Skip to content

Bump @angular/platform-server, @angular/ssr and @angular/build - #4

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-00625189c6
Closed

Bump @angular/platform-server, @angular/ssr and @angular/build#4
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-00625189c6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Contributor

Bumps @angular/platform-server, @angular/ssr and @angular/build. These dependencies needed to be updated together.
Updates @angular/platform-server from 21.2.15 to 22.0.1

Release notes

Sourced from @​angular/platform-server's releases.

22.0.1

common

Commit Description
fix - c4b5fa3c92 escape CSS string-terminating characters in escapeCssUrl
fix - dfff57ede9 Limits date format string length
fix - 3c2892c8df prevent prototype pollution in formatDateTime
fix - 1d87c49f6e use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description
fix - 1ee224ca30 disallow i18n event attributes
fix - a56f1cdf8f more robust logic to check if regex can be optimized
fix - 5946c18275 sanitize href/xlink:href attributes of any element of the MathML namespace
fix - 393b84caf8 sanitize two-way properties

compiler-cli

Commit Description
fix - 3d9ca2f173 bind switch exhaustive check expressions

core

Commit Description
fix - 669146b0e7 disable WebMCP during SSR
fix - 562a566ead Handle synchronous errors in PendingTasks.run function
fix - fa546f382d harden TransferState restoration against DOM clobbering
fix - 29fdb98684 prevent dangling prevConsumer reference from leaking destroyed views (#68681)
fix - cdcea80327 require WebMCP tool descriptions
fix - 4289c4c840 update comment for Default change detection
fix - 3dd433b39a use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
fix - 045bb736b3 validate lowercase SVG animation attribute names

forms

Commit Description
fix - 11836a670a delay mcp reading the form model by a tick
fix - 85d2d100e3 harden FormGroup control lookups against prototype shadowing
fix - e51ad374ea remove animationstart listener on component destroy to prevent memory leak
fix - 55b7b5a6b6 set additionalProperties: false on generated WebMCP form

http

Commit Description
fix - ffb06c0514 ensure query parameters are inserted before URL fragments
fix - 2dd65d21e6 pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
fix - 4254eb416c preserve empty referrer option in HttpRequest
fix - 167bd4c162 Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit Description
fix - 43a0e28729 prevent external template inlay hints from appearing in TS files

platform-server

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/platform-server's changelog.

22.0.1 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)

common

Commit Type Description
c4b5fa3c92 fix escape CSS string-terminating characters in escapeCssUrl
dfff57ede9 fix Limits date format string length
3c2892c8df fix prevent prototype pollution in formatDateTime
1d87c49f6e fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description
1ee224ca30 fix disallow i18n event attributes
a56f1cdf8f fix more robust logic to check if regex can be optimized
5946c18275 fix sanitize href/xlink:href attributes of any element of the MathML namespace
393b84caf8 fix sanitize two-way properties

compiler-cli

Commit Type Description
3d9ca2f173 fix bind switch exhaustive check expressions

core

Commit Type Description
669146b0e7 fix disable WebMCP during SSR
562a566ead fix Handle synchronous errors in PendingTasks.run function
fa546f382d fix harden TransferState restoration against DOM clobbering
29fdb98684 fix prevent dangling prevConsumer reference from leaking destroyed views (#68681)
cdcea80327 fix require WebMCP tool descriptions
4289c4c840 fix update comment for Default change detection
3dd433b39a fix use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
045bb736b3 fix validate lowercase SVG animation attribute names

forms

Commit Type Description
11836a670a fix delay mcp reading the form model by a tick
85d2d100e3 fix harden FormGroup control lookups against prototype shadowing
e51ad374ea fix remove animationstart listener on component destroy to prevent memory leak
55b7b5a6b6 fix set additionalProperties: false on generated WebMCP form

http

Commit Type Description
ffb06c0514 fix ensure query parameters are inserted before URL fragments
2dd65d21e6 fix pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
4254eb416c fix preserve empty referrer option in HttpRequest
167bd4c162 fix Rejects non-HTTP(S) URLs in JSONP requests

language-service

| Commit | Type | Description |

... (truncated)

Commits
  • 1881ede refactor(platform-server): deprecate ServerXhr
  • ed48ca7 fix(platform-server): harden platform location origin validation during SSR
  • feb0400 refactor(platform-server): replace standard Error with RuntimeError
  • 7b91309 fix(platform-server): throw on suspicious URLs and restrict protocol-relative...
  • 6e71049 refactor(platform-server): clean up and simplify url resolution utility
  • f7b3ed8 fix(http): Introduce a max buffer size for fetch requests on SSR
  • a97d5ec build: update minimum supported Node.js versions
  • 28338a1 fix(platform-server): prevent SSRF bypasses via backslash URLs in HttpClient
  • 9552252 fix(platform-server): secure location and document initialization against SSR...
  • 119a19e fix(platform-server): forward BEFORE_APP_SERIALIZED errors to ErrorHandler
  • Additional commits viewable in compare view

Updates @angular/ssr from 21.2.13 to 22.0.1

Release notes

Sourced from @​angular/ssr's releases.

22.0.1

@​schematics/angular

Commit Description
fix - c80012294 fix browserMode option mapping in refactor-jasmine-vitest
fix - a9b6bd904 safely comment out multiline statements in refactor-jasmine-vitest
fix - 12199df00 use null objects and callbacks in karma-to-vitest migration

@​angular/cli

Commit Description
fix - b54e9a549 do not sort migrations of the same version alphabetically
fix - d33311612 fallback to local package.json for schematic detection on first run
fix - 918102a93 isolate temporary package installation from parent pnpm workspace
fix - b048b5f4a remove forceAuth and unscoped credential parsing
fix - 277934035 validate registry option is a valid URL in ng add
perf - 4510dae02 optimize update schematic registry query counts by fetching package metadata lazily

@​angular/build

Commit Description
fix - 89d1be979 allow disabling Vitest isolation from builder
fix - d45b84be9 exclude JSON imports from Vite dependency optimization
fix - e3cab4ddd prevent concurrent stylesheet bundling esbuild context leaks
fix - bd413b0eb restrict application builder output paths to output directory

22.0.0

@​schematics/angular

Commit Description
feat - be60a63b7 add migrate-karma-to-vitest update migration
feat - 43505066e add migration to add istanbul-lib-instrument
feat - b2f7a038b conditionally install istanbul coverage provider for Vitest migration
feat - d227e6985 migrate fake async to Vitest fake timers
feat - d2aa9ede5 migrate fakeAsync's flush behavior when used in beforeEach
feat - f98cc82eb rely on strict template default in generated workspaces
feat - c9f408153 set up fake timers in beforeEach instead of beforeAll
feat - de630c2fc stabilize refactor-jasmine-vitest schematic
feat - 8d0805dd1 update TSConfig globals during karma to vitest migration
fix - 470e1f937 add istanbul-lib-instrument to application/library generator dependencies
fix - dc1238e5a add trusted-proxy-headers migration
fix - 6572a6944 default components to OnPush change detection
fix - aed407db8 defer karma config deletion in Karma to Vitest migration
fix - 4fbc60891 preserve Jasmine stub-by-default semantics for bare spies
fix - b3d838dfd replace deprecated ChangeDetectionStrategy.Default with Eager
fix - a7ac8e5f0 support spy call arguments migration in refactor-jasmine-vitest
fix - 7fb59eaa6 use service decorator in ng generate

@​angular/cli

Commit Description
feat - 58c0978f6 add support for Node.js 26.0.0
fix - a5c7c0b5f reflect new minimum supported Node version in ng.js

... (truncated)

Changelog

Sourced from @​angular/ssr's changelog.

22.0.1 (2026-06-10)

@​angular/cli

Commit Type Description
b54e9a549 fix do not sort migrations of the same version alphabetically
d33311612 fix fallback to local package.json for schematic detection on first run
918102a93 fix isolate temporary package installation from parent pnpm workspace
b048b5f4a fix remove forceAuth and unscoped credential parsing
277934035 fix validate registry option is a valid URL in ng add
4510dae02 perf optimize update schematic registry query counts by fetching package metadata lazily

@​schematics/angular

Commit Type Description
c80012294 fix fix browserMode option mapping in refactor-jasmine-vitest
a9b6bd904 fix safely comment out multiline statements in refactor-jasmine-vitest
12199df00 fix use null objects and callbacks in karma-to-vitest migration

@​angular/build

Commit Type Description
89d1be979 fix allow disabling Vitest isolation from builder
d45b84be9 fix exclude JSON imports from Vite dependency optimization
e3cab4ddd fix prevent concurrent stylesheet bundling esbuild context leaks
bd413b0eb fix restrict application builder output paths to output directory

22.0.0 (2026-06-03)

Breaking Changes

  • Node.js v20 is no longer supported. The minimum supported Node.js versions are now v22.22.0 and v24.13.1.
  • The @angular-devkit/architect-cli package is no longer available. The architect CLI tool has been moved to the @angular-devkit/architect package.
  • The experimental @angular-devkit/build-angular:jest and @angular-devkit/build-angular:web-test-runner builders have been removed.

@​angular/build

  • The @angular/build:dev-server (ng serve) now assigns the highest priority to the PORT environment variable. This value will override any port configurations specified in angular.json or via the --port command-line flag. This includes the default port 4200.
  • istanbul-lib-instrument is now an optional peer dependency. Projects using karma with code coverage enabled will need to ensure that istanbul-lib-instrument is installed. Note: ng update will automatically add this dependency during the update process.

... (truncated)

Commits
  • 5a64af9 release: cut the v22.0.1 release
  • b54e9a5 fix(@​angular/cli): do not sort migrations of the same version alphabetically
  • b048b5f fix(@​angular/cli): remove forceAuth and unscoped credential parsing
  • 3275b45 test(@​angular/cli): remove unscoped authentication test cases from registry t...
  • da81e55 build: update cross-repo angular dependencies
  • 56ac348 build: lock file maintenance
  • 12199df fix(@​schematics/angular): use null objects and callbacks in karma-to-vitest m...
  • 918102a fix(@​angular/cli): isolate temporary package installation from parent pnpm wo...
  • e9b106e build: update cross-repo angular dependencies
  • e3cab4d fix(@​angular/build): prevent concurrent stylesheet bundling esbuild context l...
  • Additional commits viewable in compare view

Updates @angular/build from 21.2.13 to 22.0.1

Release notes

Sourced from @​angular/build's releases.

22.0.1

@​schematics/angular

Commit Description
fix - c80012294 fix browserMode option mapping in refactor-jasmine-vitest
fix - a9b6bd904 safely comment out multiline statements in refactor-jasmine-vitest
fix - 12199df00 use null objects and callbacks in karma-to-vitest migration

@​angular/cli

Commit Description
fix - b54e9a549 do not sort migrations of the same version alphabetically
fix - d33311612 fallback to local package.json for schematic detection on first run
fix - 918102a93 isolate temporary package installation from parent pnpm workspace
fix - b048b5f4a remove forceAuth and unscoped credential parsing
fix - 277934035 validate registry option is a valid URL in ng add
perf - 4510dae02 optimize update schematic registry query counts by fetching package metadata lazily

@​angular/build

Commit Description
fix - 89d1be979 allow disabling Vitest isolation from builder
fix - d45b84be9 exclude JSON imports from Vite dependency optimization
fix - e3cab4ddd prevent concurrent stylesheet bundling esbuild context leaks
fix - bd413b0eb restrict application builder output paths to output directory

22.0.0

@​schematics/angular

Commit Description
feat - be60a63b7 add migrate-karma-to-vitest update migration
feat - 43505066e add migration to add istanbul-lib-instrument
feat - b2f7a038b conditionally install istanbul coverage provider for Vitest migration
feat - d227e6985 migrate fake async to Vitest fake timers
feat - d2aa9ede5 migrate fakeAsync's flush behavior when used in beforeEach
feat - f98cc82eb rely on strict template default in generated workspaces
feat - c9f408153 set up fake timers in beforeEach instead of beforeAll
feat - de630c2fc stabilize refactor-jasmine-vitest schematic
feat - 8d0805dd1 update TSConfig globals during karma to vitest migration
fix - 470e1f937 add istanbul-lib-instrument to application/library generator dependencies
fix - dc1238e5a add trusted-proxy-headers migration
fix - 6572a6944 default components to OnPush change detection
fix - aed407db8 defer karma config deletion in Karma to Vitest migration
fix - 4fbc60891 preserve Jasmine stub-by-default semantics for bare spies
fix - b3d838dfd replace deprecated ChangeDetectionStrategy.Default with Eager
fix - a7ac8e5f0 support spy call arguments migration in refactor-jasmine-vitest
fix - 7fb59eaa6 use service decorator in ng generate

@​angular/cli

Commit Description
feat - 58c0978f6 add support for Node.js 26.0.0
fix - a5c7c0b5f reflect new minimum supported Node version in ng.js

... (truncated)

Changelog

Sourced from @​angular/build's changelog.

22.0.1 (2026-06-10)

@​angular/cli

Commit Type Description
b54e9a549 fix do not sort migrations of the same version alphabetically
d33311612 fix fallback to local package.json for schematic detection on first run
918102a93 fix isolate temporary package installation from parent pnpm workspace
b048b5f4a fix remove forceAuth and unscoped credential parsing
277934035 fix validate registry option is a valid URL in ng add
4510dae02 perf optimize update schematic registry query counts by fetching package metadata lazily

@​schematics/angular

Commit Type Description
c80012294 fix fix browserMode option mapping in refactor-jasmine-vitest
a9b6bd904 fix safely comment out multiline statements in refactor-jasmine-vitest
12199df00 fix use null objects and callbacks in karma-to-vitest migration

@​angular/build

Commit Type Description
89d1be979 fix allow disabling Vitest isolation from builder
d45b84be9 fix exclude JSON imports from Vite dependency optimization
e3cab4ddd fix prevent concurrent stylesheet bundling esbuild context leaks
bd413b0eb fix restrict application builder output paths to output directory

22.0.0 (2026-06-03)

Breaking Changes

  • Node.js v20 is no longer supported. The minimum supported Node.js versions are now v22.22.0 and v24.13.1.
  • The @angular-devkit/architect-cli package is no longer available. The architect CLI tool has been moved to the @angular-devkit/architect package.
  • The experimental @angular-devkit/build-angular:jest and @angular-devkit/build-angular:web-test-runner builders have been removed.

@​angular/build

  • The @angular/build:dev-server (ng serve) now assigns the highest priority to the PORT environment variable. This value will override any port configurations specified in angular.json or via the --port command-line flag. This includes the default port 4200.
  • istanbul-lib-instrument is now an optional peer dependency. Projects using karma with code coverage enabled will need to ensure that istanbul-lib-instrument is installed. Note: ng update will automatically add this dependency during the update process.

... (truncated)

Commits
  • 5a64af9 release: cut the v22.0.1 release
  • b54e9a5 fix(@​angular/cli): do not sort migrations of the same version alphabetically
  • b048b5f fix(@​angular/cli): remove forceAuth and unscoped credential parsing
  • 3275b45 test(@​angular/cli): remove unscoped authentication test cases from registry t...
  • da81e55 build: update cross-repo angular dependencies
  • 56ac348 build: lock file maintenance
  • 12199df fix(@​schematics/angular): use null objects and callbacks in karma-to-vitest m...
  • 918102a fix(@​angular/cli): isolate temporary package installation from parent pnpm wo...
  • e9b106e build: update cross-repo angular dependencies
  • e3cab4d fix(@​angular/build): prevent concurrent stylesheet bundling esbuild context l...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump @angular/platform-server, @angular/ssr and @angular/build
07ecf63 
Bumps [@angular/platform-server](https://github.com/angular/angular/tree/HEAD/packages/platform-server), [@angular/ssr](https://github.com/angular/angular-cli) and [@angular/build](https://github.com/angular/angular-cli). These dependencies needed to be updated together.

Updates `@angular/platform-server` from 21.2.15 to 22.0.1
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/platform-server)

Updates `@angular/ssr` from 21.2.13 to 22.0.1
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](angular/angular-cli@v21.2.13...v22.0.1)

Updates `@angular/build` from 21.2.13 to 22.0.1
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](angular/angular-cli@v21.2.13...v22.0.1)

---
updated-dependencies:
- dependency-name: "@angular/platform-server"
  dependency-version: 22.0.1
  dependency-type: direct:production
- dependency-name: "@angular/ssr"
  dependency-version: 22.0.1
  dependency-type: direct:production
- dependency-name: "@angular/build"
  dependency-version: 22.0.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #17.

@dependabot dependabot Bot closed this Aug 3, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-00625189c6 branch August 3, 2026 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants