Skip to content

chore(deps): update npm packages#326

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/npm-packages
Jun 1, 2026
Merged

chore(deps): update npm packages#326
renovate[bot] merged 1 commit into
mainfrom
renovate/npm-packages

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 31, 2026

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@angular/animations (source) 21.2.1421.2.15 age adoption passing confidence
@angular/build 21.2.1221.2.13 age adoption passing confidence
@angular/cdk 21.2.1221.2.13 age adoption passing confidence
@angular/common (source) 21.2.1421.2.15 age adoption passing confidence
@angular/compiler (source) 21.2.1421.2.15 age adoption passing confidence
@angular/compiler-cli (source) 21.2.1421.2.15 age adoption passing confidence
@angular/core (source) 21.2.1421.2.15 age adoption passing confidence
@angular/forms (source) 21.2.1421.2.15 age adoption passing confidence
@angular/material 21.2.1221.2.13 age adoption passing confidence
@angular/platform-browser (source) 21.2.1421.2.15 age adoption passing confidence
@angular/platform-browser-dynamic (source) 21.2.1421.2.15 age adoption passing confidence
@angular/router (source) 21.2.1421.2.15 age adoption passing confidence
@sanity/types (source) 5.26.05.28.0 age adoption passing confidence
posthog-js (source) 1.375.01.376.4 age adoption passing confidence

Release Notes

angular/angular (@​angular/animations)

v21.2.15

Compare Source

common
Commit Type Description
7f4ac78994 fix add upper bounds for digitsInfo
300f61feb3 fix sanitize placeholder
compiler
Commit Type Description
0b07f47bd6 fix normalize tag names with custom namespaces in DomElementSchemaRegistry (#​68925)
eb1cbbf2eb fix prevent namespaced SVG <style> elements from being stripped
cc1378d54b fix sanitize dynamic href and xlink:href bindings on SVG a elements (#​68925)
782e01594e fix strip namespaced SVG script elements during template compilation (#​68925)
core
Commit Type Description
ff12fe55ac fix normalize tag names in runtime i18n attribute security context lookup (#​68925)
e6fe77cc97 fix sanitize meta selectors
daaf32937f fix support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#​68925)
dada86e43d fix synchronize core sanitization schema with compiler (#​68925)
http
Commit Type Description
582a417bd2 fix exclude withCredentials requests from transfer cache
5c6d6df34b fix skip TransferCache for cookie-bearing requests by default
platform-server
Commit Type Description
37e8aadf87 fix prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e fix secure location and document initialization against SSRF and path hijack
service-worker
Commit Type Description
b8bd49341d fix Preserves explicit 'credentials: omit' in asset requests
ca32fc1000 fix Preserves HTTP cache mode in asset group requests
angular/angular-cli (@​angular/build)

v21.2.13

Compare Source

@​angular-devkit/build-angular
Commit Type Description
3c6d26a31 fix remove unconditional CORS wildcard from webpack dev-server
@​angular/build
Commit Type Description
2b3e95517 fix assert that asset input paths are within workspace root
angular/components (@​angular/cdk)

v21.2.13

Compare Source

No user facing changes in this release

sanity-io/sanity (@​sanity/types)

v5.28.0

Compare Source

Bug Fixes

v5.27.0

Compare Source

Sanity Studio v5.27.0

This release includes various improvements and bug fixes.

For the complete changelog with all details, please visit:
www.sanity.io/changelog/studio-NS4yNi4w

Install or upgrade Sanity Studio

To upgrade to this version, run:

npm install sanity@latest

To initiate a new Sanity Studio project or learn more about upgrading, please refer to our comprehensive guide on Installing and Upgrading Sanity Studio.

📓 Full changelog

Author Message Commit
squiggler-app[bot] chore(deps): dedupe pnpm-lock.yaml (#​12846) 2057560
@​juice49 fix(sanity): add SanityImageSource to permitted media preview types (#​12863) ecf8f39
@​juice49 fix(sanity): set correct dimensions for PTE block image preview (#​12863) 44bc72c
@​pedrobonamin feat(actions): adds sieve (#​12864) 5742d89
@​bjoerge chore(ci): add node 26 to test matrix (#​12860) ca41e8f
@​juice49 fix(sanity): full-screen PTE popover boundaries (#​12857) c78ec37
@​pedrobonamin feat(core): add variant definition delete action (#​12848) e296b6c
@​pedrobonamin feat(core): initial implementation for variants creation form (#​12847) 9178fe2
@​pedrobonamin feat(core): Setting up variants tool (#​12840) ee6c149
@​pedrobonamin fix(i18n): mark stable resources for translation (#​12861) 36a8b11
@​bjoerge chore(ci): bring back build metadata for prereleases (#​12856) 2428346
@​hermanwikner fix(comments): hide empty field wrapper when field component is hidden (#​12773) 320f744
@​bjoerge chore: upgrade react-i18next & i18next (#​12845) de77cf7
@​EoinFalconer fix(e2e): stabilize flaky delete and restore document-action tests (#​12714) e356ae3
PostHog/posthog-js (posthog-js)

v1.376.4

Compare Source

1.376.4

Patch Changes
  • #​3685 f59f35a Thanks @​ioannisj! - fix(cookieless): enable request queue when opting out in on_reject mode. When using cookieless_mode: "on_reject", calling opt_out_capturing() correctly switched the SDK into cookieless capturing but never enabled the RequestQueue — so batched events were enqueued but never flushed over the network. At init time the queue was not started because consent was PENDING and is_capturing() returned false; opt_out_capturing() is the first moment capturing becomes active but was missing the _start_queue_if_opted_in() call that opt_in_capturing() already had.
    (2026-05-28)

  • #​3692 f01cd93 Thanks @​ksvat! - fix(replay): take a fresh full snapshot after session ID rotates via forcedIdleReset. Previously, when the session manager's idle enforcement timer rotated the session id, the recorder tore down rrweb and set _isIdle = 'unknown' before the new session id was observed. Neither restart path then fired (the _onSessionIdCallback guard only restarted when _isIdle === true, and _updateWindowAndSessionIds could not run with rrweb stopped), so the new session received only incremental mutations until a later snapshot — leaving the player stuck on "Buffering". The restart guard now also fires when rrweb isn't running.
    (2026-05-28)

  • #​3691 cc71f3f Thanks @​ksvat! - fix(replay): ship ph-no-capture absolute-position fix from #​3678 to posthog-js. The original changeset only bumped @posthog/rrweb and @posthog/rrweb-snapshot; because posthog-js depends on @posthog/rrweb via workspace:*, the cascade did not bump posthog-js, so the rebuilt bundle containing the fix was not published. This changeset re-publishes posthog-js with the fix.
    (2026-05-28)

  • #​3695 e1ff722 Thanks @​ksvat! - chore(replay): expose $sdk_debug_rrweb_attached and $sdk_debug_rrweb_start_attempted debug properties on captured events. Today the SDK already stamps several $sdk_debug_* properties (start reason, linked-flag trigger status, recording status) that report the SDK's intent to record — they all flip to "active" as soon as the state machine evaluates the configured triggers. None of them observe whether rrweb actually attached and is producing events. The new booleans close that gap: $sdk_debug_rrweb_start_attempted is set when _startRecorder() is first entered, and $sdk_debug_rrweb_attached reflects whether _stopRrweb is currently a non-falsy stop handle (i.e. rrwebRecord({...}) returned successfully and the recorder has not been torn down). No behavior change — this only adds two booleans to the existing sdkDebugProperties channel, used to diagnose cases where a session reports trigger_activated / recording_status: active but no $snapshot data is ever uploaded.
    (2026-05-28)

  • Updated dependencies [7b84b75]:

v1.376.3

Compare Source

1.376.3

Patch Changes

v1.376.2

Compare Source

1.376.2

Patch Changes
  • #​3667 cafa9cc Thanks @​pauldambra! - fix(replay): stop polling preload-as-style <link> elements forever. Session recorder treated <link rel="preload" as="style" href="*.css"> as if it were a stylesheet and waited for link.sheet to populate. Per spec preload links never instantiate a CSSStyleSheet, so the wait timed out, re-serialized the link, scheduled another wait, and leaked a load listener on every cycle — multiplying further on every real load event. Pages with Next.js-style CSS preloads accumulated thousands of active polling chains, saturating the main thread and freezing the tab on refocus
    (2026-05-26)
  • Updated dependencies []:

v1.376.1

Compare Source

1.376.1
Patch Changes

v1.376.0

Compare Source

1.376.0

Minor Changes
  • #​3655 6e8d349 Thanks @​arnaudhillen! - Expose the in-repo @posthog/rrweb, @posthog/rrweb-types, and @posthog/rrweb-plugin-console-record packages as subpath entry points on posthog-js. Consumers can now import { Replayer } from 'posthog-js/rrweb', import type { eventWithTime } from 'posthog-js/rrweb-types', and import { LogLevel } from 'posthog-js/rrweb-plugin-console-record' instead of installing the underlying rrweb packages directly. The rrweb worker sourcemap (image-bitmap-data-url-worker-*.js.map) is also shipped from posthog-js/dist/ so downstream bundlers no longer need to reach into node_modules/@&#8203;posthog/rrweb.
    (2026-05-22)
Patch Changes

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • "before 10am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot enabled auto-merge (squash) May 31, 2026 16:49
@renovate renovate Bot force-pushed the renovate/npm-packages branch from ebce907 to f6a3100 Compare May 31, 2026 20:50
@renovate renovate Bot force-pushed the renovate/npm-packages branch from f6a3100 to e93c65e Compare June 1, 2026 11:03
@renovate renovate Bot merged commit 99c64eb into main Jun 1, 2026
10 checks passed
@renovate renovate Bot deleted the renovate/npm-packages branch June 1, 2026 12:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant