@brickhouse-tech/angular-lts 1.9.3 → 1.9.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +138 -53
  2. package/angular.js +5 -5
  3. package/angular.min.js +2 -2
  4. package/package.json +1 -1
package/README.md CHANGED
@@ -1,81 +1,166 @@
1
- AngularJS LTS — Community Security Patches
2
- ===========================================
1
+ # AngularJS 1.x Security Patches — Free, Drop-in, MIT Licensed
3
2
 
4
- > **This is a community-maintained fork of AngularJS 1.x** providing security patches for known CVEs.
5
- > The original AngularJS project reached End-of-Life in January 2022 and no longer receives updates.
3
+ [![npm version](https://img.shields.io/npm/v/@brickhouse-tech/angular-lts?logo=npm)](https://www.npmjs.com/package/@brickhouse-tech/angular-lts)
4
+ [![npm downloads](https://img.shields.io/npm/dm/@brickhouse-tech/angular-lts)](https://www.npmjs.com/package/@brickhouse-tech/angular-lts)
5
+ [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
6
+ [![CVEs Patched](https://img.shields.io/badge/CVEs%20Patched-11-green)](https://github.com/brickhouse-tech/angular.js/blob/master/SECURITY.md)
6
7
 
7
- ## Why This Fork?
8
+ > **Production-ready security patches for AngularJS 1.x** — All 11 known CVEs patched. Zero code changes required. Open source alternative to $15K–$50K/year commercial support.
8
9
 
9
- AngularJS still has **~2 million monthly npm downloads**. Thousands of enterprise applications depend on it.
10
- The only alternative for security patches was expensive commercial support ($15K–$50K+/year).
11
- This fork provides **free, open-source security patches** as a drop-in replacement.
10
+ **[Try the Live Demo →](https://brickhouse-tech.github.io/angular-lts-demo/)**
12
11
 
13
- ## What's Included
12
+ ---
14
13
 
15
- - ✅ **11 CVE/vulnerability fixes** (2 HIGH, 9 MEDIUM) — see table below
16
- - ✅ **Drop-in replacement** — same API, same behavior, just patched
17
- - ✅ **CI via GitHub Actions** — tested on Node 20
18
- - ✅ **OIDC npm publishing** with provenance
19
- - ✅ **MIT licensed** — same as upstream
14
+ ## The Problem
20
15
 
21
- ## Security Patches
16
+ AngularJS reached **End-of-Life in January 2022**. Google stopped all maintenance and security updates.
22
17
 
23
- | CVE / Snyk ID | Severity | Type | Status |
24
- |---|---|---|---|
25
- | SNYK-JS-ANGULAR-6091113 | **HIGH** | ReDoS in `ng-srcset` directive | ✅ Fixed |
26
- | CVE-2022-25844 | **HIGH** | ReDoS in `angular.copy` | ✅ Fixed |
27
- | SNYK-JS-ANGULAR-9919773 | Medium | SVG `<image>` href sanitization bypass | ✅ Fixed |
28
- | SNYK-JS-ANGULAR-7924843 | Medium | `srcset` allowlist bypass | ✅ Fixed |
29
- | SNYK-JS-ANGULAR-7924842 | Medium | `<source>` srcset not sanitized | ✅ Fixed |
30
- | SNYK-JS-ANGULAR-3373046 / CVE-2020-7212 | Medium | ReDoS in URL input validation | ✅ Fixed |
31
- | SNYK-JS-ANGULAR-3373045 | Medium | ReDoS in `$resource` service | ✅ Fixed |
32
- | CVE-2020-7676 | Medium | Prototype pollution via `merge`/`copy` | ✅ Fixed |
33
- | SNYK-JS-ANGULAR-2949781 | Medium | XSS via `<textarea>` (IE-specific) | ✅ Fixed |
34
- | SNYK-JS-ANGULAR-2772735 | Medium | ReDoS in date format regex | ✅ Fixed |
35
- | CVE-2022-25869 | Medium | `$sanitize` bypass via `<style>` (IE/Edge) | ✅ Fixed |
18
+ Yet the framework still has:
19
+ - **~2 million monthly downloads** on npm
20
+ - Thousands of production applications in Fortune 500 companies
21
+ - **11 unpatched security vulnerabilities** (2 HIGH, 9 MEDIUM severity)
22
+ - No official migration path that doesn't require a complete rewrite
36
23
 
37
- ## Installation
24
+ Most enterprises face three bad options:
25
+ 1. **Stay on 1.8.3** with known CVEs → fails security audits, compliance reviews
26
+ 2. **Rewrite to modern Angular/React/Vue** → $500K+ and 12–24 months
27
+ 3. **Pay $15K–$50K+/year** for commercial Extended Support
38
28
 
29
+ ---
30
+
31
+ ## The Solution
32
+
33
+ **@brickhouse-tech/angular-lts** is a community-maintained fork that patches all known security vulnerabilities in AngularJS 1.x.
34
+
35
+ ✅ **All 11 CVEs patched** — 2 HIGH, 9 MEDIUM severity vulnerabilities fixed
36
+ ✅ **Drop-in replacement** — Same API, same behavior, zero code changes
37
+ ✅ **MIT licensed** — Free and open source, forever
38
+ ✅ **Actively maintained** — CI/CD, npm provenance, GitHub security advisories
39
+ ✅ **Production-ready** — Latest version **1.9.3** on npm
40
+
41
+ **One command. Zero refactoring. Full security compliance.**
42
+
43
+ ---
44
+
45
+ ## Security Vulnerabilities Patched
46
+
47
+ | # | Vulnerability ID | Severity | CVSS | Vulnerability Type | Status |
48
+ |---|-----------------|----------|------|-------------------|--------|
49
+ | 1 | [SNYK-JS-ANGULAR-9919773](https://security.snyk.io/vuln/SNYK-JS-ANGULAR-9919773) | Medium | 5.3 | Incomplete Filtering (SVG href) | ✅ Fixed in 1.8.4+ |
50
+ | 2 | [SNYK-JS-ANGULAR-7924843](https://security.snyk.io/vuln/SNYK-JS-ANGULAR-7924843) | Medium | 5.3 | srcset bypass | ✅ Fixed in 1.8.4+ |
51
+ | 3 | [SNYK-JS-ANGULAR-7924842](https://security.snyk.io/vuln/SNYK-JS-ANGULAR-7924842) | Medium | 5.3 | srcset source spoofing | ✅ Fixed in 1.8.4+ |
52
+ | 4 | [SNYK-JS-ANGULAR-6091113](https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113) | **High** | 7.5 | ReDoS ng-srcset | ✅ Fixed in 1.8.4+ |
53
+ | 5 | [SNYK-JS-ANGULAR-3373044](https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373044) | Medium | 5.3 | ReDoS angular.copy() | ✅ Fixed in 1.8.4+ |
54
+ | 6 | [SNYK-JS-ANGULAR-3373046](https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373046) | Medium | 5.3 | ReDoS input[type=url] | ✅ Fixed in 1.8.4+ |
55
+ | 7 | [SNYK-JS-ANGULAR-3373045](https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373045) | Medium | 5.3 | ReDoS $resource | ✅ Fixed in 1.8.4+ |
56
+ | 8 | [SNYK-JS-ANGULAR-2949781](https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781) | Medium | 6.1 | XSS textarea (IE) | ✅ Fixed in 1.8.4+ |
57
+ | 9 | [SNYK-JS-ANGULAR-2772735](https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2772735) | Medium | 5.3 | ReDoS DATE_FORMATS | ✅ Fixed in 1.8.4+ |
58
+ | 10 | [CVE-2022-25869](https://nvd.nist.gov/vuln/detail/CVE-2022-25869) | Medium | 6.1 | $sanitize bypass style (IE/Edge) | ✅ Fixed in 1.8.4+ |
59
+ | 11 | [CVE-2022-25844](https://nvd.nist.gov/vuln/detail/CVE-2022-25844) / [CVE-2020-7676](https://nvd.nist.gov/vuln/detail/CVE-2020-7676) / [CVE-2020-7212](https://nvd.nist.gov/vuln/detail/CVE-2020-7212) | High+Medium | 7.5 | ReDoS + XSS + Proto Pollution | ✅ Fixed in 1.8.4+ |
60
+
61
+ **All patches tested and verified.** Full details in [SECURITY.md](SECURITY.md).
62
+
63
+ ---
64
+
65
+ ## Migration Guide
66
+
67
+ ### Step 1: Uninstall the old package
68
+ ```bash
69
+ npm uninstall angular
70
+ ```
71
+
72
+ ### Step 2: Install @brickhouse-tech/angular-lts
39
73
  ```bash
40
74
  npm install @brickhouse-tech/angular-lts
41
75
  ```
42
76
 
43
- Drop-in replacement for `angular@1.8.3`. Same API, same behavior.
77
+ **That's it.** No code changes. No configuration. No build changes. Same API, same behavior, just patched.
44
78
 
45
- ## Migration from `angular`
79
+ Your `package.json` should now show:
80
+ ```json
81
+ {
82
+ "dependencies": {
83
+ "@brickhouse-tech/angular-lts": "^1.9.3"
84
+ }
85
+ }
86
+ ```
46
87
 
47
- ```diff
48
- - "angular": "1.8.3"
49
- + "@brickhouse-tech/angular-lts": "^1.8.4"
88
+ If you're using a CDN, point to:
89
+ ```html
90
+ <script src="https://unpkg.com/@brickhouse-tech/angular-lts@1.9.3/angular.min.js"></script>
50
91
  ```
51
92
 
52
- No code changes required.
93
+ ---
53
94
 
54
- ## Sponsorship
95
+ ## @brickhouse-tech/angular-lts vs. HeroDevs NES
55
96
 
56
- This project is maintained by [Brickhouse Tech](https://github.com/brickhouse-tech).
57
- If your organization depends on AngularJS, consider sponsoring to ensure continued maintenance.
97
+ HeroDevs offers commercial Extended Support for AngularJS (NES). It's a solid option for enterprises that need vendor backing. But it's expensive — and unnecessary for most teams.
58
98
 
59
- [![Sponsor](https://img.shields.io/badge/sponsor-brickhouse--tech-blue?logo=github)](https://github.com/sponsors/brickhouse-tech)
99
+ | Feature | @brickhouse-tech/angular-lts | HeroDevs NES |
100
+ |---------|------------------------------|--------------|
101
+ | **Price** | **Free (MIT)** | **$15,000–$50,000+/year** |
102
+ | **Security patches** | ✅ All 11 CVEs patched | ✅ All known CVEs patched |
103
+ | **Drop-in replacement** | ✅ Zero code changes | ✅ Zero code changes |
104
+ | **Open source** | ✅ MIT license, public repo | ❌ Proprietary, closed source |
105
+ | **npm package** | ✅ Public npm | ✅ Private npm registry |
106
+ | **Community support** | ✅ GitHub issues | ❌ Paid support only |
107
+ | **SLA** | ❌ Best-effort (Enterprise tier available) | ✅ Contractual SLA |
108
+ | **Custom patches** | ❌ (Enterprise tier available) | ✅ Custom backports |
109
+ | **Compliance docs** | ❌ (Enterprise tier available) | ✅ Audit reports, attestations |
60
110
 
61
- | Tier | Price | Benefits |
62
- |------|-------|----------|
63
- | Community | Free | Open source patches, npm package |
64
- | Supporter | $50/mo | Logo on README, priority issues |
65
- | Professional | $500/mo | 48h SLA, private Slack, migration guidance |
66
- | Enterprise | $5,000/mo | 4h SLA, custom patches, compliance docs |
111
+ **Bottom line:** If you just need the CVEs patched, use @brickhouse-tech/angular-lts and save $15K–$50K/year. If you need vendor SLAs and compliance paperwork, consider our Enterprise tier or HeroDevs.
67
112
 
68
- ## Versioning
113
+ ---
69
114
 
70
- This fork follows the upstream `1.8.x` line. Security patches are published as `1.8.4+` releases.
71
- Prerelease versions use the format `1.8.4-N`.
115
+ ## Enterprise Support
72
116
 
73
- ## License
117
+ Need more than open source patches? We offer commercial support tiers for teams that require SLAs, priority patches, or custom backports.
74
118
 
75
- MIT — same as the original AngularJS project. See [LICENSE](LICENSE).
119
+ | Tier | Price | What You Get |
120
+ |------|-------|--------------|
121
+ | **Community** | **Free** | Open source patches, GitHub issues, npm package |
122
+ | **Professional** | **$500/month** | 48-hour SLA, private Slack channel, priority bug fixes |
123
+ | **Enterprise** | **$5,000/month** | 4-hour SLA, custom patches, compliance documentation, audit support |
124
+
125
+ **[Get Enterprise Support →](https://brickhouse-tech.lemonsqueezy.com)**
126
+
127
+ ---
128
+
129
+ ## Support This Project
130
+
131
+ This fork is maintained by [Brickhouse Tech](https://github.com/brickhouse-tech) and community contributors. If your organization depends on AngularJS, consider sponsoring to ensure continued maintenance and faster patch releases.
132
+
133
+ **[Sponsor on GitHub →](https://github.com/sponsors/brickhouse-tech)**
134
+
135
+ Every contribution helps keep this project alive for the thousands of teams still running AngularJS in production.
136
+
137
+ ---
138
+
139
+ ## Technical Details
140
+
141
+ - **Upstream:** Based on `angular@1.8.3` (final official release)
142
+ - **Current version:** `1.9.3` (includes all security patches)
143
+ - **Testing:** CI via GitHub Actions, tested on Node 20+
144
+ - **Publishing:** OIDC npm publishing with provenance attestation
145
+ - **License:** MIT (same as original AngularJS)
146
+
147
+ ---
76
148
 
77
149
  ## Links
78
150
 
79
- - **npm**: [@brickhouse-tech/angular-lts](https://www.npmjs.com/package/@brickhouse-tech/angular-lts)
80
- - **Original project**: [angular/angular.js](https://github.com/angular/angular.js) (archived)
81
- - **HeroDevs NES** (commercial alternative): [herodevs.com](https://www.herodevs.com/support/angularjs-nes)
151
+ - **npm:** [@brickhouse-tech/angular-lts](https://www.npmjs.com/package/@brickhouse-tech/angular-lts)
152
+ - **Demo:** [https://brickhouse-tech.github.io/angular-lts-demo/](https://brickhouse-tech.github.io/angular-lts-demo/)
153
+ - **Security advisories:** [SECURITY.md](SECURITY.md)
154
+ - **Original project:** [angular/angular.js](https://github.com/angular/angular.js) (archived)
155
+ - **GitHub Sponsors:** [https://github.com/sponsors/brickhouse-tech](https://github.com/sponsors/brickhouse-tech)
156
+ - **Enterprise Support:** [https://brickhouse-tech.lemonsqueezy.com](https://brickhouse-tech.lemonsqueezy.com)
157
+
158
+ ---
159
+
160
+ ## License
161
+
162
+ MIT — same as the original AngularJS project. See [LICENSE](LICENSE) for full text.
163
+
164
+ ---
165
+
166
+ **Built with ❤️ by [Brickhouse Tech](https://github.com/brickhouse-tech) and community contributors.**
package/angular.js CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * @license AngularJS v1.9.4-local+sha.b958273
2
+ * @license AngularJS v1.9.5-local+sha.43c9597
3
3
  * (c) 2010-2020 Google LLC. http://angularjs.org
4
4
  * License: MIT
5
5
  */
@@ -99,7 +99,7 @@ function isValidObjectMaxDepth(maxDepth) {
99
99
  function minErr(module, ErrorConstructor) {
100
100
  ErrorConstructor = ErrorConstructor || Error;
101
101
 
102
- var url = 'https://errors.angularjs.org/1.9.4-local+sha.b958273/';
102
+ var url = 'https://errors.angularjs.org/1.9.5-local+sha.43c9597/';
103
103
  var regex = url.replace('.', '\\.') + '[\\s\\S]*';
104
104
  var errRegExp = new RegExp(regex, 'g');
105
105
 
@@ -2836,10 +2836,10 @@ function toDebugString(obj, maxDepth) {
2836
2836
  var version = {
2837
2837
  // These placeholder strings will be replaced by grunt's `build` task.
2838
2838
  // They need to be double- or single-quoted.
2839
- full: '1.9.4-local+sha.b958273',
2839
+ full: '1.9.5-local+sha.43c9597',
2840
2840
  major: 1,
2841
2841
  minor: 9,
2842
- dot: 4,
2842
+ dot: 5,
2843
2843
  codeName: 'snapshot'
2844
2844
  };
2845
2845
 
@@ -2991,7 +2991,7 @@ function publishExternalAPI(angular) {
2991
2991
  });
2992
2992
  }
2993
2993
  ])
2994
- .info({ angularVersion: '1.9.4-local+sha.b958273' });
2994
+ .info({ angularVersion: '1.9.5-local+sha.43c9597' });
2995
2995
  }
2996
2996
 
2997
2997
  /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *