Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 24 updates - #56

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-b88b48ada5
Open

build(deps): bump the npm_and_yarn group across 1 directory with 24 updates#56
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-b88b48ada5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 13 updates in the / directory:

Package From To
@angular/common 21.1.2 22.0.6
@angular/compiler 21.1.2 21.2.17
@angular/core 21.1.2 21.2.17
postcss 8.5.6 8.5.16
@hono/node-server 1.19.9 1.19.14
@modelcontextprotocol/sdk 1.25.2 1.26.0
fast-uri 3.0.3 3.1.3
flatted 3.3.2 3.4.2
follow-redirects 1.15.9 1.16.0
tmp 0.2.3 0.2.7
lodash 4.17.23 4.18.1
qs 6.14.1 6.15.3
yaml 2.7.0 2.9.0

Updates @angular/common from 21.1.2 to 22.0.6

Release notes

Sourced from @​angular/common's releases.

22.0.6

compiler

Commit Description
fix - fd4ddcafed use regular optional chaining expression for safe function calls in TCBs

compiler-cli

Commit Description
fix - 534fe81a89 apply debugName transform to required signal queries
fix - 3b08201bfb detect uninvoked signals in bound expressions using ternary

forms/signals

Commit Description
fix - 171669f7b2 make extractValue reactive for compat AbstractControl values

migrations

Commit Description
fix - 0a6af1496b preserve transitive NgModule references when pruning
fix - d4a926a762 remove stale model import in model-output migration

router

Commit Description
fix - c238bd2ad7 handle outlet named proto in segment group maps
fix - 8e6d7f7190 use safe hasOwnProperty when parsing query params

22.0.5

common

Commit Description
fix - eb8fb9fe58 use Object.hasOwn in I18nSelectPipe to handle null-prototype and shadowed mappings

compiler-cli

Commit Description
fix - baf09a9939 include toSignal in debugName transform

core

Commit Description
fix - e598dc843f improve input writes migration in best effort mode
fix - ced0180b06 reject dynamic script host elements

router

Commit Description
fix - ca13b42e7c fix malformed jsdoc comment for RouterLinkWithHref export

22.0.4

migrations

Commit Description
fix - fd37f09f37 resolve migration failure when tsconfig specifies rootDir

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

22.0.6 (2026-07-08)

compiler

Commit Type Description
fd4ddcafed fix use regular optional chaining expression for safe function calls in TCBs

compiler-cli

Commit Type Description
534fe81a89 fix apply debugName transform to required signal queries
3b08201bfb fix detect uninvoked signals in bound expressions using ternary

forms/signals

Commit Type Description
171669f7b2 fix make extractValue reactive for compat AbstractControl values

migrations

Commit Type Description
0a6af1496b fix preserve transitive NgModule references when pruning
d4a926a762 fix remove stale model import in model-output migration

router

Commit Type Description
c238bd2ad7 fix handle outlet named proto in segment group maps
8e6d7f7190 fix use safe hasOwnProperty when parsing query params

22.1.0-next.4 (2026-07-01)

common

Commit Type Description
311aff05aa fix use Object.hasOwn in I18nSelectPipe to handle null-prototype and shadowed mappings

compiler

Commit Type Description
292199aa4d fix permissive whitespace parsing in default never blocks

compiler-cli

Commit Type Description
165995285c fix include toSignal in debugName transform

core

Commit Type Description
74638cab84 fix improve input writes migration in best effort mode
d7f70616a0 fix reject dynamic script host elements

router

Commit Type Description
a74801c59c fix fix malformed jsdoc comment for RouterLinkWithHref export

... (truncated)

Commits
  • 748faa4 docs(docs-infra): Add build-time validation for API and guide links using rou...
  • 8e6d7f7 fix(router): use safe hasOwnProperty when parsing query params
  • eb8fb9f fix(common): use Object.hasOwn in I18nSelectPipe to handle null-prototype and...
  • cd8f472 docs: add documentation for HttpClient response body size limit and related e...
  • 8cdc202 fix(http): prevent caching of responses with Set-Cookie headers
  • 6867f77 fix(http): distinguish repeated transfer cache params
  • 6c1f3e9 fix(common): skip transfer cache for uncacheable HTTP traffic (#69316)
  • 7ef1399 fix(http): skip transfer cache for fetch credentialed requests (#69316)
  • 94ea403 fix(common): escape anchor fragment in shadow DOM name selector
  • 2dd65d2 fix(http): pass down the reportUploadProgress and reportDownloadProgress ...
  • Additional commits viewable in compare view

Updates @angular/compiler from 21.1.2 to 21.2.17

Release notes

Sourced from @​angular/compiler's releases.

21.2.17

common

Commit Description
fix - 86a56dc279 Limits date format string length
fix - d846326b07 skip transfer cache for uncacheable HTTP traffic
fix - bc55749698 use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description
fix - dc9c99636d sanitize two-way properties

core

Commit Description
fix - 1523061137 harden TransferState restoration against DOM clobbering
fix - 88832c84f8 validate lowercase SVG animation attribute names (#69269)

http

Commit Description
fix - bcb1b7ea25 preserve empty referrer option in HttpRequest
fix - a810a319d1 Rejects non-HTTP(S) URLs in JSONP requests
fix - e245d40c4d skip transfer cache for fetch credentialed requests

platform-server

Commit Description
fix - 35510746b7 harden platform location origin validation during SSR
refactor - 13fb0afe93 deprecate ServerXhr (#69255)

service-worker

Commit Description
fix - b9d29381bb Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

21.2.16

common

Commit Description
fix - f6d8e642b0 only strip a literal /index.html suffix from URLs

compiler

Commit Description
fix - ae1c8a1f7a move projection attributes into constants

core

Commit Description
fix - 3fd6897a67 harden inherit definition feature against polluted prototypes
fix - 7e38336dc7 use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.17 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description
86a56dc279 fix Limits date format string length
d846326b07 fix skip transfer cache for uncacheable HTTP traffic
bc55749698 fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description
dc9c99636d fix sanitize two-way properties

core

Commit Type Description
1523061137 fix harden TransferState restoration against DOM clobbering
88832c84f8 fix validate lowercase SVG animation attribute names (#69269)

http

Commit Type Description
bcb1b7ea25 fix preserve empty referrer option in HttpRequest
a810a319d1 fix Rejects non-HTTP(S) URLs in JSONP requests
e245d40c4d fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description
35510746b7 fix harden platform location origin validation during SSR
13fb0afe93 refactor deprecate ServerXhr (#69255)

service-worker

Commit Type Description
b9d29381bb fix Strips sensitive headers on cross-origin redirects

20.3.25 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description
9f443bc24c fix Limits date format string length
566ad05f20 fix skip transfer cache for uncacheable HTTP traffic
1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

| Commit | Type | Description |

... (truncated)

Commits
  • dc9c996 fix(compiler): sanitize two-way properties
  • ae1c8a1 fix(compiler): move projection attributes into constants
  • eb1cbbf fix(compiler): prevent namespaced SVG <style> elements from being stripped
  • 29ceeff docs: fix typos in source code comments
  • 782e015 fix(compiler): strip namespaced SVG script elements during template compilati...
  • ff12fe5 fix(core): normalize tag names in runtime i18n attribute security context loo...
  • 0b07f47 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
  • cc1378d fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
  • daaf329 fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
  • 68282df fix(compiler): strip namespaced SVG script elements during template compilation
  • Additional commits viewable in compare view

Updates @angular/core from 21.1.2 to 21.2.17

Release notes

Sourced from @​angular/core's releases.

21.2.17

common

Commit Description
fix - 86a56dc279 Limits date format string length
fix - d846326b07 skip transfer cache for uncacheable HTTP traffic
fix - bc55749698 use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description
fix - dc9c99636d sanitize two-way properties

core

Commit Description
fix - 1523061137 harden TransferState restoration against DOM clobbering
fix - 88832c84f8 validate lowercase SVG animation attribute names (#69269)

http

Commit Description
fix - bcb1b7ea25 preserve empty referrer option in HttpRequest
fix - a810a319d1 Rejects non-HTTP(S) URLs in JSONP requests
fix - e245d40c4d skip transfer cache for fetch credentialed requests

platform-server

Commit Description
fix - 35510746b7 harden platform location origin validation during SSR
refactor - 13fb0afe93 deprecate ServerXhr (#69255)

service-worker

Commit Description
fix - b9d29381bb Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

21.2.16

common

Commit Description
fix - f6d8e642b0 only strip a literal /index.html suffix from URLs

compiler

Commit Description
fix - ae1c8a1f7a move projection attributes into constants

core

Commit Description
fix - 3fd6897a67 harden inherit definition feature against polluted prototypes
fix - 7e38336dc7 use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

21.2.17 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description
86a56dc279 fix Limits date format string length
d846326b07 fix skip transfer cache for uncacheable HTTP traffic
bc55749698 fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description
dc9c99636d fix sanitize two-way properties

core

Commit Type Description
1523061137 fix harden TransferState restoration against DOM clobbering
88832c84f8 fix validate lowercase SVG animation attribute names (#69269)

http

Commit Type Description
bcb1b7ea25 fix preserve empty referrer option in HttpRequest
a810a319d1 fix Rejects non-HTTP(S) URLs in JSONP requests
e245d40c4d fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description
35510746b7 fix harden platform location origin validation during SSR
13fb0afe93 refactor deprecate ServerXhr (#69255)

service-worker

Commit Type Description
b9d29381bb fix Strips sensitive headers on cross-origin redirects

20.3.25 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description
9f443bc24c fix Limits date format string length
566ad05f20 fix skip transfer cache for uncacheable HTTP traffic
1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

| Commit | Type | Description |

... (truncated)

Commits
  • 88832c8 fix(core): validate lowercase SVG animation attribute names (#69269)
  • 3551074 fix(platform-server): harden platform location origin validation during SSR
  • bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
  • d846326 fix(common): skip transfer cache for uncacheable HTTP traffic
  • e245d40 fix(http): skip transfer cache for fetch credentialed requests
  • 1523061 fix(core): harden TransferState restoration against DOM clobbering
  • 736c4ab refactor(core): fix broken unit test.
  • 3fd6897 fix(core): harden inherit definition feature against polluted prototypes
  • 7e38336 fix(core): use Object.create(null) for LOCALE_DATA as a hardening measure
  • 29ceeff docs: fix typos in source code comments
  • Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.16

Release notes

Sourced from postcss's releases.

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Changelog

Sourced from postcss's changelog.

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates @hono/node-server from 1.19.9 to 1.19.14

Release notes

Sourced from @​hono/node-server's releases.

v1.19.14

What's Changed

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

Commits

Updates @modelcontextprotocol/sdk from 1.25.2 to 1.26.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.26.0

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

v1.25.3

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.2...v1.25.3

Commits
  • fe9c07b chore: bump version to 1.26.0 (#1479)
  • 4f01e7e fix: add non-null assertions for optional setupServer fields in stateful test
  • a05be17 Merge commit from fork
  • 50d9fa3 Fix #1430: Client Credentials providers scopes support (backported) (#1442)
  • aa81a66 fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x back...
  • 6aba065 chore: bump v1.25.3 for backport fixes (#1412)
  • 6e8f7e1 fix: prevent Hono from overriding global Response object (v1.x) (#1411)
  • 12ae856 [v1.x backport] Use correct schema for client sampling validation when tools ...
  • See full diff in compare view

Updates @sigstore/core from 3.1.0 to 3.2.1

Release notes

Sourced from @​sigstore/core's releases.

@​sigstore/core@​3.2.1

Patch Changes

  • b5aa4f1: Apply UTF-8 encoding to payload type during PAE calculation

@​sigstore/core@​3.2.0

Minor Changes

  • 8f736ef: Update the createPublicKey function to support base64-encoded keys
Commits

Updates @sigstore/verify from 3.1.0 to 3.1.1

Release notes

Sourced from @​sigstore/verify's releases.

@​sigstore/verify@​3.1.1

Patch Changes

  • 7845532: Verification of OID certificate extensions
  • f074710: Require inclusion promise in Rekor entry when used as timestamp source
  • Updated dependencies [b5aa4f1]
    • @​sigstore/core@​3.2.1
Commits

Updates fast-uri from 3.0.3 to 3.1.3

Release notes

Sourced from fast-uri's releases.

v3.1.3

⚠️ Security Release

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

v3.1.2

⚠️ Security Release

What's Changed

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

What's Changed

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 9, 2026
@dependabot
dependabot Bot requested a review from JamesIves as a code owner July 9, 2026 07:28
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 9, 2026
This was referenced Jul 9, 2026
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 24 u…
0428750 
…pdates

---
updated-dependencies:
- dependency-name: "@angular/common"
  dependency-version: 22.0.6
  dependency-type: direct:production
- dependency-name: "@angular/compiler"
  dependency-version: 21.2.17
  dependency-type: direct:production
- dependency-name: "@angular/core"
  dependency-version: 21.2.17
  dependency-type: direct:production
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.14
  dependency-type: indirect
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: indirect
- dependency-name: "@sigstore/core"
  dependency-version: 3.2.1
  dependency-type: indirect
- dependency-name: "@sigstore/verify"
  dependency-version: 3.1.1
  dependency-type: indirect
- dependency-name: fast-uri
  dependency-version: 3.1.3
  dependency-type: indirect
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
- dependency-name: hono
  dependency-version: 4.12.28
  dependency-type: indirect
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
- dependency-name: ip-address
  dependency-version: 10.2.0
  dependency-type: indirect
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
- dependency-name: piscina
  dependency-version: 5.2.0
  dependency-type: indirect
- dependency-name: postcss
  dependency-version: 8.5.16
  dependency-type: direct:development
- dependency-name: qs
  dependency-version: 6.15.3
  dependency-type: indirect
- dependency-name: rollup
  dependency-version: 4.60.2
  dependency-type: indirect
- dependency-name: sigstore
  dependency-version: 4.1.1
  dependency-type: indirect
- dependency-name: tar
  dependency-version: 7.5.19
  dependency-type: indirect
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
- dependency-name: undici
  dependency-version: 6.27.0
  dependency-type: indirect
- dependency-name: vite
  dependency-version: 7.3.5
  dependency-type: indirect
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-b88b48ada5 branch from 2a3c329 to 0428750 Compare July 13, 2026 03:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JamesIves JamesIves Awaiting requested review from JamesIves JamesIves is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants