Sourced from @​angular/platform-server's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description

... (truncated)

Sourced from @​angular/platform-server's changelog.

21.2.13 (2026-05-13)

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit	Type	Description
f584840e2e	fix	add allowedHosts option to renderModule and renderApplication

22.0.0-next.12 (2026-05-08)

core

Commit	Type	Description
8ebae1de33	fix	allow service with factory on abstract classes
6f525245cd	fix	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Type	Description
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-server

| Commit | Type | Description |

... (truncated)

• 0b7192f fix(platform-server): forward BEFORE_APP_SERIALIZED errors to ErrorHandler
• 629905d fix(platform-server): add allowedHosts option to renderModule and `render...
• 1aeebbe fix(core): respect ngSkipHydration on components with projectable nodes in LC...
• 41e4851 docs: update documentation for platform server URL token options
• be1f80a fix(platform-server): ensure origin has a trailing slash when parsing url
• 7a64aff fix(core): prevent event replay double-invocation when element hydrates befor...
• b24ead5 refactor: Improve hydration mismatch errors for third-party scripts
• e0b5078 fix(platform-server): prevent SSRF bypasses via protocol-relative and backsla...
• f603d47 fix(core): escape forward slashes in transfer state to prevent crawler indexing
• 04f5841 test(platform-server): fix race condition in incremental hydration test
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.