Secure End-of-Life Angular Apps with ELS

Go straight to an AI summary of this blog post instead

Ever upgrade an old Angular app to a slightly less old version, thinking it’ll buy you some time, only to get slammed with a wall of red security warnings in your terminal? You think you’re moving forward, but the vulnerabilities just keep stacking up like unpaid parking tickets.

Instead of tearing everything apart or shipping insecure code, TuxCare’s Endless Lifecycle Support (ELS) gives you a way to patch vulnerabilities, stay secure, and align with Angular security best practices, all while buying time for a proper upgrade without the chaos.

Let’s break down how to get started.

The New Kid on the Block… Sort Of

If you’re maintaining a legacy Angular app that’s no longer officially supported, you’re in good company. According to npm’s website, there are still over 98,000 weekly downloads of the Angular v16 CLI, proof that plenty of teams are still relying on older versions.

The problem? Older code means older dependencies (and a growing list of security issues that can quickly violate Angular security best practices if left unpatched). It’s not that these apps suddenly became bad; it’s that the ecosystem around them keeps moving, and threat actors move even faster.

As of November 2024, Angular v16 has reached its end of life (EOL). While you can still install it (and other previous versions), official security updates have stopped.

If your app isn’t ready for a full migration yet, that’s completely normal; most production teams need stability first and modernization second.

In the examples below, we’ll use Angular v16. The most recent version still under active support is v20.

You’ve Got Options

Migrating away from Angular, or any legacy framework, isn’t as easy as clicking “Upgrade” and hoping for the best.

If you’ve ever lived through the Bootstrap 3 era, you know that sometimes “just migrate” is easier said than done. For most organizations, these older Angular apps are mission-critical, tightly coupled with backend systems, and can’t just be rewritten overnight.

You want to modernize, but maybe you don’t have the resources to do it all at once. That doesn’t mean you should have to leave your stack unprotected, or compromise on Angular security best practices while you wait.

How You Can Stay Secure without Rewriting Everything Right Now

That’s exactly where TuxCare’s Endless Lifecycle Support (ELS) for Libraries comes in.

ELS for Libraries keeps your legacy Angular versions patched and secure long after official support has ended, helping you maintain Angular security best practices and protect your production apps while upgrading on your own timeline.

No downtime, disruptions, or migrations to connect to our repository, and no “burn the boats” rewrite.

Here’s what ELS for Libraries delivers for Angular users:

Ongoing security patches for end-of-life Angular versions.
Protection against new and evolving vulnerabilities, even those that target outdated frameworks.
Compliance peace of mind, showing auditors your systems remain patched and monitored.
Breathing room to plan your migration – on your schedule, not the framework’s.

In addition to Angular, ELS for Libraries also covers end-of-life versions of various open-source libraries, including CometD, Apache Struts, Apache Spark, Spring^®, AngularJS, Netty, Vue, Next.js, and many others.

For instance, teams dealing with recent framework shifts can read our analysis on the implications of the next.js EOL or explore what happens when an organization faces an Apache Spark end of life to see how those support cycles compare.

Setting Up ELS for Libraries to Secure Angular

Below is a breakdown of how to get set up using TuxCare’s ELS for Libraries (which includes coverage for end-of-life Angular, among many other open-source libraries) to keep your apps secure and protected.

Navigate to the Angular ELS page in the documentation on the TuxCare website. You will notice that the page that is linked is dedicated to versions of Angular spanning 9, 10, 11, 12, 13, 14, 15, 16, 17, and 18. The example in the code below covers Angular v16.

First things first you need a username, password, and token from TuxCare in order to modify the registry line with the token. Once you have those credentials, proceed to step 2, contact [email protected] for that token.
Navigate to the root of your Angular directory and create an .npmrc file. Within this file is where you are going to add the provided registry info from TuxCare.

my-angular-project/

├── src/

├── angular.json

├── package.json

├── .npmrc         ⚠️ ← Create it here

└── tsconfig.json

Copy and paste this line and add it to the .npmrc file, and save. Make sure to replace your ${TOKEN} with the one provided to you.

registry=https://registry.npmjs.org/

@els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/

//nexus.repo.tuxcare.com/repository/els-js/:_auth=${TOKEN}

Open your package.json file and replace the dependencies block with the TuxCare dependencies, like below, and save.

"dependencies": {

   "@angular/animations": "npm:@els-js/[email protected]",

   "@angular/common": "npm:@els-js/[email protected]",

   "@angular/compiler": "npm:@els-js/[email protected]",

   "@angular/core": "npm:@els-js/[email protected]",

   "@angular/forms": "npm:@els-js/[email protected]",

   "@angular/platform-browser": "npm:@els-js/[email protected]",

   "@angular/platform-browser-dynamic": "npm:@els-js/[email protected]",

   "@angular/router": "npm:@els-js/[email protected]",

   "rxjs": "^7.4.0",

   "tslib": "^2.3.0",

   "zone.js": "~0.13.0"

 },

 "devDependencies": {

   "@angular-devkit/build-angular": "^16.2.12",

   "@angular/cli": "^16.2.12",

   "@angular/compiler-cli": "npm:@els-js/[email protected]",

   "@types/jasmine": "~4.3.0",

   "@types/node": "^18.7.0",

   "jasmine-core": "~4.6.0",

   "karma": "~6.4.0",

   "karma-chrome-launcher": "~3.2.0",

   "karma-coverage": "~2.2.0",

   "karma-jasmine": "~5.1.0",

   "karma-jasmine-html-reporter": "~2.1.0",

   "typescript": "~5.1.3"

 },

 "overrides": {

   "@angular/animations": "npm:@els-js/[email protected]",

   "@angular/common": "npm:@els-js/[email protected]",

   "@angular/compiler": "npm:@els-js/[email protected]",

   "@angular/core": "npm:@els-js/[email protected]",

   "@angular/forms": "npm:@els-js/[email protected]",

   "@angular/platform-browser": "npm:@els-js/[email protected]",

   "@angular/platform-browser-dynamic": "npm:@els-js/[email protected]",

   "@angular/compiler-cli": "npm:@els-js/[email protected]",

   "@angular/router": "npm:@els-js/[email protected]",

   "@babel/runtime": "7.26.10",

   "esbuild": "0.25.0",

   "rxjs": "^7.4.0",

   "[email protected]": "npm:@els-js/[email protected]",

   "[email protected]": "npm:@els-js/[email protected]",

   "[email protected]": "npm:@els-js/[email protected]",

   "[email protected]": "npm:@els-js/[email protected]"

 },

You have to remove node_modules and package-lock.json, and clear the cache. Be sure to run the command below.

rm -rf node_modules package-lock.json && npm cache clean --force

Make sure your npm version is up to date. This is for security and compliance reasons. If you aren’t running a version of npm 9.6.3 or later, run the command below.

npm install -g npm@latest

Now you should be good to run the npm install command to install the Angular v16 ELS solution.

npm install

The output below is an example of what it should look like. Your mileage may vary.

added 925 packages, and audited 926 packages in 3m


158 packages are looking for funding

  run `npm fund` for details


found 0 vulnerabilities

Final Thoughts

End-of-life doesn’t have to mean end-of-security. With TuxCare’s Endless Lifecycle Support (ELS) for Libraries, you can keep your Angular apps secure, compliant, and in line with Angular security best practices – long after official support ends, and without rewriting core functionality or overhauling your stack.

For developers and teams managing production-critical apps, ELS acts like a safety net – patching vulnerabilities in the background so you can focus on shipping features, not chasing CVEs.

Whether you’re maintaining Angular v9, v16, or anything in between, TuxCare helps you bridge the gap between today’s workloads and tomorrow’s upgrade plans, no downtime, no rush, no surprises.

Ready to learn more?

Explore the full list of supported libraries and frameworks at https://tuxcare.com/endless-lifecycle-support/libraries-eol-support/.

Summary