Continue to receive timely and reliable security updates for Angular vulnerabilities for as many years as you need.
TuxCare keeps you ahead of threats by proactively tracking and patching new CVEs impacting AngularJS. View all security fixes available to date here.
This means you will no longer get security updates for these versions from Google.
Continue to receive timely and reliable security updates for Angular vulnerabilities for as many years as you need.
Avoid code refactoring and keep your Angular applications running smoothly while you strategize your upgrade.
Gain 14-day SLAs for security fixes to maintain compliance with standards including PCI DSS, ISO 27001, HIPAA, and others.
Endless Lifecycle Support for Angular delivers continued security support for:
If It's Open Source
and Not on Our List,
2,700+
Enterprise Clients
70,000+Packages Curated
420,000+
Patches Delivered
14,000+
Vulnerabilities Fixed
11,000+
Kernels Supported
70+
Linux Distro Versions Supported
15 years of proven excellence in open-source patching have created highly
automated processes and systems, providing:
We provide long-term security across your entire stack, supporting a wide and continually expanding set of open-source projects, libraries, and runtimes – all from a single, trusted partner.
We utilize advanced automation across CVE discovery, backporting, building, and release workflows to accelerate delivery and ensure the highest possible quality of security patches.
We go beyond surface-level scanning to uncover and fix hidden vulnerabilities deep in your dependency trees, securing the entire software supply chain with precision and scale.
Automated pipelines and mature workflows ensure rapid, reliable patch delivery backed by SLAs – giving you confidence in your risk management and compliance posture.
About 18 months — roughly six months of active support plus twelve months of LTS. With a major release every six months, versions age out fast: Angular 19 reached end of life in May 2026. ELS extends security coverage well past that 18-month window.
Angular 4 through 19. Coverage spans the interdependent @angular/* package set — core, common, compiler, forms, router, platform-browser, platform-server, CLI, compiler-cli, localize, service worker, and SSR — so the framework stays internally consistent.
Yes. TuxCare patches the version you run, which matters because Angular upgrades are chained — you can't skip majors, and each hop drags TypeScript, RxJS, Node, and Angular Material peer-dependency bumps with it. A four-version gap is a multi-sprint project.
No. Patched packages come from TuxCare's @els-angular registry, configured in .npmrc and aliased in package.json. Templates, decorators, DI, ng build, and ng serve all behave the same. The docs cover both SSR and non-SSR project layouts, and require npm 9.6.3 or later.
Yes, the packages are Docker compatible. Registry configuration and the auth token need to be available at the dependency-installation stage of the build — handle the token through your secrets manager rather than baking it into the image.
TuxCare targets 14 days from disclosure for critical and high-severity CVEs (CVSS 7.0+), 60 days for medium, and 90 days for low. Each patched release ships with SBOM and CycloneDX VEX data so scanners can tell a remediated build from the vulnerable upstream version.