Skip to content

chore(deps-dev): bump @angular/core from 21.2.14 to 21.2.15#2751

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/angular/core-21.2.15
May 28, 2026
Merged

chore(deps-dev): bump @angular/core from 21.2.14 to 21.2.15#2751
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/angular/core-21.2.15

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 28, 2026

Bumps @angular/core from 21.2.14 to 21.2.15.

Release notes

Sourced from @​angular/core's releases.

21.2.15

common

Commit Description
fix - 7f4ac78994 add upper bounds for digitsInfo
fix - 300f61feb3 sanitize placeholder

compiler

Commit Description
fix - 0b07f47bd6 normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
fix - eb1cbbf2eb prevent namespaced SVG elements from being stripped
fix - cc1378d54b sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
fix - 782e01594e strip namespaced SVG script elements during template compilation (#68925)

core

Commit Description
fix - ff12fe55ac normalize tag names in runtime i18n attribute security context lookup (#68925)
fix - e6fe77cc97 sanitize meta selectors
fix - daaf32937f support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
fix - dada86e43d synchronize core sanitization schema with compiler (#68925)

http

Commit Description
fix - 582a417bd2 exclude withCredentials requests from transfer cache
fix - 5c6d6df34b skip TransferCache for cookie-bearing requests by default

platform-server

Commit Description
fix - 37e8aadf87 prevent SSRF bypasses via backslash URLs in HttpClient
fix - 72696e244e secure location and document initialization against SSRF and path hijack

service-worker

Commit Description
fix - b8bd49341d Preserves explicit 'credentials: omit' in asset requests
fix - ca32fc1000 Preserves HTTP cache mode in asset group requests
Changelog

Sourced from @​angular/core's changelog.

21.2.15 (2026-05-28)

common

Commit Type Description
7f4ac78994 fix add upper bounds for digitsInfo
300f61feb3 fix sanitize placeholder

compiler

Commit Type Description
0b07f47bd6 fix normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
eb1cbbf2eb fix prevent namespaced SVG elements from being stripped
cc1378d54b fix sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
782e01594e fix strip namespaced SVG script elements during template compilation (#68925)

core

Commit Type Description
ff12fe55ac fix normalize tag names in runtime i18n attribute security context lookup (#68925)
e6fe77cc97 fix sanitize meta selectors
daaf32937f fix support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
dada86e43d fix synchronize core sanitization schema with compiler (#68925)

http

Commit Type Description
582a417bd2 fix exclude withCredentials requests from transfer cache
5c6d6df34b fix skip TransferCache for cookie-bearing requests by default

platform-server

Commit Type Description
37e8aadf87 fix prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e fix secure location and document initialization against SSRF and path hijack

service-worker

Commit Type Description
b8bd49341d fix Preserves explicit 'credentials: omit' in asset requests
ca32fc1000 fix Preserves HTTP cache mode in asset group requests

19.2.24 (2026-05-28)

compiler

Commit Type Description
6ea6379123 fix prevent namespaced SVG elements from being stripped

20.3.23 (2026-05-28)

compiler

... (truncated)

Commits
  • 29ceeff docs: fix typos in source code comments
  • 251c8f2 test(core): remove obsolete SVG script sanitization translation test (#68925)
  • dada86e fix(core): synchronize core sanitization schema with compiler (#68925)
  • 782e015 fix(compiler): strip namespaced SVG script elements during template compilati...
  • ff12fe5 fix(core): normalize tag names in runtime i18n attribute security context loo...
  • 0b07f47 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
  • cc1378d fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
  • daaf329 fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 21.2.14 to 21.2.15.
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.15/packages/core)

---
updated-dependencies:
- dependency-name: "@angular/core"
  dependency-version: 21.2.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 28, 2026
@github-actions github-actions Bot merged commit 1028078 into main May 28, 2026
2 of 3 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/angular/core-21.2.15 branch May 28, 2026 22:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants