Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the npm_and_yarn group across 2 directories with 19 updates

Closed
Number: #31
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 1
Created: November 25, 2025 at 05:11 PM UTC
(5 days ago)
Updated: November 25, 2025 at 08:50 PM UTC
(5 days ago)
Closed: November 25, 2025 at 08:50 PM UTC
(5 days ago)
Time to Close: about 4 hours
Labels:
dependencies javascript
Description:

Bumps the npm_and_yarn group with 3 updates in the /bin/Debug/net8.0/my-app directory: @angular/platform-server, cookie and ws.
Bumps the npm_and_yarn group with 3 updates in the /wwwroot directory: @angular/platform-server, cookie and ws.

Updates @angular/platform-server from 17.1.3 to 21.0.0

Release notes

Sourced from @​angular/platform-server's releases.

VSCode Extension: 21.0.0

  • fix(language-service): address potential memory leak during project creation (89095946cf)
  • fix(language-server): fix directory renaming on Windows (3f7111a9c3)

21.0.0

common

Commit Description
feat - c795960ada Add experimental support for the Navigation API (#63406)
feat - 9eac43cf46 Support of optional keys for the KeyValue pipe (#48814)
feat - a1868c9d13 update to cldr 47 (#64032)
fix - 196fa500a3 properly type ngComponentOutlet (#64561)
refactor - 7a4b225c57 improve typing of ngComponentOutletContent (#63674)
refactor - 25f593ce2a removengModuleFactory input of NgComponentOutlet (#62838)

compiler

Commit Description
fix - ecea909bcc don't choke on unbalanced parens in declaration block
fix - 04dd75ba94 support arbitrary nesting in :host-context()
fix - f54cc4f28a support commas in :host() argument
fix - 814b2713f5 support complex selectors in :nth-child()
fix - aad6ced0ef support one additional level of nesting in :host()

compiler-cli

Commit Description
feat - 563dbd998c Adds diagnostic for misconfigured @defer triggers (#64069)
feat - 0571b335b9 enable type checking of host bindings by default (#63654)
fix - 5b55200edf allow value to be set on radio fields
fix - ab98b2425f capture metadata for undecorated fields (#63957)
fix - be7110342b disallow compiling with the emitDeclarationOnly TS compiler option enabled (#61609)
fix - bd322ca410 do not flag custom control required inputs as missing when field is present
fix - 471da8a311 infer type of custom field controls
fix - 96cb0cffda infer types of signal forms set on native inputs
fix - 71ab11ccf0 make field detection logic more robust
fix - 1f389b8b97 missingStructuralDirective diagnostic produces false negatives (#64579)
fix - 7fd3db0423 remove internal syntax-related flags (#63787)
fix - c371251e4c report invalid bindings on form controls
fix - 01290ab275 use any when checking field interface conformance

core

Commit Description
feat - 809a4ed8c1 Add migration for zoneless by default. (#63042)
feat - 2a7a5de53f Allow passing application providers in bootstrapModule options (#64354)
feat - 28926ba92c introduce BootstrapContext for improved server bootstrapping (#63562)
feat - c2d376b85a make SimpleChanges generic (#64535)
feat - ad2376435b support IntersectionObserver options in viewport triggers (#64130)
feat - 539717f58a support regular expressions in templates (#63887)
fix - ab415f3d7f control not recognized when input has directive injecting ViewContainerRef (#64368)

... (truncated)

Changelog

Sourced from @​angular/platform-server's changelog.

21.0.0 (2025-11-19)

Blog post "Announcing Angular v21".

Breaking Changes

common

  • (test only) - TestBed now provides a fake PlatformLocation implementation that supports the Navigation API. This may break some tests, though we have not observed any failures internally. You can revert to the old default for TestBed by providing the MockPlatformLocation from @angular/common/testing in your providers: {provide: PlatformLocation, useClass: MockPlatformLocation}
  • ngComponentOutletContent is now of type Node[][] | undefined instead of any[][] | undefined.
  • NgModuleFactory has been removed, use NgModule instead.

compiler-cli

    • Previously hidden type issues in host bindings may show up in your builds. Either resolve the type issues or set "typeCheckHostBindings": false in the angularCompilerOptions section of your tsconfig.
  • The Angular compiler now produces an error when the the emitDeclarationOnly TS compiler option is enabled as this mode is not supported.

core

  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

    Before:

    const bootstrap = () => bootstrapApplication(AppComponent, config);

    After:

    const bootstrap = (context: BootstrapContext) =>
  bootstrapApplication(AppComponent, config, context);

    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

  • Using a combination of provideZoneChangeDetection while also removing ZoneJS polyfills will no longer result in the internal scheduler being disabled. All Angular applications now consistenly use the same scheduler, and those with the Zone change detection provider include additional automatic scheduling behaviors based on

... (truncated)

Commits
  • 8ab0847 refactor(core): mark VERSION as @__PURE__ for better tree-shaking
  • 3bed9f0 build: format md files
  • 1b5e2c8 refactor(platform-server): remove redundant providedIn: 'root' from injecti...
  • 062a696 refactor(platform-server): use URL constructor for robust parsing (#64494)
  • dd2f53b refactor(core): warning when hydration trigger is used without hydration b...
  • ad23764 feat(core): support IntersectionObserver options in viewport triggers (#64130)
  • f5b50ec refactor: clean up explicit standalone flags from tests (#63963)
  • f008045 fix(core): do not rename ARIA property bindings to attributes (#63925)
  • 0d028e0 refactor(platform-browser): Remove zonejs compatibility detector (#63847)
  • 8f59295 refactor(core): remove unnecessary deps arrays (#63823)
  • Additional commits viewable in compare view

Updates express from 4.19.2 to 4.21.2

Release notes

Sourced from express's releases.

4.21.2

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.1...4.21.2

4.21.1

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.0...4.21.1

4.21.0

What's Changed

New Contributors

Full Changelog: https://github.com/expressjs/express/compare/4.20.0...4.21.0

4.20.0

What's Changed

Important

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect

Other Changes

... (truncated)

Changelog

Sourced from express's changelog.

4.21.2 / 2024-11-06

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
Commits
Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.


Updates body-parser from 1.20.2 to 1.20.3

Release notes

Sourced from body-parser's releases.

1.20.3

What's Changed

Important

  • deps: qs@6.13.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

New Contributors

Full Changelog: https://github.com/expressjs/body-parser/compare/1.20.2...1.20.3

Changelog

Sourced from body-parser's changelog.

1.20.3 / 2024-09-10

  • deps: qs@6.13.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.


Updates braces from 3.0.2 to 3.0.3

Commits

Updates cookie from 0.4.2 to 0.7.1

Release notes

Sourced from cookie's releases.

0.7.1

Fixed

  • Allow leading dot for domain (#174)
    • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
  • Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)

https://github.com/jshttp/cookie/compare/v0.7.0...v0.7.1

0.7.0

https://github.com/jshttp/cookie/compare/v0.6.0...v0.7.0

0.6.0

  • Add partitioned option

0.5.0

  • Add priority option
  • Fix expires option to reject invalid dates
  • pref: improve default decode speed
  • pref: remove slow string split in parse
Commits
Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.


Updates js-yaml from 3.14.1 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

  • Types are now exported as yaml.types.XXX.
  • Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

  • Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

  • Check migration guide to see details for all breaking changes.
  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
  • Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
  • !!binary now always mapped to Uint8Array on load.
  • Reduced nesting of /lib folder.
  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
  • Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
  • Code snippet created in exceptions now contains multiple lines with line numbers.
  • dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
  • dump() with skipInvalid=true now serializes invalid items in collections as null.
  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

  • Added .mjs (es modules) support.
  • Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
  • Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.
  • Added replacer option (similar to option in JSON.stringify), #339.
  • Custom Tag can now handle all tags or multiple tags with the same prefix, #385.

Fixed

... (truncated)

Commits

Updates esbuild from 0.19.11 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12

  • Fix a minification regression with CSS media queries (#4315)

    The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.

  • Update the list of known JavaScript globals (#4310)

    This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

    From ES2017:

    • Atomics
    • SharedArrayBuffer

    From ES2020:

    • BigInt64Array
    • BigUint64Array

    From ES2021:

    • FinalizationRegistry
    • WeakRef

    From ES2025:

    • Float16Array
    • Iterator

    Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:

    // This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}

  • Add support for the new @view-transition CSS rule (#4313)

    With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):

    /* Original code */
@view-transition {
  navigation: auto;
  types: check;
}

    /* Old output */
    
@​view-transition { navigation: auto; types: check; }
    

    /* New output */
    
@​view-transition {
    
navigation: auto;
    
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

Commits
  • 208f539 publish 0.25.12 to npm
  • 5f03afd update release notes
  • 6b2ee78 minify: remove css rules containing empty :is()
  • f361deb add some additional known static methods
  • 07aa646 automatically mark "RegExp.escape()" calls as pure
  • 9039c46 simplify some call expression checks
  • 188944d add some additional known static methods
  • d3c67f9 fix #4310: add Iterator and other known globals
  • 4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
  • 26b29ed fix #4315: @media deduplication bug edge case
  • Additional commits viewable in compare view

Updates http-proxy-middleware from 2.0.6 to 2.0.9

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.9

What's Changed

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.8...v2.0.9

v2.0.8

What's Changed

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.7...v2.0.8

v2.0.7

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.6...v2.0.7

v2.0.7-beta.1

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.7-beta.0...v2.0.7-beta.1

v2.0.7-beta.0

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.6...v2.0.7-beta.0

Changelog

Sourced from http-proxy-middleware's changelog.

v2.0.9

  • fix(fixRequestBody): check readableLength

v2.0.8

  • fix(fixRequestBody): prevent multiple .write() calls
  • fix(fixRequestBody): handle invalid request

v2.0.7

  • ci(github actions): add publish.yml
  • fix(filter): handle errors
Commits

Updates nanoid from 3.3.7 to 3.3.11

Release notes

Sourced from nanoid's releases.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.
Changelog

Sourced from nanoid's changelog.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.

3.3.8

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).
Commits

Updates on-headers from 1.0.2 to 1.1.0

Release notes

Sourced from on-headers's releases.

1.1.0

Important

What's Changed

New Contributors

Full Changelog: https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0

Changelog

Sourced from on-headers's changelog.

1.1.0 / 2025-07-17

Commits
  • 4b017af 1.1.0
  • b636f2d ♻️ refactor header array code
  • 3e2c2d4 ✨ ignore falsy header keys, matching node behavior
  • 172eb41 ✨ support duplicate headers
  • c6e3849 🔒️ fix array handling
  • 6893518 💚 update CI - add newer node versions
  • 56a345d ✨ add script to update known hashes
  • 175ab21 👷 add upstream change detection (#31)
  • Package Dependencies
    Package:
     http-proxy-middleware
    Ecosystem:
    npm
    Version Change:
    2.0.6 → 2.0.9
    Update Type:
    Patch
    Package:
    nanoid
    Ecosystem:
    npm
    Version Change:
    3.3.7 → 3.3.11
    Update Type:
    Patch
    Package:
    braces
    Ecosystem:
    npm
    Version Change:
    3.0.2 → 3.0.3
    Update Type:
    Patch
    Package:
    express
    Ecosystem:
    npm
    Version Change:
    4.19.2 → 4.21.2
    Update Type:
    Minor
    Package:
    esbuild
    Ecosystem:
    npm
    Version Change:
    0.19.11 → 0.25.12
    Update Type:
    Minor
    Package:
    @angular/platform-server
    Ecosystem:
    npm
    Version Change:
    17.1.3 → 21.0.0
    Update Type:
    Major
    Package:
    cookie
    Ecosystem:
    npm
    Version Change:
    0.4.2 → 0.7.1
    Update Type:
    Minor
    Package:
    body-parser
    Ecosystem:
    npm
    Version Change:
    1.20.2 → 1.20.3
    Update Type:
    Patch
    Package:
    js-yaml
    Ecosystem:
    npm
    Version Change:
    3.14.1 → 4.1.1
    Update Type:
    Major
    Package:
    on-headers
    Ecosystem:
    npm
    Version Change:
    1.0.2 → 1.1.0
    Update Type:
    Minor
Security Advisories
cookie accepts cookie name, path, and domain with out of bounds characters
GHSA-pxg6-pf52-xh8x CVE-2024-47764 LOW
### Impact The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize("userName=<script>alert('XSS3')</script>; Max-Age=25920...
on-headers is vulnerable to http response header manipulation
GHSA-76c9-3jph-rj3q CVE-2025-7339 LOW
### Impact A bug in on-headers versions `< 1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()` ### Patches Users should upgrade t...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 11381569
UUID: 3663902261
Node ID: PR_kwDOLP6sz861dkUA
Host: GitHub
Repository: batuhan-basoglu/NET-Web-API-w-Angular