Skip to content

build(deps): Bump the angular-stack group across 1 directory with 3 updates#3265

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/angular-stack-a06b3f16a4
Open

build(deps): Bump the angular-stack group across 1 directory with 3 updates#3265
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/angular-stack-a06b3f16a4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 16, 2026 •
edited
Loading

Bumps the angular-stack group with 3 updates in the / directory: @angular/common, @angular/compiler and @angular/core.

Updates @angular/common from 21.2.8 to 21.2.9

Release notes

Sourced from @​angular/common's releases.

21.2.9

core

Commit Description
fix - f603d4714f escape forward slashes in transfer state to prevent crawler indexing

http

Commit Description
fix - 540536c386 add CSP nonce support to JsonpClientBackend
fix - 63a857b874 Don't on Passthru outside of reactive context

platform-server

Commit Description
fix - e0b5078cf2 prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Description
fix - 684e9fd53d normalize multiple leading slashes in URL parser
Changelog

Sourced from @​angular/common's changelog.

21.2.9 (2026-04-15)

core

Commit Type Description
f603d4714f fix escape forward slashes in transfer state to prevent crawler indexing

http

Commit Type Description
540536c386 fix add CSP nonce support to JsonpClientBackend
63a857b874 fix Don't on Passthru outside of reactive context

platform-server

Commit Type Description
e0b5078cf2 fix prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Type Description
684e9fd53d fix normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

  • The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
    • TypeScript versions older than 6.0 are no longer supported.
  • ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
  • ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

  • This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

  • The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit Type Description
2ce0e98f79 fix handle nested brackets in host object bindings

compiler-cli

Commit Type Description
7f9450219f feat Adds warning for prefetch without main defer trigger
ab061a7610 fix error for type parameter declarations
9218140348 fix resolve TCB mapping failure for safe property reads with as any

core

Commit Type Description
a0aa8304cd feat bootstrap via ApplicationRef with config
9c55fcb3e6 feat de-duplicate host directives
8fe025f514 feat drop support for TypeScript 5.9
77f1ca08e4 fix handle missing serialized container hydration data

... (truncated)

Commits

Updates @angular/compiler from 21.2.8 to 21.2.9

Release notes

Sourced from @​angular/compiler's releases.

21.2.9

core

Commit Description
fix - f603d4714f escape forward slashes in transfer state to prevent crawler indexing

http

Commit Description
fix - 540536c386 add CSP nonce support to JsonpClientBackend
fix - 63a857b874 Don't on Passthru outside of reactive context

platform-server

Commit Description
fix - e0b5078cf2 prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Description
fix - 684e9fd53d normalize multiple leading slashes in URL parser
Changelog

Sourced from @​angular/compiler's changelog.

21.2.9 (2026-04-15)

core

Commit Type Description
f603d4714f fix escape forward slashes in transfer state to prevent crawler indexing

http

Commit Type Description
540536c386 fix add CSP nonce support to JsonpClientBackend
63a857b874 fix Don't on Passthru outside of reactive context

platform-server

Commit Type Description
e0b5078cf2 fix prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Type Description
684e9fd53d fix normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

  • The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
    • TypeScript versions older than 6.0 are no longer supported.
  • ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
  • ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

  • This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

  • The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit Type Description
2ce0e98f79 fix handle nested brackets in host object bindings

compiler-cli

Commit Type Description
7f9450219f feat Adds warning for prefetch without main defer trigger
ab061a7610 fix error for type parameter declarations
9218140348 fix resolve TCB mapping failure for safe property reads with as any

core

Commit Type Description
a0aa8304cd feat bootstrap via ApplicationRef with config
9c55fcb3e6 feat de-duplicate host directives
8fe025f514 feat drop support for TypeScript 5.9
77f1ca08e4 fix handle missing serialized container hydration data

... (truncated)

Commits

Updates @angular/core from 21.2.8 to 21.2.9

Release notes

Sourced from @​angular/core's releases.

21.2.9

core

Commit Description
fix - f603d4714f escape forward slashes in transfer state to prevent crawler indexing

http

Commit Description
fix - 540536c386 add CSP nonce support to JsonpClientBackend
fix - 63a857b874 Don't on Passthru outside of reactive context

platform-server

Commit Description
fix - e0b5078cf2 prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Description
fix - 684e9fd53d normalize multiple leading slashes in URL parser
Changelog

Sourced from @​angular/core's changelog.

21.2.9 (2026-04-15)

core

Commit Type Description
f603d4714f fix escape forward slashes in transfer state to prevent crawler indexing

http

Commit Type Description
540536c386 fix add CSP nonce support to JsonpClientBackend
63a857b874 fix Don't on Passthru outside of reactive context

platform-server

Commit Type Description
e0b5078cf2 fix prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Type Description
684e9fd53d fix normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

  • The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
    • TypeScript versions older than 6.0 are no longer supported.
  • ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
  • ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

  • This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

  • The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit Type Description
2ce0e98f79 fix handle nested brackets in host object bindings

compiler-cli

Commit Type Description
7f9450219f feat Adds warning for prefetch without main defer trigger
ab061a7610 fix error for type parameter declarations
9218140348 fix resolve TCB mapping failure for safe property reads with as any

core

Commit Type Description
a0aa8304cd feat bootstrap via ApplicationRef with config
9c55fcb3e6 feat de-duplicate host directives
8fe025f514 feat drop support for TypeScript 5.9
77f1ca08e4 fix handle missing serialized container hydration data

... (truncated)

Commits
  • 17cae6a docs: fix bootstraping link
  • f603d47 fix(core): escape forward slashes in transfer state to prevent crawler indexing
  • 05d9b97 build: update cross-repo angular dependencies
  • See full diff in compare view

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 16, 2026
@dependabot
build(deps): Bump the angular-stack group with 3 updates
270df31 
Bumps the angular-stack group with 3 updates: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) and [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core).


Updates `@angular/common` from 21.2.8 to 21.2.9
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.9/packages/common)

Updates `@angular/compiler` from 21.2.8 to 21.2.9
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.9/packages/compiler)

Updates `@angular/core` from 21.2.8 to 21.2.9
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.9/packages/core)

---
updated-dependencies:
- dependency-name: "@angular/common"
  dependency-version: 21.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-stack
- dependency-name: "@angular/compiler"
  dependency-version: 21.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-stack
- dependency-name: "@angular/core"
  dependency-version: 21.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-stack
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot changed the title build(deps): Bump the angular-stack group with 3 updates build(deps): Bump the angular-stack group across 1 directory with 3 updates Apr 17, 2026
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/angular-stack-a06b3f16a4 branch from fd08950 to 270df31 Compare April 17, 2026 03:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants