Guide · AngularJS migration
A small AngularJS upgrade as a stop-gap: when it is worth it
By MervenorPublished Last reviewed 3 min read
Upgrading an older AngularJS application to the last 1.8 release, or moving it onto a paid extended-support build, buys time; it does not remove the need to migrate. It makes sense when a migration cannot start for months and a security review or customer contract demands action now. Use the time to build the test safety net the real migration will need.
What a stop-gap can and cannot do
It can pick up the fixes that shipped before support ended, make the code easier to migrate later, and give you something concrete to show an auditor. It cannot fix vulnerabilities found after 31 December 2021 in the open-source releases, bring back developers who want to work on AngularJS, or stop libraries from dropping it.
Option 1: Move to the last open-source release (1.8)
Applications on 1.4, 1.5 or 1.6 can usually move to 1.8 in steps, one minor version at a time, following the AngularJS migration guide. The larger changes came in 1.6 (for example, $http's .success() and .error() were removed and the default hash prefix in URLs changed) and in 1.8 (stricter handling of HTML strings in jqLite, for security). Each step needs your end-to-end tests to pass before the next one.
Option 2: Paid extended support
Commercial vendors sell patched AngularJS builds that fix vulnerabilities found after the end of support; HeroDevs, for example, lists the CVEs its builds have fixed since then. It is a subscription, it keeps your code as it is, and it is the only way to close those vulnerabilities without migrating.
When a stop-gap is worth it
| Worth it when | Not worth it when |
|---|---|
| A migration cannot start for several months | You can start migrating now |
| A customer contract or security review demands patched dependencies today | The application is under active development |
| The application will be retired within a year or so | The stop-gap would cost as much as the first slices of a real migration |
How to use the time
- Write end-to-end tests for the journeys that matter; the migration will need them anyway.
- Refactor towards components (
.component()with one-way bindings), which map cleanly to React or modern Angular. - List every route, directive and shared service, and decide where the application is going: React or modern Angular.
Questions people ask
Is AngularJS 1.8 still supported?
Not by Google: long-term support for every AngularJS version ended on 31 December 2021. Only paid extended-support builds receive fixes now.
Does extended support make us compliant?
It closes the known vulnerabilities it lists. Whether that satisfies a particular customer or auditor is their call, so ask them before you buy.
Renascia, the upgrade and migration sprint, can do the stop-gap and the real migration in one plan, at a fixed price set by a five-day Perlustra audit.