[Snyk] Security upgrade @angular-devkit/build-angular from 18.2.12 to 20.2.0

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• chargebee-js-angular/package.json
• chargebee-js-angular/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Directory Traversal SNYK-JS-ROLLUP-15340920	700

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

[snyk-io]

This upgrade from v18 to v20 introduces significant breaking changes, primarily centered around a new build system and the deprecation of the Karma test runner.

Key Breaking Changes:

• New Build System: The default build package is changing from @angular-devkit/build-angular to the new @angular/build. This new system uses esbuild instead of Webpack. While a migration is attempted during the update, complex or custom build configurations may require manual intervention.
• Karma Test Runner Removed: The new build system does not support the Karma test runner. Consequently, ng test will fail after the upgrade. The official recommendation is to migrate to a modern test runner like Jest or Vitest.
• ng-reflect-* Attributes Removed: Angular no longer adds ng-reflect-* attributes to elements in development mode. Any tests that rely on these attributes for querying elements will break and must be updated. A temporary provider (provideNgReflectAttributes) is available as a short-term fix.
• SSR Builder Deprecated: The @angular-devkit/build-angular:server builder used for Server-Side Rendering is deprecated in v19 and has been replaced by functionality within the new unified application builder.
• Structural Directives Deprecated: The common structural directives *ngIf, *ngFor, and *ngSwitch are now deprecated in favor of the new @ control flow syntax. While they are not yet removed, migration is recommended.

Recommendation:
This is a high-impact upgrade that will require significant testing and likely manual intervention. Before merging, you must:

1. Plan the migration of your unit tests from Karma to Jest or Vitest.
2. Thoroughly review and test your application's build and SSR configurations after the update.
3. Audit your test suite for any reliance on ng-reflect-* attributes and refactor them.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[hivel-marco]

Secrets found in the following files: chargebee-js-angular/package-lock.json
PII found in the following files: chargebee-js-angular/package-lock.json

• chargebee-js-angular/package.json
  PR has too many lines changed - Skipping review. Please keep lines changed under 2000 for high quality reviews