chore(deps): bump the npm_and_yarn group across 4 directories with 7 updates by dependabot[bot] · Pull Request #333 · pathosDev/actor-ts

dependabot · 2026-06-20T10:56:29Z

Bumps the npm_and_yarn group with 5 updates in the /examples/chat/frontend-angular directory:

Package	From	To
@angular/common	`21.2.13`	`22.0.2`
@angular/compiler	`21.2.13`	`21.2.17`
@angular/core	`21.2.13`	`21.2.17`
hono	`4.12.23`	`4.12.26`
undici	`6.25.0`	`6.27.0`

Bumps the npm_and_yarn group with 1 update in the /examples/chat/frontend-svelte directory: vite.
Bumps the npm_and_yarn group with 5 updates in the /examples/voice/frontend-angular directory:

Package	From	To
@angular/common	`21.2.13`	`22.0.2`
@angular/compiler	`21.2.13`	`21.2.17`
@angular/core	`21.2.13`	`21.2.17`
hono	`4.12.23`	`4.12.26`
undici	`6.25.0`	`6.27.0`

Bumps the npm_and_yarn group with 1 update in the /examples/voice/frontend-svelte directory: vite.

Updates @angular/common from 21.2.13 to 22.0.2

Release notes

Sourced from @angular/common's releases.

22.0.2

common

Commit Description

escape anchor fragment in shadow DOM name selector

skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit Description

restrict possible event handler check to property names longer than 2 characters

core

Commit Description

avoid caching missing locale data

escape overlapping comment delimiters in escapeCommentText

guard against DOM clobbering in declareExperimentalWebMcpTool

preserve leave animation for sibling instances sharing a TNode

prevent unsubscribe during emit from throwing off other listeners

treat iframe credentialless as security-sensitive

detect existing signal dependency without checking all producer links

http

Commit Description

distinguish repeated transfer cache params

skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit Description

migration skip any target are not build or test

22.0.1

common

Commit Description

escape CSS string-terminating characters in escapeCssUrl

Limits date format string length

prevent prototype pollution in formatDateTime

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

disallow i18n event attributes

more robust logic to check if regex can be optimized

sanitize href/xlink:href attributes of any element of the MathML namespace

sanitize two-way properties

compiler-cli

Commit Description

bind switch exhaustive check expressions

core

... (truncated)

Changelog

Sourced from @angular/common's changelog.

22.0.2 (2026-06-17)

common

Commit Type Description

94ea403563 fix escape anchor fragment in shadow DOM name selector

6c1f3e9d49 fix skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit Type Description

6f1171991a fix restrict possible event handler check to property names longer than 2 characters

core

Commit Type Description

528a34f766 fix avoid caching missing locale data

e17e8d5422 fix escape overlapping comment delimiters in escapeCommentText

59dea13f80 fix guard against DOM clobbering in declareExperimentalWebMcpTool

3a48abc15c fix preserve leave animation for sibling instances sharing a TNode

93d0a5f95c fix prevent unsubscribe during emit from throwing off other listeners

b32ee7ceb3 fix treat iframe credentialless as security-sensitive

f902d1d35e perf detect existing signal dependency without checking all producer links

http

Commit Type Description

6867f77ec7 fix distinguish repeated transfer cache params

7ef1399068 fix skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit Type Description

15314c1736 fix migration skip any target are not build or test

22.1.0-next.0 (2026-06-10)

Deprecations

http

HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit Type Description

1ad6824d0d fix skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit Type Description

25c744c4d0 fix support foreign components defined outside top-level scope

compiler-cli

Commit Type Description

aeb55c8bc1 fix allow passing uninvoked signals as foreign component props

7c60a98b3c fix support import aliases in foreignImports (#68674)

... (truncated)

Commits

6867f77 fix(http): distinguish repeated transfer cache params
6c1f3e9 fix(common): skip transfer cache for uncacheable HTTP traffic (#69316)
7ef1399 fix(http): skip transfer cache for fetch credentialed requests (#69316)
94ea403 fix(common): escape anchor fragment in shadow DOM name selector
2dd65d2 fix(http): pass down the reportUploadProgress and reportDownloadProgress ...
1bd5a56 docs: deprecate XHR support for server-side rendering in HTTP docs and recomm...
3c2892c fix(common): prevent prototype pollution in formatDateTime
c4b5fa3 fix(common): escape CSS string-terminating characters in escapeCssUrl
4254eb4 fix(http): preserve empty referrer option in HttpRequest
167bd4c fix(http): Rejects non-HTTP(S) URLs in JSONP requests
Additional commits viewable in compare view

Updates @angular/compiler from 21.2.13 to 21.2.17

Release notes

Sourced from @angular/compiler's releases.

21.2.17

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69269)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69255)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

21.2.16

common

Commit Description

only strip a literal /index.html suffix from URLs

compiler

Commit Description

move projection attributes into constants

core

Commit Description

harden inherit definition feature against polluted prototypes

use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

21.2.17 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

86a56dc279 fix Limits date format string length

d846326b07 fix skip transfer cache for uncacheable HTTP traffic

bc55749698 fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

dc9c99636d fix sanitize two-way properties

core

Commit Type Description

1523061137 fix harden TransferState restoration against DOM clobbering

88832c84f8 fix validate lowercase SVG animation attribute names (#69269)

http

Commit Type Description

bcb1b7ea25 fix preserve empty referrer option in HttpRequest

a810a319d1 fix Rejects non-HTTP(S) URLs in JSONP requests

e245d40c4d fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

35510746b7 fix harden platform location origin validation during SSR

13fb0afe93 refactor deprecate ServerXhr (#69255)

service-worker

Commit Type Description

b9d29381bb fix Strips sensitive headers on cross-origin redirects

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

| Commit | Type | Description |

... (truncated)

Commits

dc9c996 fix(compiler): sanitize two-way properties
ae1c8a1 fix(compiler): move projection attributes into constants
eb1cbbf fix(compiler): prevent namespaced SVG <style> elements from being stripped
29ceeff docs: fix typos in source code comments
782e015 fix(compiler): strip namespaced SVG script elements during template compilati...
ff12fe5 fix(core): normalize tag names in runtime i18n attribute security context loo...
0b07f47 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
cc1378d fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
daaf329 fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
68282df fix(compiler): strip namespaced SVG script elements during template compilation
Additional commits viewable in compare view

Updates @angular/core from 21.2.13 to 21.2.17

Release notes

Sourced from @angular/core's releases.

21.2.17

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69269)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69255)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

21.2.16

common

Commit Description

only strip a literal /index.html suffix from URLs

compiler

Commit Description

move projection attributes into constants

core

Commit Description

harden inherit definition feature against polluted prototypes

use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

... (truncated)

Changelog

Sourced from @angular/core's changelog.

21.2.17 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

86a56dc279 fix Limits date format string length

d846326b07 fix skip transfer cache for uncacheable HTTP traffic

bc55749698 fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

dc9c99636d fix sanitize two-way properties

core

Commit Type Description

1523061137 fix harden TransferState restoration against DOM clobbering

88832c84f8 fix validate lowercase SVG animation attribute names (#69269)

http

Commit Type Description

bcb1b7ea25 fix preserve empty referrer option in HttpRequest

a810a319d1 fix Rejects non-HTTP(S) URLs in JSONP requests

e245d40c4d fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

35510746b7 fix harden platform location origin validation during SSR

13fb0afe93 refactor deprecate ServerXhr (#69255)

service-worker

Commit Type Description

b9d29381bb fix Strips sensitive headers on cross-origin redirects

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

| Commit | Type | Description |

... (truncated)

Commits

88832c8 fix(core): validate lowercase SVG animation attribute names (#69269)
3551074 fix(platform-server): harden platform location origin validation during SSR
bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
d846326 fix(common): skip transfer cache for uncacheable HTTP traffic
e245d40 fix(http): skip transfer cache for fetch credentialed requests
1523061 fix(core): harden TransferState restoration against DOM clobbering
736c4ab refactor(core): fix broken unit test.
3fd6897 fix(core): harden inherit definition feature against polluted prototypes
7e38336 fix(core): use Object.create(null) for LOCALE_DATA as a hardening measure
29ceeff docs: fix typos in source code comments
Additional commits viewable in compare view

Updates esbuild from 0.27.3 to 0.27.7

Release notes

Sourced from esbuild's releases.

v0.27.7
Fix lowering of define semantics for TypeScript parameter properties (#4421)

The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)
class Foo {
constructor(x = 1) {
this.x = x;
__publicField(this, "y", 2);
}
x;
}
// New output (with --loader=ts --target=es2021)
class Foo {
constructor(x = 1) {
__publicField(this, "x", x);
__publicField(this, "y", 2);
}
}
v0.27.5
Fix for an async generator edge case (#4401, #4417)

Support for transforming async generators into the equivalent state machine was added in version 0.19.0. However, the generated state machine didn't work correctly when polling async generators concurrently, such as in the following code:
async function* inner() { yield 1; yield 2 }
async function* outer() { yield* inner() }
let gen = outer()
for await (let x of [gen.next(), gen.next()]) console.log(x)
Previously esbuild's output of the above code behaved incorrectly when async generators were transformed (such as with --supported:async-generator=false). The transformation should be fixed starting with this release.

This fix was contributed by @2767mr.
Fix a regression when metafile is enabled (#4420, #4418)

This release fixes a regression introduced by the previous release. When metafile: true was enabled in esbuild's JavaScript API, builds with build errors were incorrectly throwing an error about an empty JSON string instead of an object containing the build errors.

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.27.7
Fix lowering of define semantics for TypeScript parameter properties (#4421)

The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)
class Foo {
constructor(x = 1) {
this.x = x;
__publicField(this, "y", 2);
}
x;
}
// New output (with --loader=ts --target=es2021)
class Foo {
constructor(x = 1) {
__publicField(this, "x", x);
__publicField(this, "y", 2);
}
}
0.27.5
Fix for an async generator edge case (#4401, #4417)

Support for transforming async generators into the equivalent state machine was added in version 0.19.0. However, the generated state machine didn't work correctly when polling async generators concurrently, such as in the following code:
async function* inner() { yield 1; yield 2 }
async function* outer() { yield* inner() }
let gen = outer()
for await (let x of [gen.next(), gen.next()]) console.log(x)
Previously esbuild's output of the above code behaved incorrectly when async generators were transformed (such as with --supported:async-generator=false). The transformation should be fixed starting with this release.

This fix was contributed by @2767mr.
Fix a regression when metafile is enabled (#4420, #4418)

... (truncated)

Commits

2025c9f publish 0.27.7 to npm
c6b586e fix typo in Makefile for @esbuild/win32-x64
9785e14 publish 0.27.6 to npm
b169d8c Revert "update go 1.25.7 => 1.26.1"
7ac8762 run make update-compat-table
8b5ff53 remove an incorrect else
e955268 fix #4421: lower generated class fields if needed
a5a2500 ci: move make test-old-ts
b71e7ac omit go's buildvcs for more reproducible builds
7406b09 organize make platform-all output in Makefile
Additional commits viewable in compare view

Updates hono from 4.12.23 to 4.12.26

Release notes

Sourced from hono's releases.

v4.12.26

What's Changed

fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @yusukebe in honojs/hono#5013

ci: publish to npm from CI with OIDC trusted publishing by @yusukebe in honojs/hono#5028

chore: remove unused devcontainer and gitpod configs by @yusukebe in honojs/hono#5029

chore: replace arg and glob with Bun native APIs in build script by @yusukebe in honojs/hono#5030

Full Changelog: honojs/hono@v4.12.25...v4.12.26

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

docs(contribution): simplifyAI Usage Policy by @yusukebe in honojs/hono#4972

chore: remove @types/glob by @rtritto in honojs/hono#4978

fix(bearer-auth): mention verifyToken in missing-options error message by @tan7vir in honojs/hono#4987

refactor(language): Test/improve tests on languages middleware by @iNeoO in honojs/hono#4980

fix(utils/ipaddr): expand "::" to eight zero groups by @youcefzemmar in honojs/hono#4973

fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by @Mohammad-Faiz-Cloud-Engineer in honojs/hono#4982

refactor(timing): Test/add test for middleware timing by @iNeoO in honojs/hono#4991

fix(utils/ipaddr): render the unspecified address binary as "::" by @sarathfrancis90 in honojs/hono#4998

Full Changelog: honojs/hono@v4.12.23...v4.12.24

Commits

27b7992 4.12.26
d29982c chore: replace arg and glob with Bun native APIs in build script
16215d5 chore: remove unused devcontainer and gitpod configs (#5029)
c574cf1 ci: publish to npm from CI with OIDC trusted publishing (#5028)
e50df01 fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding (#5...
fce483e 4.12.25
751ba41 Merge commit from fork
f0b094d Merge commit from fork
fa5f9bf Merge commit from fork
3892a6c Merge commit from fork
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates undici from 6.25.0 to 6.27.0

Release notes

Sourced from undici's releases.

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.
Action required: Upgrade to undici 6.27.0 or later.
npm install undici@^6.27.0
Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.

Workaround: none — upgrade is required.

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits

551138c Bumped v6.27.0 (#5431)
b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
25efa44 fix(cookies): preserve values and parse SameSite strictly
f4c31d6 fix: guard idle socket validation to skip fresh sockets (#5400)
768beac Bumped v6.26.0 (#5323)
7917b25 fix: validate EOF for chunked h1 responses (#5308)
See full diff in compare view

Updates vite from 7.3.2 to 7.3.5

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

deps: reject UNC paths for launch-editor-middleware (#22571) (50b9512)

reject windows alternate paths (#22572) (dc245c7)

8.0.15 (2026-06-01)

Features

send 408 on request timeout (#22476) (c85c9ee)

update rolldown to 1.0.3 (#22538) (646dbed)

Bug Fixes

capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)

deps: update all n...
Description has been truncated

…updates Bumps the npm_and_yarn group with 5 updates in the /examples/chat/frontend-angular directory: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.13` | `22.0.2` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.13` | `21.2.17` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.13` | `21.2.17` | | [hono](https://github.com/honojs/hono) | `4.12.23` | `4.12.26` | | [undici](https://github.com/nodejs/undici) | `6.25.0` | `6.27.0` | Bumps the npm_and_yarn group with 1 update in the /examples/chat/frontend-svelte directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 5 updates in the /examples/voice/frontend-angular directory: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.13` | `22.0.2` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.13` | `21.2.17` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.13` | `21.2.17` | | [hono](https://github.com/honojs/hono) | `4.12.23` | `4.12.26` | | [undici](https://github.com/nodejs/undici) | `6.25.0` | `6.27.0` | Bumps the npm_and_yarn group with 1 update in the /examples/voice/frontend-svelte directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@angular/common` from 21.2.13 to 22.0.2 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.2/packages/common) Updates `@angular/compiler` from 21.2.13 to 21.2.17 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.17/packages/compiler) Updates `@angular/core` from 21.2.13 to 21.2.17 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.17/packages/core) Updates `esbuild` from 0.27.3 to 0.27.7 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.3...v0.27.7) Updates `hono` from 4.12.23 to 4.12.26 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.23...v4.12.26) Updates `undici` from 6.25.0 to 6.27.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.25.0...v6.27.0) Updates `vite` from 7.3.2 to 7.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `vite` from 8.0.10 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `vite` from 8.0.13 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `@angular/common` from 21.2.13 to 22.0.2 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.2/packages/common) Updates `@angular/compiler` from 21.2.13 to 21.2.17 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.17/packages/compiler) Updates `@angular/core` from 21.2.13 to 21.2.17 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.17/packages/core) Updates `esbuild` from 0.27.3 to 0.27.7 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.3...v0.27.7) Updates `hono` from 4.12.23 to 4.12.26 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.23...v4.12.26) Updates `undici` from 6.25.0 to 6.27.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.25.0...v6.27.0) Updates `vite` from 7.3.2 to 7.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `vite` from 8.0.10 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `vite` from 8.0.13 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 22.0.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 21.2.17 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 21.2.17 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.27.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.26 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.27.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@angular/common" dependency-version: 22.0.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 21.2.17 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 21.2.17 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.27.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.26 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.27.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 20, 2026

dependabot Bot mentioned this pull request Jun 20, 2026

chore(deps): bump the npm_and_yarn group across 4 directories with 6 updates #332

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 4 directories with 7 updates#333

chore(deps): bump the npm_and_yarn group across 4 directories with 7 updates#333
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/chat/frontend-angular/npm_and_yarn-4785c07680

dependabot Bot commented on behalf of github Jun 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize `href`/`xlink:href` attributes of any element of the MathML namespace
	sanitize two-way properties

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#69316)

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#69316)

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#68674)

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69269)

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69255)

Commit	Description
	harden inherit definition feature against polluted prototypes
	use Object.create(null) for LOCALE_DATA as a hardening measure

Commit	Type	Description
86a56dc279	fix	Limits date format string length
d846326b07	fix	skip transfer cache for uncacheable HTTP traffic
bc55749698	fix	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
1523061137	fix	harden TransferState restoration against DOM clobbering
88832c84f8	fix	validate lowercase SVG animation attribute names (#69269)

Commit	Type	Description
bcb1b7ea25	fix	preserve empty referrer option in HttpRequest
a810a319d1	fix	Rejects non-HTTP(S) URLs in JSONP requests
e245d40c4d	fix	skip transfer cache for fetch credentialed requests

Commit	Type	Description
35510746b7	fix	harden platform location origin validation during SSR
13fb0afe93	refactor	deprecate ServerXhr (#69255)

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	`b7f252e7`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	`25efa447`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	`25efa447`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	`f4c31d60`

Conversation

dependabot Bot commented on behalf of github Jun 20, 2026

22.0.2

common

compiler

core

http

migrations

22.0.1

common

compiler

compiler-cli

core

22.0.2 (2026-06-17)

common

compiler

core

http

migrations

22.1.0-next.0 (2026-06-10)

Deprecations

http

common

compiler

compiler-cli

21.2.17

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

21.2.16

common

compiler

core

platform-server

21.2.17 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

21.2.17

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

21.2.16

common

compiler

core

platform-server

21.2.17 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

20.3.25 (2026-06-10)

Deprecations

platform-server

common

CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice