build(deps): bump @angular/compiler from 20.3.6 to 20.3.18 in /samples/client/others/typescript-angular-v20

[dependabot]

Bumps @angular/compiler from 20.3.6 to 20.3.18.

Release notes

Sourced from @​angular/compiler's releases.

20.3.18

compiler

Commit	Description
	disallow translations of iframe src

core

Commit	Description
	sanitize translated attribute bindings with interpolations
	sanitize translated form attributes

20.3.17

core

Commit	Description
	block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

• Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

  (cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

20.3.16

core

Commit	Description
	sanitize sensitive attributes on SVG script elements

20.3.15

compiler

Commit	Description
	prevent XSS via SVG animation attributeName and MathML/SVG URLs

20.3.14

http

Commit	Description
	prevent XSRF token leakage to protocol-relative URLs

20.3.13

No release notes provided.

20.3.12

No release notes provided.

20.3.11

common

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

20.3.18 (2026-03-12)

compiler

Commit	Type	Description
02fbf08890	fix	disallow translations of iframe src

core

Commit	Type	Description
72126f9a08	fix	sanitize translated attribute bindings with interpolations
626bc8bc20	fix	sanitize translated form attributes

22.0.0-next.3 (2026-03-12)

compiler

Commit	Type	Description
78dea55351	fix	disallow translations of iframe src

core

Commit	Type	Description
999c14eaab	fix	reverts "feat(core): add support for nested animations"
de0eb4c656	fix	sanitize translated form attributes

21.2.4 (2026-03-12)

compiler

Commit	Type	Description
ed2d324f9c	fix	disallow translations of iframe src

core

Commit	Type	Description
abbd8797bb	fix	reverts "feat(core): add support for nested animations"
d1dcd16c5b	fix	sanitize translated form attributes

22.0.0-next.2 (2026-03-11)

Breaking Changes

core

• createNgModuleRef was removed, use createNgModule instead

core

Commit	Type	Description
b918beda32	feat	allow debouncing signals

... (truncated)

Commits

• 02fbf08 fix(compiler): disallow translations of iframe src
• c2c2b4a fix(core): sanitize sensitive attributes on SVG script elements
• d1ca8ae fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
• f689269 Revert "fix(compiler): support one additional level of nesting in :host()"
• 7b2e6ca Revert "fix(compiler): support arbitrary nesting in :host-context()"
• 6036eef Revert "fix(compiler): support commas in :host() argument"
• a44658b Revert "fix(compiler): support complex selectors in :nth-child()"
• 9419ea3 fix(compiler): support complex selectors in :nth-child()
• 2531863 test(compiler): add test for :host:has(> .foo)
• 106b904 fix(compiler): support commas in :host() argument
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Upgrade @angular/compiler to 20.3.18 in the TypeScript Angular v20 sample to pick up security hardening and compiler fixes. This blocks risky translations (e.g., iframe src) and tightens SVG/MathML URL handling.

• Dependencies
  • Bump @angular/compiler from 20.3.6 to 20.3.18 in samples/client/others/typescript-angular-v20.

^{Written for commit 0b9940f. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/client/others/typescript-angular-v20/package.json">

<violation number="1" location="samples/client/others/typescript-angular-v20/package.json:27">
P1: This bump leaves the sample on mismatched Angular patch versions: the lockfile resolves `@angular/compiler` 20.3.18, but `@angular/compiler-cli` and `@angular/core` stay on 20.3.6 and both require `@angular/compiler` 20.3.6. Update the companion Angular packages and lockfile together.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: This bump leaves the sample on mismatched Angular patch versions: the lockfile resolves @angular/compiler 20.3.18, but @angular/compiler-cli and @angular/core stay on 20.3.6 and both require @angular/compiler 20.3.6. Update the companion Angular packages and lockfile together.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/others/typescript-angular-v20/package.json, line 27:

<comment>This bump leaves the sample on mismatched Angular patch versions: the lockfile resolves `@angular/compiler` 20.3.18, but `@angular/compiler-cli` and `@angular/core` stay on 20.3.6 and both require `@angular/compiler` 20.3.6. Update the companion Angular packages and lockfile together.</comment>

<file context>
@@ -24,7 +24,7 @@
   "dependencies": {
     "@angular/common": "^20.3.0",
-    "@angular/compiler": "^20.3.0",
+    "@angular/compiler": "^20.3.18",
     "@angular/core": "^20.3.0",
     "@angular/forms": "^20.3.0",
</file context>

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.