Angular
Endless Lifecycle Support (ELS) for Angular from TuxCare provides security fixes for Angular versions that have reached their end of life. This allows you to continue running Angular applications without vulnerability concerns, even after official support has ended.
Supported Angular Versions
Angular versions 9, 10, 11, 12, 13, 14, 15, 16, 17, and 18 are supported.
Connection to ELS for Angular Repository
This guide outlines the steps needed to integrate the TuxCare ELS for Angular repository.
Step 1: Get Token
You need a token in order to use TuxCare ELS Angular repository. Anonymous access is disabled. To receive the token, please contact sales@tuxcare.com.
Step 2: Set Up ELS for Angular
TuxCare provides ELS for Angular as an NPM package, hosted on a secure internal registry. Follow the steps below to add it to your project and get started.
Navigate to the root directory of your Angular project.
Create a
.npmrc
file or update it if it already exists.Example:
my-angular-project/ ├── src/ ├── angular.json ├── package.json ├── .npmrc ⚠️ ← Create it here └── tsconfig.json
Use an editor of your choice (e.g., VS Code) to add the following registry address line:
registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN}
Replace ${TOKEN} with the token you received from sales@tuxcare.com.
Update your
package.json
file to replace your Angular dependencies with the TuxCare packages.Choose Angular version:Use "SSR ON" if your project is configured with Server-Side Rendering, otherwise use "SSR OFF".
To check whether your Angular project is configured with Server-Side Rendering, look for
@angular/ssr
listed in your originalpackage.json
file before replacing dependencies. If you see@angular/ssr
listed, SSR is ON, otherwise SSR is OFF."dependencies": { "@angular/animations": "npm:@els-js/angular-animations@18.2.13-tuxcare.1", "@angular/common": "npm:@els-js/angular-common@18.2.13-tuxcare.1", "@angular/compiler": "npm:@els-js/angular-compiler@18.2.13-tuxcare.1", "@angular/core": "npm:@els-js/angular-core@18.2.13-tuxcare.1", "@angular/forms": "npm:@els-js/angular-forms@18.2.13-tuxcare.1", "@angular/platform-browser": "npm:@els-js/angular-platform-browser@18.2.13-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-js/angular-platform-browser-dynamic@18.2.13-tuxcare.1", "@angular/platform-server": "npm:@els-js/angular-platform-server@18.2.13-tuxcare.1", "@angular/router": "npm:@els-js/angular-router@18.2.13-tuxcare.1", "@angular/ssr": "^18.2.20", "express": "^4.18.2", "rxjs": "^7.4.0", "tslib": "^2.3.0", "zone.js": "~0.14.10" }, "devDependencies": { "@angular-devkit/build-angular": "^18.2.20", "@angular/cli": "^18.2.20", "@angular/compiler-cli": "npm:@els-js/angular-compiler-cli@18.2.13-tuxcare.1", "@types/express": "^4.17.17", "@types/jasmine": "~5.1.0", "@types/node": "^18.18.0", "jasmine-core": "~5.2.0", "karma": "~6.4.0", "karma-chrome-launcher": "~3.2.0", "karma-coverage": "~2.2.0", "karma-jasmine": "~5.1.0", "karma-jasmine-html-reporter": "~2.1.0", "typescript": "~5.5.2" }, "overrides": { "@angular/animations": "npm:@els-js/angular-animations@18.2.13-tuxcare.1", "@angular/common": "npm:@els-js/angular-common@18.2.13-tuxcare.1", "@angular/compiler": "npm:@els-js/angular-compiler@18.2.13-tuxcare.1", "@angular/core": "npm:@els-js/angular-core@18.2.13-tuxcare.1", "@angular/forms": "npm:@els-js/angular-forms@18.2.13-tuxcare.1", "@angular/platform-browser": "npm:@els-js/angular-platform-browser@18.2.13-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-js/angular-platform-browser-dynamic@18.2.13-tuxcare.1", "@angular/platform-server": "npm:@els-js/angular-platform-server@18.2.13-tuxcare.1", "@angular/router": "npm:@els-js/angular-router@18.2.13-tuxcare.1", "@angular/compiler-cli": "npm:@els-js/angular-compiler-cli@18.2.13-tuxcare.1", "rxjs": "^7.4.0", "esbuild": "0.25.0", "tmp@0.0.33": "npm:@els-js/tmp@0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-js/tmp@0.2.1-tuxcare.1" }
If you use any of the following non-default Angular modules, update their versions as shown below:
- "@angular/language-service": "npm:@els-js/angular-language-service@18.2.13-tuxcare.1",
- "@angular/upgrade": "npm:@els-js/angular-upgrade@18.2.13-tuxcare.1",
- "@angular/elements": "npm:@els-js/angular-elements@18.2.13-tuxcare.1",
- "@angular/service-worker": "npm:@els-js/angular-service-worker@18.2.13-tuxcare.1",
After adding these aliases, make sure the same modules are also listed in the
overrides
section, just like the default ones.You need to remove the
node_modules
directory and thepackage-lock.json
file, and also clear thenpm cache
before installing the patched packages. Use the following commands:rm -rf node_modules package-lock.json && npm cache clean --force
Ensure your npm is up to date.
Use npm version 9.6.3 or later for security and compatibility reasons. To update npm globally on your system, you can run:
npm install -g npm@latest
Run the following command to install ELS for Angular dependencies (token for the TuxCare repository will be automatically picked up from your
.npmrc
file):npm install
You will see an output like:
added 925 packages, and audited 926 packages in 3m 158 packages are looking for funding run `npm fund` for details found 0 vulnerabilities
You've successfully integrated the TuxCare ELS for Angular repository into your project.
How to Upgrade to a Newer Version of TuxCare Packages
If you have already installed a package with a tuxcare.1
suffix and want to upgrade to a newer release (for example, tuxcare.3
), you need to update the version string in your package.json
, remove installed files and clear npm cache to avoid conflicts:
rm -rf node_modules package-lock.json && npm cache clean --force
npm install
Resolved CVEs
Fixes for the following vulnerabilities are available in ELS for Angular from TuxCare versions:
CVE ID | CVE Type | Severity | Affected Library | Vulnerable Versions | Fixed in version |
---|---|---|---|---|---|
CVE-2025-59052 | Direct | High | @angular/platform-server | = 16.0.0-next.0 < 18.2.14 | tuxcare.1 |
CVE-2025-59052 | Direct | High | @angular/ssr | = 17.0.0-next.0 < 18.2.21 | tuxcare.1 |
GHSA-67mh-4wv8-2f99 | Transitive | Moderate | esbuild | <= 0.24.2 | tuxcare.1 |
CVE-2025-32997 | Transitive | Moderate | http-proxy-middleware | 1.3.0 - 2.0.8 | tuxcare.1 |
CVE-2025-30360 | Transitive | Moderate | webpack-dev-server | <= 5.2.0 | tuxcare.1 |
CVE-2025-30359 | Transitive | Moderate | webpack-dev-server | <= 5.2.0 | tuxcare.1 |
CVE-2025-54798 | Transitive | Low | tmp | <= 0.2.3 | tuxcare.1 |
If you are interested in the TuxCare Endless Lifecycle Support, contact sales@tuxcare.com.