chore: upgrade Angular 19 → 20 to resolve security vulnerabilities

[yogeshchoudhary147]

Summary

• Bumps all @angular/* packages from v19.2.x to v20.3.26
• Aligns build tooling (@angular-devkit/build-angular, @angular/cli, ng-packagr, @angular-eslint/*) to their v20 counterparts
• Fixes four CVEs reported by Snyk at High/Critical severity
• Disables the @angular-eslint/prefer-inject rule introduced in @angular-eslint@20 (constructor injection is still fully supported in Angular 20; migration to inject() can be done in a follow-up PR)

Why v20 and not a v19 patch

No fix was backported to v19 — 19.2.25 is the latest Angular 19 release and remains vulnerable per Snyk. The fix only exists in v20.3.25+. Staying on v19 is also not viable as its LTS window ended May 2026, meaning Google is no longer issuing security patches for it.

Security fixes

CVE	Package	Severity
ReDoS	@angular/common@19.x	High
Use of Weak Hash	@angular/common@19.x	Critical
XSS	@angular/compiler@19.x	High
Modification of Assumed-Immutable Data	@angular/core@19.x	High

Package changes

Package	Before	After
@angular/* (7 deps)	^19.2.21	^20.3.26
@angular/compiler-cli	^19.2.21	^20.3.26
@angular/forms	^19.2.21	^20.3.26
@angular-devkit/build-angular	^19.2.24	^20.3.32
@angular/cli	^19.2.24	^20.3.32
@angular-eslint/* (5 packages)	^19.0.0	^20.7.0
ng-packagr	^19.2.2	^20.3.2

No changes to jest, jest-preset-angular, @types/jest, or typescript — build-angular 20.x still supports jest@^29.x and jest-preset-angular@14.x supports @angular/compiler-cli <21.0.0.

Consumer impact

No changes to the library's public API or peerDependencies (>=13). The library source code is unchanged. However, the compiled output now uses Angular 20's toolchain; consumers on older Angular versions should test their integration as Angular does not guarantee cross-version compiler compatibility.

Test plan

• npm run build:dev passes
• npm test — all 184 tests pass
• npm run lint passes
• CI passes

[coderabbitai]

📝 Walkthrough

Walkthrough

Angular runtime, development tooling, ESLint packages, and ng-packagr versions are upgraded from Angular 19-compatible releases to Angular 20-compatible releases.

Changes

Angular 20 upgrade

Layer / File(s)	Summary
Angular runtime and build tooling versions package.json	Angular runtime, router, CLI, compiler, build, ESLint, forms, and ng-packagr dependencies are updated to Angular 20 versions.

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested reviewers: cschetan77

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: upgrading Angular 19 to 20 for security remediation.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/angular-20-migration

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}