Angular developers looking to stay up-to-date should note the subtle yet important differences between @angular/core versions 4.3.5 and 4.3.6. Both versions, described as the core framework for Angular applications, share the same fundamental characteristics: they rely on identical dependencies, tslib (^1.7.1), and require the same peer dependencies, namely rxjs (^5.0.1) and zone.js (^0.8.4). This indicates a high degree of compatibility for projects already utilizing these versions. Further commonalities include the MIT license, ensuring developers can freely use and modify the framework, and the official Angular GitHub repository for access to the source code and contribution opportunities. The author of both versions is credited as "angular," indicating the consistent involvement of the core Angular team.
The essential distinction lies in the version number itself, a minor increment suggesting bug fixes and potentially small feature enhancements. A crucial point for developers is the release date: version 4.3.6 was published on August 23, 2017, while version 4.3.5 was released on August 16, 2017, about a week earlier. This time difference implies that 4.3.6 likely addresses issues uncovered in the previous release. Reviewing the Angular changelog and release notes for the period encompassing these versions would give developers a complete picture. While the core functionalities remain consistent, upgrading to 4.3.6 is generally recommended to benefit from the latest improvements and potential bug resolutions. Both versions are retrievable from the npm registry using the provided tarball URLs, but always ensure to check for breaking changes before upgrading between versions.
All the vulnerabilities related to the version 4.3.6 of the package
Cross site scripting in Angular
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 10.2.5, 11.0.5 or 11.1.0-next.3 is advised to to address this issue.