The Angular 2 Rewrite Turns a Migration Lesson Into a Security Bill: AngularJS Still Draws 533,480 Downloads a Week, and 10 Advisories Have No Open-Source Fix

On October 28, The Register published “How Google fumbled the frontend with Angular 2,” Joab Jackson’s account of a talk by Stephen Fluin at the All Things Open conference. Fluin, the article says, worked on the Angular project at Google from 2016 to 2021, and his advice is easy to repeat: “If you’re trying to bring your developers with you, give them a path. Don’t just kill your old thing and then not have a new thing ready.” The article’s verdict is that Angular has since recovered, shipping on a routine twice-a-year schedule with a one-year deprecation period.

I checked the article’s dates and policy claims against the npm registry, Angular’s own documentation and the AngularJS repository. Then I looked at what a retelling of the rewrite is unlikely to cover, which is what the framework Google moved away from costs a team in 2026. For that I pulled last week’s npm downloads by version, the OSV advisory list and the underlying CVE records for the angular package, CISA’s Known Exploited Vulnerabilities (KEV) catalog, EPSS scores, and the raw responses of the 2026 Stack Overflow Developer Survey. Everything below was read on October 28, 2026, and a short script near the end reproduces the npm and OSV numbers.

The short version:

• The dates hold, and one explanation does not. npm dates @angular/core 2.0.0 to September 15, 2016 (UTC) and 4.0.0 to March 23, 2017, as the article says. But version 3 was not skipped “for no discernable reason.” The router package was already at 3.x while the rest of the framework was at 2.x, and the team renumbered to bring them into line. The registry holds 46 router versions in the 3.x line and none for @angular/core.
• The old road never closed in 2014. AngularJS received 77 more stable releases on npm between November 7, 2014 and April 7, 2022. The last, 1.8.3, was published “in order to update package README files on npm,” and the project says support officially ended in January 2022.
• The bill is a security bill. The angular package still drew 533,480 downloads last week, 7.9 percent of what @angular/core drew, and 6.1 percent of the 2026 Stack Overflow survey respondents who answered the web-framework question had done extensive work in AngularJS in the past year. Ten advisories affect 1.8.3, all published after that final release, and OSV lists no fixed version for any of them. The only fix I could find is in a paid build from HeroDevs, the vendor the AngularJS documentation names for extended support and the CVE numbering authority for the four newest entries. None of the ten is in the KEV catalog and the highest EPSS score is 7.7 percent, so this is a planning problem more than an emergency.
• Current Angular has a cliff of its own. Angular’s documentation says versions 2 to 19 are no longer supported, and version 20’s long-term support ends on November 28. Last week 29.3 percent of @angular/core downloads were for the unsupported majors and 13.2 percent for version 20.
• The talk has a lineage worth knowing. A talk with almost the same title was a HeroDevs sponsored session in June 2025. The Register and Fluin’s own site describe him as head of developer relations at Buildkite, so this is context for the “2 Million Engineers” figure, which is the talk’s title, not a reason to doubt the advice.

What The Register reported

The article opens with a cartoon titled “Welcome to Google,” two diverging roads and neither passable: the main road marked deprecated, the new one marked as still under construction. In the article’s words, that was “the no-win choice two million frontend developers faced in 2014, when Google unexpectedly deprecated its popular JavaScript framework, AngularJS, in favor of Angular 2, which had a radically different architecture, a confusing name, no upgrade path, and wasn’t even fully released yet.”

Fluin is candid about the cost. “Uncertainty kills motivation,” he said. The ng-europe keynote that announced Angular 2 showed a tombstone for each discarded feature, “RIP Controllers” among them, while a church bell tolled, and “That talk is still infamous today for what it did to the community.” Developers drifted to React and Vue, the article says. Angular 2 was released in September 2016 and Angular 4 followed in March, but “Version 3 was skipped entirely for no discernable reason.” Today, the article says, Angular follows semantic versioning, releases twice a year and keeps a feature that is slated for removal “deprecated for a year first.” The closing advice is that “pretending to be a new framework might have been better.”

What holds up, and what does not

I turned the article’s checkable statements into a table. A result of Holds means my own check agreed; the rest are explained below it.

Why there is no Angular 3

InfoQ’s December 2016 report on the plan to skip the number gives the reason: “Because the latest Angular router’s version, currently 3.3.0, is not in alignment with the rest of the modules which are at 2.3.0, the team plans to bring them in sync, releasing the next major version as Angular 4, not 3.” The registry confirms it. @angular/router has 46 versions in the 3.x line, from 3.0.0-alpha.0 on June 9, 2016 to 3.4.10 on March 17, 2017, while @angular/core goes from 2.x straight to 4.0.0. Fluin’s own conclusion, “Naming and versioning matter,” fits. Renumbering a framework to fix a mismatch created by versioning one package separately is the kind of problem his talk describes, which makes it a better example than “no discernable reason.”

The old road never closed in 2014

The cartoon’s main road is marked deprecated, and the article says Google “deprecated” AngularJS in 2014. The registry describes a longer wind-down. From November 7, 2014 to April 7, 2022, npm lists 77 stable AngularJS releases, counting patch releases of every 1.x line: 10 in the last two months of 2014, 22 in 2015, 21 in 2016, 8 each in 2017 and 2018, 4 in 2019, 3 in 2020, none in 2021 and one in 2022. That last one, 1.8.3, is named “ultimate-farewell” in the changelog, which describes it as “One final release of AngularJS in order to update package README files on npm.” The project’s support document says “AngularJS support has officially ended as of January 2022,” and the GitHub repository is archived.

Angular 2.0.0 reached npm on September 15, 2016, roughly two years after the announcement, a gap that the abstract of Fluin’s 2025 talk also describes. From then until support ended in January 2022, both frameworks were supported at once, for more than five years. On the upgrade question, the bridge now exists as a package: @angular/upgrade is at 22.2.3, and Angular’s API reference describes its UpgradeModule as an NgModule that provides AngularJS core services and has a method “used to bootstrap the hybrid upgrade application.” I did not check how much of that existed in 2014 or 2015, so the article’s “no upgrade path” may well have been true when the keynote aired.

What the article does not cover: AngularJS in 2026

Still installed

The angular package on npm is AngularJS. Angular 2 and later live under the @angular scope. This table compares their downloads for October 1 to 27 of each year, a window of the same length every year so the counts can be compared.

AngularJS’s October downloads peaked in 2020. This year’s count is 24 percent below that peak and 22 percent below October 2021, the last year of support. Almost five years after support ended, it is still installed at about three-quarters of its peak rate, and its share of Angular’s downloads fell mainly because Angular grew. Last week the counts were 533,480 for angular and 6,728,124 for @angular/core, about one AngularJS download for every 12.6 Angular downloads.

npm also reports last week’s downloads by version. Version 1.8.3, the final release, accounts for 34.4 percent of the AngularJS downloads and the 1.8 line for 51.7 percent. The other 48.3 percent went to versions older than 1.8.0, which carry advisories that were fixed upstream in later releases, such as the prototype pollution flaw fixed in 1.7.9 and the cross-site scripting flaw fixed in 1.8.0.

The Stack Overflow Developer Survey is a self-selected sample, so its shares are not the share of all developers, but it asks about AngularJS separately from Angular. In the 2026 public file, 9,957 respondents answered which web frameworks and web technologies they had done extensive development work in over the past year. Of those, 612 (6.1 percent) chose AngularJS, 1,642 (16.5 percent) chose Angular, 404 chose both and 208 chose AngularJS without Angular. Among the 1,850 who chose either, a third chose AngularJS. Asked what they want to work with in the next year, 337 of 7,502 (4.5 percent) chose AngularJS.

Download counts are not users. Continuous-integration installs, mirrors and automated traffic all count, and React’s count for the same October 1 to 27 window rose from 181.8 million in 2025 to 624.9 million in 2026, which is not developer growth. In the other direction, three public CDNs still serve AngularJS 1.8.x (Google Hosted Libraries and cdnjs for 1.8.3, code.angularjs.org for 1.8.2; each returned HTTP 200 today), and an app that loads it from a script tag never shows up in npm figures.

Ten advisories and no open-source fix

I asked OSV for advisories that affect angular 1.8.3, the final release. It returned ten, and none of them lists a fixed version. The oldest CVE record is dated May 1, 2022, 24 days after that release, so all ten were published after upstream stopped shipping. The table adds the CVE numbering authority (CNA) that assigned each, that authority’s own CVSS 3.1 score, and the EPSS exploitation-probability estimate for October 28.

The first six were assigned by Snyk. The newest four, from September 2024 to June 2026, were assigned by HeroDevs, and each of its records links a page in HeroDevs’s vulnerability directory and a CodePen demonstration. The newest, CVE-2026-11998, is a flaw in AngularJS’s Strict Contextual Escaping (SCE) logic that “can lead to arbitrary JavaScript execution within the context of the victim’s browser session.” Its CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L. The record adds: “The AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue.”

So where does a fix come from? HeroDevs’s page for that CVE says: “This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.” The AngularJS documentation lists one option under “Extended Long Term Support”: “If you need extended support for AngularJS, you should consider:” HeroDevs. The npm registry marks 1.8.3 as deprecated with the message “AngularJS support has officially ended. For extended AngularJS support options, see https://goo.gle/angularjs-path-forward,” a short link that redirects to an Angular team blog post I could not open, because the blog’s host answered scripted clients with a 403. HeroDevs says on its AngularJS page that it “has found and fixed more CVEs in AngularJS than any other organization,” and offers “Secure drop-in replacements for AngularJS versions 1.4.x, 1.5.x, 1.8.x.”

My reading is structural, not an accusation. Each record carries a working demonstration and describes ordinary parser, sanitizer and regular-expression bugs, so I have no reason to think the findings are wrong. But with the upstream frozen, the organization that has been finding new bugs, assigning their CVE numbers and writing their advisories is also the one selling the fix, and the project’s own documentation points buyers to it. Extended support for end-of-life software is a real need and a legitimate business. A reader should still know that the last four advisories in the feed all come from the same company.

HeroDevs lists drop-in builds for the 1.4, 1.5 and 1.8 lines. Those lines were 74.0 percent of last week’s AngularJS downloads, so the other 26.0 percent (mostly 1.6 and 1.7, plus 1.3 and 1.2) sit on lines the page does not list. I did not ask HeroDevs whether other lines are covered on request.

How worried to be

None of the ten is in the KEV catalog (catalog version 2026.10.28, 1,762 entries), and the EPSS estimates run from 0.40 percent for the newest to 7.7 percent for CVE-2022-25869. That does not make them harmless. The ten are five regular-expression denial-of-service cases, one cross-site scripting case that depends on Internet Explorer page caching, three sanitizer bypasses that the records call content spoofing, and the SCE bypass. Which of them matters depends on what an application does with untrusted input. A scanner, though, will list all ten against every copy of 1.8.3, and audit regimes that treat unsupported components as findings will ask for an exception, a mitigation or a contract. That is where the cost shows up.

The same cliff, one level up: Angular’s own support window

The article credits Angular with a predictable update pattern, and the documentation bears that out. Each major version gets 12 months of active support and 12 months of long-term support, and during the second year “Only critical fixes and security patches are released.” The docs state that “Angular versions v2 to v19 are no longer supported.” The table below combines the documentation’s support table with last week’s @angular/core downloads by major version.

By my arithmetic, 42.4 percent of last week’s @angular/core downloads (the 29.3 percent and 13.2 percent above, summed before rounding) were for a major that is out of support or loses long-term support in 31 days. One caveat: a single exact version, 9.0.0, accounts for 3.7 percent of the week, which could be a template or a build image. Without it, the unsupported share is 26.5 percent. Support lasts 24 months per major and a new major arrives every six months, so a team that stays on one version for more than two years ends up unsupported. That is a far better position than AngularJS users are in, because the path exists and is dated, and it is also the talk’s own lesson turned around: a path only helps if people take it.

Where the talk came from

The Register describes Fluin as “now head of developer relations for Buildkite,” and his own site says the same. The All Things Open speaker page for the October session, titled “Lessons Learned While Moving 2 Million Engineers From AngularJS to Angular,” lists him as VP of Product and names no employer. The title is almost word for word that of a session he gave at Open Source Summit North America on June 24, 2025, which the schedule lists as a “Sponsored Session” with the speaker line “Maintainer of the Unmaintained, HeroDevs.” That abstract says the lessons are meant to help attendees “drive adoption, evolve your ecosystem, stay fresh and relevant, and even support the developers you leave behind.” HeroDevs sells extended support for AngularJS.

I could not read the All Things Open schedule or sponsor pages as plain text, so I do not know whether the October session had a sponsor, and nothing in the article is contradicted by this history. It does explain where the “2 Million Engineers” figure comes from: the talk’s title, not a sourced count. It also means the article’s hopeful ending is about the framework that won the migration. The people still running the old one do not appear in it, and they are the gap the rest of this post fills.

What to do with it

1. Find every copy, not just the one in package.json. Run npm ls angular --all in each repository; the package is named angular, not @angular/core. Then search for vendored files such as angular.min.js, script tags that load it from Google Hosted Libraries, cdnjs or code.angularjs.org, and Java WebJars, which Snyk’s CVE references show packaging the same code.
2. Triage by exposure, not only by the scanner list. The ten advisories sit in input handling. Ask which applications pass untrusted strings to angular.copy(), $resource, input[type=url], ng-srcset, SVG image links or SCE resource URLs. Record today’s KEV and EPSS readings with the date.
3. Choose one route per application and attach a date: migrate, mitigate or buy. Migration can be gradual because UpgradeModule lets AngularJS and Angular components share a page. Our posts on seams and adapters and on differential testing cover how to carve a legacy application into replaceable pieces and check each replacement against the old behavior. Buying extended support is a legitimate choice that should come with an owner and a renewal date, and since HeroDevs names the 1.4, 1.5 and 1.8 lines, a 1.6 or 1.7 application has an extra step first.
4. Put Angular’s own end dates in the same calendar. If you run Angular 20, its long-term support ends on November 28, 2026, and versions 19 and older are already out of support.

Reproduce the numbers

This script needs Python 3.13 and nothing outside the standard library. It makes five HTTPS requests to public endpoints: npm’s per-version download counts for angular and @angular/core, OSV’s query API for angular 1.8.3, and the npm registry for the 3.x version check. The first listing is the script and the second is what it printed at the time of writing.

"""angular_audit.py: AngularJS long tail and Angular support window. Python 3.13, standard library only."""
import collections
import json
import re
import urllib.request

UA = {"User-Agent": "angular-audit/1.0"}


def fetch(url, body=None, headers=None):
    data = json.dumps(body).encode() if body is not None else None
    head = dict(UA, **(headers or {}))
    if data:
        head["Content-Type"] = "application/json"
    with urllib.request.urlopen(urllib.request.Request(url, data=data, headers=head), timeout=120) as reply:
        return json.load(reply)


def week_by_version(package):
    return fetch("https://api.npmjs.org/versions/" + package.replace("/", "%2f") + "/last-week")["downloads"]


def share(part, whole):
    return f"{100 * part / whole:.1f}%"


def key(version):
    found = re.match(r"(\d+)\.(\d+)\.(\d+)", version)
    return tuple(int(x) for x in found.groups()) if found else (0, 0, 0)


core, js = week_by_version("@angular/core"), week_by_version("angular")
core_total, js_total = sum(core.values()), sum(js.values())
print(f"@angular/core, last week: {core_total:,} downloads")
print(f"angular (AngularJS), last week: {js_total:,} downloads = {share(js_total, core_total)} of @angular/core")

by_major = collections.Counter()
for version, n in core.items():
    by_major[int(version.split(".")[0])] += n
old = sum(n for major, n in by_major.items() if major <= 19)
pinned = core.get("9.0.0", 0)
print(f"majors 2 to 19 (documented as unsupported): {share(old, core_total)}")
print(f"major 20 (LTS ends 2026-11-28): {share(by_major[20], core_total)}")
print(f"majors 21 and 22: {share(by_major[21] + by_major[22], core_total)}")
print(f"version 9.0.0 alone: {share(pinned, core_total)}; unsupported share without it: {share(old - pinned, core_total - pinned)}")

before_180 = sum(n for version, n in js.items() if key(version) < (1, 8, 0))
nes_lines = sum(n for version, n in js.items() if re.match(r"1\.(4|5|8)\.", version))
print(f"AngularJS on 1.8.3: {share(js.get('1.8.3', 0), js_total)}; before 1.8.0: {share(before_180, js_total)}; on the 1.4, 1.5 and 1.8 lines: {share(nes_lines, js_total)}")


def has_fix(vuln):
    for affected in vuln.get("affected", []):
        if affected.get("package", {}).get("name") != "angular":
            continue
        for span in affected.get("ranges", []):
            if any("fixed" in event for event in span.get("events", [])):
                return True
    return False


query = {"package": {"name": "angular", "ecosystem": "npm"}, "version": "1.8.3"}
vulns = fetch("https://api.osv.dev/v1/query", query)["vulns"]
unfixed = sorted((v for v in vulns if not has_fix(v)), key=lambda v: v["published"])
print(f"OSV advisories affecting angular 1.8.3: {len(vulns)}; with no fixed version: {len(unfixed)}")
for vuln in unfixed:
    cve = next((a for a in vuln.get("aliases", []) if a.startswith("CVE-")), "-")
    print(f"  {vuln['published'][:10]}  {vuln['id']}  {cve}")

short = {"Accept": "application/vnd.npm.install-v1+json"}
for package in ("@angular/core", "@angular/router"):
    versions = fetch("https://registry.npmjs.org/" + package.replace("/", "%2f"), headers=short)["versions"]
    threes = sorted((v for v in versions if v.startswith("3.")), key=key)
    span = f" ({threes[0]} to {threes[-1]})" if threes else ""
    print(f"{package} versions starting with 3.: {len(threes)}{span}")

@angular/core, last week: 6,728,124 downloads
angular (AngularJS), last week: 533,480 downloads = 7.9% of @angular/core
majors 2 to 19 (documented as unsupported): 29.3%
major 20 (LTS ends 2026-11-28): 13.2%
majors 21 and 22: 57.6%
version 9.0.0 alone: 3.7%; unsupported share without it: 26.5%
AngularJS on 1.8.3: 34.4%; before 1.8.0: 48.3%; on the 1.4, 1.5 and 1.8 lines: 74.0%
OSV advisories affecting angular 1.8.3: 10; with no fixed version: 10
  2022-05-03  GHSA-m2h2-264f-f486  CVE-2022-25844
  2022-07-16  GHSA-prc3-vjfx-vhm9  CVE-2022-25869
  2023-03-30  GHSA-qwqh-hm9m-p5hr  CVE-2023-26118
  2023-03-30  GHSA-2qqx-w9hr-q5gx  CVE-2023-26117
  2023-03-30  GHSA-2vrf-hf26-jrp5  CVE-2023-26116
  2024-02-10  GHSA-4w4v-5hc9-xrr2  CVE-2024-21490
  2024-09-09  GHSA-m9gf-397r-hwpg  CVE-2024-8372
  2024-09-09  GHSA-mqm9-c95h-x2p6  CVE-2024-8373
  2025-04-29  GHSA-j58c-ww9w-pwp5  CVE-2025-0716
  2026-06-24  GHSA-7x27-g8rg-x87w  CVE-2026-11998
@angular/core versions starting with 3.: 0
@angular/router versions starting with 3.: 46 (3.0.0-alpha.0 to 3.4.10)

npm’s last-week window was October 21 to 27, 2026 when I ran it, so your counts will differ, and OSV will grow if a new advisory lands. The download table earlier in this post uses the date-range endpoint (https://api.npmjs.org/downloads/point/2026-10-01:2026-10-27/angular, with the other packages and years swapped in). I read the CVE records through the CVE Services API, EPSS through FIRST’s API and the KEV catalog from CISA’s JSON feed.

What I did not check

• The article’s statements about Gemini, Google Analytics, the Wiz framework and its origin, and how the AngularJS team moved between Google divisions. I found no primary document to test them against, because the Angular blog is hosted on Medium and answered scripted clients with a 403 and a block page.
• The State of JS 2016 percentages, which the archived page draws in JavaScript.
• The tombstones and the church bell at ng-europe. That description comes from the article.
• What HeroDevs charges or whether it covers other AngularJS lines. Its page says “Get Pricing,” and I did not ask.
• Whether anyone has patched AngularJS in a public fork. I looked at the npm registry, OSV and HeroDevs, not at forks.

Related reading

• CloudLinux Adds ELS as MariaDB 10.6 Approaches End of Life, another case of paid extended support filling in after an upstream end of life.
• WordPress 7.1.4 Closes an Unauthenticated Race in Its Own Update Routine, but 19 Older Branches Had No Backport Hours After Release, on what “supported” means for older branches.
• How to Prepare a Legacy Application for Migration Using Seams and Adapters in Python.
• How to Use Differential Testing to Safely Replace Legacy Code in Python.

Sources

• The Register, Joab Jackson, How Google fumbled the frontend with Angular 2 (October 28, 2026).
• npm registry records for angular, @angular/core, @angular/router and @angular/upgrade, and npm’s download counts API.
• AngularJS repository: Version Support Status, CHANGELOG and README.
• Angular documentation: Versioning and releases and the UpgradeModule API reference.
• InfoQ, Angular 4 report (December 2016).
• OSV, GHSA-7x27-g8rg-x87w, and the CVE records, for example CVE-2026-11998.
• HeroDevs, Never-Ending Support for AngularJS and its CVE-2026-11998 page.
• CISA, Known Exploited Vulnerabilities catalog (version 2026.10.28), and FIRST, EPSS API.
• Stack Overflow, 2026 Developer Survey and its public results repository.
• Open Source Summit North America 2025 session page, the All Things Open 2026 speaker page and Stephen Fluin’s site.