chore(deps): bump the npm_and_yarn group across 10 directories with 6 updates by dependabot[bot] · Pull Request #2936 · GoogleCloudPlatform/generative-ai

dependabot · 2026-06-17T10:11:09Z

Bumps the npm_and_yarn group with 6 updates in the /gemini/sample-apps/genwealth/ui directory:

Package	From	To
@angular/common	`17.3.12`	`22.0.1`
@angular/compiler	`17.3.12`	`20.3.25`
@angular/core	`17.3.12`	`22.0.1`
js-yaml	`4.1.0`	`4.2.0`
form-data	`4.0.0`	`4.0.6`
ws	`8.17.1`	`8.21.0`

Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/conversational-app-multi-playbook/frontend directory: @angular/common, @angular/compiler, @angular/core and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/conversational-app-single-playbook/frontend directory: @angular/common, @angular/compiler, @angular/core and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/document-search-using-agent-builder/frontend directory: @angular/common, @angular/compiler, @angular/core and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/image-background-changer-using-imagen3/frontend directory: @angular/common, @angular/compiler, @angular/core and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/linkedin-profile-image-generation-using-imagen3/frontend directory: @angular/common, @angular/compiler, @angular/core and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/multi-agent-travel-concierge-with-adk/frontend directory: @angular/common, @angular/compiler, @angular/core and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/text-to-image-using-imagen3/frontend directory: @angular/common, @angular/compiler, @angular/core and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/website-search-using-agent-builder/frontend directory: @angular/common, @angular/compiler, @angular/core and js-yaml.
Bumps the npm_and_yarn group with 1 update in the /vision/sample-apps/V-Start directory: ws.

Updates @angular/common from 17.3.12 to 22.0.1

Release notes

Sourced from @angular/common's releases.

22.0.1

common

Commit Description

escape CSS string-terminating characters in escapeCssUrl

Limits date format string length

prevent prototype pollution in formatDateTime

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

disallow i18n event attributes

more robust logic to check if regex can be optimized

sanitize href/xlink:href attributes of any element of the MathML namespace

sanitize two-way properties

compiler-cli

Commit Description

bind switch exhaustive check expressions

core

Commit Description

disable WebMCP during SSR

Handle synchronous errors in PendingTasks.run function

harden TransferState restoration against DOM clobbering

prevent dangling prevConsumer reference from leaking destroyed views (#68681)

require WebMCP tool descriptions

update comment for Default change detection

use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray

validate lowercase SVG animation attribute names

forms

Commit Description

delay mcp reading the form model by a tick

harden FormGroup control lookups against prototype shadowing

remove animationstart listener on component destroy to prevent memory leak

set additionalProperties: false on generated WebMCP form

http

Commit Description

ensure query parameters are inserted before URL fragments

pass down the reportUploadProgress and reportDownloadProgress on post/patch requests

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit Description

prevent external template inlay hints from appearing in TS files

platform-server

| Commit | Description |

... (truncated)

Changelog

Sourced from @angular/common's changelog.

22.0.1 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)

common

Commit Type Description

c4b5fa3c92 fix escape CSS string-terminating characters in escapeCssUrl

dfff57ede9 fix Limits date format string length

3c2892c8df fix prevent prototype pollution in formatDateTime

1d87c49f6e fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

1ee224ca30 fix disallow i18n event attributes

a56f1cdf8f fix more robust logic to check if regex can be optimized

5946c18275 fix sanitize href/xlink:href attributes of any element of the MathML namespace

393b84caf8 fix sanitize two-way properties

compiler-cli

Commit Type Description

3d9ca2f173 fix bind switch exhaustive check expressions

core

Commit Type Description

669146b0e7 fix disable WebMCP during SSR

562a566ead fix Handle synchronous errors in PendingTasks.run function

fa546f382d fix harden TransferState restoration against DOM clobbering

29fdb98684 fix prevent dangling prevConsumer reference from leaking destroyed views (#68681)

cdcea80327 fix require WebMCP tool descriptions

4289c4c840 fix update comment for Default change detection

3dd433b39a fix use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray

045bb736b3 fix validate lowercase SVG animation attribute names

forms

Commit Type Description

11836a670a fix delay mcp reading the form model by a tick

85d2d100e3 fix harden FormGroup control lookups against prototype shadowing

e51ad374ea fix remove animationstart listener on component destroy to prevent memory leak

55b7b5a6b6 fix set additionalProperties: false on generated WebMCP form

http

Commit Type Description

ffb06c0514 fix ensure query parameters are inserted before URL fragments

2dd65d21e6 fix pass down the reportUploadProgress and reportDownloadProgress on post/patch requests

4254eb416c fix preserve empty referrer option in HttpRequest

167bd4c162 fix Rejects non-HTTP(S) URLs in JSONP requests

language-service

| Commit | Type | Description |

... (truncated)

Commits

2dd65d2 fix(http): pass down the reportUploadProgress and reportDownloadProgress ...
1bd5a56 docs: deprecate XHR support for server-side rendering in HTTP docs and recomm...
3c2892c fix(common): prevent prototype pollution in formatDateTime
c4b5fa3 fix(common): escape CSS string-terminating characters in escapeCssUrl
4254eb4 fix(http): preserve empty referrer option in HttpRequest
167bd4c fix(http): Rejects non-HTTP(S) URLs in JSONP requests
dfff57e fix(common): Limits date format string length
1d87c49 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
ffb06c0 fix(http): ensure query parameters are inserted before URL fragments
4795b35 fix(common): only strip a literal /index.html suffix from URLs
Additional commits viewable in compare view

Updates @angular/compiler from 17.3.12 to 20.3.25

Release notes

Sourced from @angular/compiler's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

20.3.23

compiler

Commit Description

prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

a68ec70 fix(compiler): sanitize two-way properties
d40acc6 fix(compiler): prevent namespaced SVG <style> elements from being stripped
7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
823b37f test(compiler): remove obsolete schema_extractor import (#68926)
e345a58 fix(core): normalize tag names in runtime i18n attribute security context loo...
8f35b18 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
64a89e9 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
6404edf fix(compiler): strip namespaced SVG script elements during template compilati...
dc631ef fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
Additional commits viewable in compare view

Updates @angular/core from 17.3.12 to 22.0.1

Release notes

Sourced from @angular/core's releases.

22.0.1

common

Commit Description

escape CSS string-terminating characters in escapeCssUrl

Limits date format string length

prevent prototype pollution in formatDateTime

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

disallow i18n event attributes

more robust logic to check if regex can be optimized

sanitize href/xlink:href attributes of any element of the MathML namespace

sanitize two-way properties

compiler-cli

Commit Description

bind switch exhaustive check expressions

core

Commit Description

disable WebMCP during SSR

Handle synchronous errors in PendingTasks.run function

harden TransferState restoration against DOM clobbering

prevent dangling prevConsumer reference from leaking destroyed views (#68681)

require WebMCP tool descriptions

update comment for Default change detection

use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray

validate lowercase SVG animation attribute names

forms

Commit Description

delay mcp reading the form model by a tick

harden FormGroup control lookups against prototype shadowing

remove animationstart listener on component destroy to prevent memory leak

set additionalProperties: false on generated WebMCP form

http

Commit Description

ensure query parameters are inserted before URL fragments

pass down the reportUploadProgress and reportDownloadProgress on post/patch requests

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit Description

prevent external template inlay hints from appearing in TS files

platform-server

| Commit | Description |

... (truncated)

Changelog

Sourced from @angular/core's changelog.

22.0.1 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)

common

Commit Type Description

c4b5fa3c92 fix escape CSS string-terminating characters in escapeCssUrl

dfff57ede9 fix Limits date format string length

3c2892c8df fix prevent prototype pollution in formatDateTime

1d87c49f6e fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

1ee224ca30 fix disallow i18n event attributes

a56f1cdf8f fix more robust logic to check if regex can be optimized

5946c18275 fix sanitize href/xlink:href attributes of any element of the MathML namespace

393b84caf8 fix sanitize two-way properties

compiler-cli

Commit Type Description

3d9ca2f173 fix bind switch exhaustive check expressions

core

Commit Type Description

669146b0e7 fix disable WebMCP during SSR

562a566ead fix Handle synchronous errors in PendingTasks.run function

fa546f382d fix harden TransferState restoration against DOM clobbering

29fdb98684 fix prevent dangling prevConsumer reference from leaking destroyed views (#68681)

cdcea80327 fix require WebMCP tool descriptions

4289c4c840 fix update comment for Default change detection

3dd433b39a fix use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray

045bb736b3 fix validate lowercase SVG animation attribute names

forms

Commit Type Description

11836a670a fix delay mcp reading the form model by a tick

85d2d100e3 fix harden FormGroup control lookups against prototype shadowing

e51ad374ea fix remove animationstart listener on component destroy to prevent memory leak

55b7b5a6b6 fix set additionalProperties: false on generated WebMCP form

http

Commit Type Description

ffb06c0514 fix ensure query parameters are inserted before URL fragments

2dd65d21e6 fix pass down the reportUploadProgress and reportDownloadProgress on post/patch requests

4254eb416c fix preserve empty referrer option in HttpRequest

167bd4c162 fix Rejects non-HTTP(S) URLs in JSONP requests

language-service

| Commit | Type | Description |

... (truncated)

Commits

4b0c3b8 refactor(core): Update registerNgModuleType to support codegen typechecking
dbf64c8 test(core): fix AI tools test flake
045bb73 fix(core): validate lowercase SVG animation attribute names
1ee224c fix(compiler): disallow i18n event attributes
5946c18 fix(compiler): sanitize href/xlink:href attributes of any element of the ...
b1f02eb refactor(core): add internal utility
85d2d10 fix(forms): harden FormGroup control lookups against prototype shadowing
6e3d51d refactor(migrations): Improve safeNavigationMigration heuristic
01ea640 refactor(core): Fix DirectiveDefinition interface to allow abstract classes
a704b08 docs: add Signal Forms and v22 guidance to AI best-practices and llms.txt
Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

See full diff in compare view

Updates form-data from 4.0.0 to 4.0.6

Release notes

Sourced from form-data's releases.

v4.0.4

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] use a shared config 426ba9a

[eslint] fix some spacing issues 2094191

[Refactor] use hasown 81ab41b

[Fix] validate boundary type in setBoundary() method 8d8e469

[Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1

[Dev Deps] remove unused deps 870e4e6

[meta] remove local commit hooks e6e83cc

[Dev Deps] update eslint 4066fd6

[meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2

v4.0.2 - 2025-02-14

Merged

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

Fixed

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available [#396](https://github.com/form-data/form-data/issues/396)

Commits

... (truncated)

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

v4.0.5 - 2025-11-17

Commits

[Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076

[Dev Deps] update @ljharb/eslint-config, eslint 5822467

[Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] use a shared config 426ba9a

[eslint] fix some spacing issues 2094191

[Refactor] use hasown 81ab41b

[Fix] validate boundary type in setBoundary() method 8d8e469

[Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1

[Dev Deps] remove unused deps 870e4e6

[meta] remove local commit hooks e6e83cc

[Dev Deps] update eslint 4066fd6

[meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2 - 2025-02-14

Merged

... (truncated)

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
68ff7dd v4.0.5
5822467 [Dev Deps] update @l... Description has been truncated

… updates Bumps the npm_and_yarn group with 6 updates in the /gemini/sample-apps/genwealth/ui directory: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `17.3.12` | `22.0.1` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `17.3.12` | `20.3.25` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `17.3.12` | `22.0.1` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.2.0` | | [form-data](https://github.com/form-data/form-data) | `4.0.0` | `4.0.6` | | [ws](https://github.com/websockets/ws) | `8.17.1` | `8.21.0` | Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/conversational-app-multi-playbook/frontend directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler), [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/conversational-app-single-playbook/frontend directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler), [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/document-search-using-agent-builder/frontend directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler), [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/image-background-changer-using-imagen3/frontend directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler), [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/linkedin-profile-image-generation-using-imagen3/frontend directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler), [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/multi-agent-travel-concierge-with-adk/frontend directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler), [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/text-to-image-using-imagen3/frontend directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler), [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 4 updates in the /gemini/sample-apps/quickbot/website-search-using-agent-builder/frontend directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler), [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 1 update in the /vision/sample-apps/V-Start directory: [ws](https://github.com/websockets/ws). Updates `@angular/common` from 17.3.12 to 22.0.1 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/common) Updates `@angular/compiler` from 17.3.12 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 17.3.12 to 22.0.1 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/core) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `form-data` from 4.0.0 to 4.0.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `ws` from 8.17.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) Updates `@angular/common` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/common) Updates `@angular/compiler` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/core) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `form-data` from 2.3.3 to 2.5.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `ws` from 7.4.6 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) Updates `@angular/common` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/common) Updates `@angular/compiler` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/core) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `form-data` from 2.3.3 to 2.5.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `ws` from 7.4.6 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) Updates `@angular/common` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/common) Updates `@angular/compiler` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/core) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `form-data` from 2.3.3 to 2.5.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `ws` from 7.4.6 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) Updates `@angular/common` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/common) Updates `@angular/compiler` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/core) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `form-data` from 2.3.3 to 2.5.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `ws` from 7.4.6 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) Updates `@angular/common` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/common) Updates `@angular/compiler` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/core) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `form-data` from 2.3.3 to 2.5.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `ws` from 7.4.6 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) Updates `@angular/common` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/common) Updates `@angular/compiler` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/core) Updates `js-yaml` from 3.13.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `form-data` from 2.3.3 to 2.5.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `ws` from 7.4.6 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) Updates `@angular/common` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/common) Updates `@angular/compiler` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/core) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `form-data` from 2.3.3 to 2.5.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `ws` from 7.4.6 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) Updates `@angular/common` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/common) Updates `@angular/compiler` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 15.2.10 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/core) Updates `js-yaml` from 4.1.0 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `form-data` from 2.3.3 to 2.5.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `ws` from 7.4.6 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) Updates `ws` from 8.18.3 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.0) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 22.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 22.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from a team as a code owner June 17, 2026 10:11

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 10 directories with 6 updates#2936

chore(deps): bump the npm_and_yarn group across 10 directories with 6 updates#2936
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/gemini/sample-apps/genwealth/ui/npm_and_yarn-b761875dc4

dependabot Bot commented on behalf of github Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize `href`/`xlink:href` attributes of any element of the MathML namespace
	sanitize two-way properties

Commit	Description
	disable WebMCP during SSR
	Handle synchronous errors in PendingTasks.run function
	harden TransferState restoration against DOM clobbering
	prevent dangling prevConsumer reference from leaking destroyed views (#68681)
	require WebMCP tool descriptions
	update comment for Default change detection
	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
	validate lowercase SVG animation attribute names

Commit	Description
	delay mcp reading the form model by a `tick`
	harden FormGroup control lookups against prototype shadowing
	remove animationstart listener on component destroy to prevent memory leak
	set `additionalProperties: false` on generated WebMCP form

Commit	Description
	ensure query parameters are inserted before URL fragments
	pass down the `reportUploadProgress` and `reportDownloadProgress` on post/patch requests
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests

Commit	Type	Description
c4b5fa3c92	fix	escape CSS string-terminating characters in escapeCssUrl
dfff57ede9	fix	Limits date format string length
3c2892c8df	fix	prevent prototype pollution in formatDateTime
1d87c49f6e	fix	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
1ee224ca30	fix	disallow i18n event attributes
a56f1cdf8f	fix	more robust logic to check if regex can be optimized
5946c18275	fix	sanitize `href`/`xlink:href` attributes of any element of the MathML namespace
393b84caf8	fix	sanitize two-way properties

Commit	Type	Description
669146b0e7	fix	disable WebMCP during SSR
562a566ead	fix	Handle synchronous errors in PendingTasks.run function
fa546f382d	fix	harden TransferState restoration against DOM clobbering
29fdb98684	fix	prevent dangling prevConsumer reference from leaking destroyed views (#68681)
cdcea80327	fix	require WebMCP tool descriptions
4289c4c840	fix	update comment for Default change detection
3dd433b39a	fix	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
045bb736b3	fix	validate lowercase SVG animation attribute names

Commit	Type	Description
11836a670a	fix	delay mcp reading the form model by a `tick`
85d2d100e3	fix	harden FormGroup control lookups against prototype shadowing
e51ad374ea	fix	remove animationstart listener on component destroy to prevent memory leak
55b7b5a6b6	fix	set `additionalProperties: false` on generated WebMCP form

Commit	Type	Description
ffb06c0514	fix	ensure query parameters are inserted before URL fragments
2dd65d21e6	fix	pass down the `reportUploadProgress` and `reportDownloadProgress` on post/patch requests
4254eb416c	fix	preserve empty referrer option in HttpRequest
167bd4c162	fix	Rejects non-HTTP(S) URLs in JSONP requests

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69256)

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
768a349e6e	fix	harden TransferState restoration against DOM clobbering
ca48b4728d	fix	validate lowercase SVG animation attribute names (#69270)

Commit	Type	Description
06be298267	fix	preserve empty referrer option in HttpRequest
fa940e1f4d	fix	Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a	fix	skip transfer cache for fetch credentialed requests

Commit	Type	Description
49368c1859	fix	harden platform location origin validation during SSR
d55c94ad81	refactor	deprecate ServerXhr (#69256)

Conversation

dependabot Bot commented on behalf of github Jun 17, 2026

22.0.1

common

compiler

compiler-cli

core

forms

http

language-service

platform-server

22.0.1 (2026-06-10)

Deprecations

platform-server

common

compiler

compiler-cli

core

forms

http

language-service

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.24

platform-server

20.3.23

compiler

20.3.22

common

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

22.0.0 (2026-06-03)

Breaking Changes

compiler

compiler-cli

22.0.1

common

compiler

compiler-cli

core

forms

http

language-service

platform-server

22.0.1 (2026-06-10)

Deprecations

platform-server

common

compiler

compiler-cli

core

forms

http

language-service

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

[4.1.1] - 2025-11-12

Security

v4.0.4

v4.0.4 - 2025-07-16

Commits