Bumps the npm_and_yarn group with 4 updates in the /demos/async-pipe-as-syntax-angular7 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/date-add-angular11 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/date-helper-angular11 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/emulated-encapsulation-attributes-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 3 updates in the /demos/event-plugin-data-angular5 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 4 updates in the /demos/expando-properties-angular9 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/expando-properties-intersection-observer-angular9 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/file-reader-angular7 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 2 updates in the /demos/file-upload-form-angular7 directory: @angular/common and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/flexy-tabs-angular9 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/hide-scrollbars-until-hover-angular9 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 3 updates in the /demos/lazy-load-intersection-observer-angular5 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 4 updates in the /demos/message-bus-actions-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 3 updates in the /demos/multiple-selectors-single-directive-angular5 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /demos/named-route-outlet-angular4 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /demos/named-route-outlet-self-close-angular4 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 4 updates in the /demos/nav-trigger-angular7 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/ng-model-accessor-file-input-angular7 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 3 updates in the /demos/parent-route-param-angular4 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /demos/prevent-secondary-view-on-refresh-angular5 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 4 updates in the /demos/provided-in-fail-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/recursive-components-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/recursive-templates-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 3 updates in the /demos/routable-view-selectors-angular4 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /demos/route-redirect-sink-angular4 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /demos/route-redirect-sink2-angular4 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /demos/router-jump-to-fragment-angular5 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 4 updates in the /demos/router-lazy-load-chunk-sort-angular7 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/router-lazy-load-modules-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/router-lazy-load-modules-indicator-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/router-lazy-load-modules-preload-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/router-param-inheritance-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/router-playground-lazy-load-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/router-retain-scroll-polyfill-angular7/with-polyfill directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/router-retain-scroll-polyfill-angular7/without-polyfill directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/runtime-abstraction-angular7 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/runtime-abstraction2-angular7 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/shared-style-urls-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/simple-store-set-state-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/simple-store-set-state-callback-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 3 updates in the /demos/style-child-view-angular4 directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 4 updates in the /demos/webpack4-angular6 directory: @angular/common, @angular/compiler, @angular/core and form-data.
Bumps the npm_and_yarn group with 4 updates in the /demos/webpack4-angular6-aot directory: @angular/common, @angular/compiler, @angular/core and form-data.
Updates @angular/common from 7.0.3 to 20.3.25
Release notes
Sourced from @angular/common's releases.
20.3.25
common
| Commit |
Description |
 |
Limits date format string length |
 |
skip transfer cache for uncacheable HTTP traffic |
 |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
 |
sanitize two-way properties |
core
| Commit |
Description |
 |
harden TransferState restoration against DOM clobbering |
 |
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Description |
 |
preserve empty referrer option in HttpRequest |
 |
Rejects non-HTTP(S) URLs in JSONP requests |
 |
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Description |
 |
harden platform location origin validation during SSR |
 |
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Description |
 |
Strips sensitive headers on cross-origin redirects |
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
20.3.24
platform-server
| Commit |
Description |
 |
throw on suspicious URLs and restrict protocol-relative URLs |
 |
update domino to latest version |
20.3.23
compiler
| Commit |
Description |
 |
prevent namespaced SVG elements from being stripped |
20.3.22
common
... (truncated)
Changelog
Sourced from @angular/common's changelog.
20.3.25 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
common
| Commit |
Type |
Description |
| 9f443bc24c |
fix |
Limits date format string length |
| 566ad05f20 |
fix |
skip transfer cache for uncacheable HTTP traffic |
| 1a62130a6b |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| a68ec702a0 |
fix |
sanitize two-way properties |
core
| Commit |
Type |
Description |
| 768a349e6e |
fix |
harden TransferState restoration against DOM clobbering |
| ca48b4728d |
fix |
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Type |
Description |
| 06be298267 |
fix |
preserve empty referrer option in HttpRequest |
| fa940e1f4d |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
| e2ef1ce72a |
fix |
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Type |
Description |
| 49368c1859 |
fix |
harden platform location origin validation during SSR |
| d55c94ad81 |
refactor |
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Type |
Description |
| d65a5f457b |
fix |
Strips sensitive headers on cross-origin redirects |
22.0.0 (2026-06-03)
Blog post "Announcing Angular v22".
Breaking Changes
compiler
- This change will trigger the
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
- data prefixed attribute no-longer bind inputs nor outputs.
- The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
in variables will throw in template expressions.
compiler-cli
... (truncated)
Commits
06be298 fix(http): preserve empty referrer option in HttpRequest9f443bc fix(common): Limits date format string lengthfa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...566ad05 fix(common): skip transfer cache for uncacheable HTTP traffice2ef1ce fix(http): skip transfer cache for fetch credentialed requests3d135ce fix(common): add upper bounds for digitsInfo39a4b4c fix(common): sanitize placeholderde7b2a6 fix(http): exclude withCredentials requests from transfer cache4233188 fix(http): skip TransferCache for cookie-bearing requests by default- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by google-wombot, a new releaser for @angular/common since your current version.
Updates @angular/compiler from 7.0.3 to 22.0.2
Release notes
Sourced from @angular/compiler's releases.
22.0.2
common
| Commit |
Description |
 |
escape anchor fragment in shadow DOM name selector |
 |
skip transfer cache for uncacheable HTTP traffic (#69316) |
compiler
| Commit |
Description |
 |
restrict possible event handler check to property names longer than 2 characters |
core
| Commit |
Description |
 |
avoid caching missing locale data |
 |
escape overlapping comment delimiters in escapeCommentText |
 |
guard against DOM clobbering in declareExperimentalWebMcpTool |
 |
preserve leave animation for sibling instances sharing a TNode |
 |
prevent unsubscribe during emit from throwing off other listeners |
 |
treat iframe credentialless as security-sensitive |
 |
detect existing signal dependency without checking all producer links |
http
| Commit |
Description |
 |
distinguish repeated transfer cache params |
 |
skip transfer cache for fetch credentialed requests (#69316) |
migrations
| Commit |
Description |
 |
migration skip any target are not build or test |
22.0.1
common
| Commit |
Description |
 |
escape CSS string-terminating characters in escapeCssUrl |
 |
Limits date format string length |
 |
prevent prototype pollution in formatDateTime |
 |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
 |
disallow i18n event attributes |
 |
more robust logic to check if regex can be optimized |
 |
sanitize href/xlink:href attributes of any element of the MathML namespace |
 |
sanitize two-way properties |
compiler-cli
| Commit |
Description |
 |
bind switch exhaustive check expressions |
core
... (truncated)
Changelog
Sourced from @angular/compiler's changelog.
22.0.2 (2026-06-17)
common
| Commit |
Type |
Description |
| 94ea403563 |
fix |
escape anchor fragment in shadow DOM name selector |
| 6c1f3e9d49 |
fix |
skip transfer cache for uncacheable HTTP traffic (#69316) |
compiler
| Commit |
Type |
Description |
| 6f1171991a |
fix |
restrict possible event handler check to property names longer than 2 characters |
core
| Commit |
Type |
Description |
| 528a34f766 |
fix |
avoid caching missing locale data |
| e17e8d5422 |
fix |
escape overlapping comment delimiters in escapeCommentText |
| 59dea13f80 |
fix |
guard against DOM clobbering in declareExperimentalWebMcpTool |
| 3a48abc15c |
fix |
preserve leave animation for sibling instances sharing a TNode |
| 93d0a5f95c |
fix |
prevent unsubscribe during emit from throwing off other listeners |
| b32ee7ceb3 |
fix |
treat iframe credentialless as security-sensitive |
| f902d1d35e |
perf |
detect existing signal dependency without checking all producer links |
http
| Commit |
Type |
Description |
| 6867f77ec7 |
fix |
distinguish repeated transfer cache params |
| 7ef1399068 |
fix |
skip transfer cache for fetch credentialed requests (#69316) |
migrations
| Commit |
Type |
Description |
| 15314c1736 |
fix |
migration skip any target are not build or test |
22.1.0-next.0 (2026-06-10)
Deprecations
http
HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.
common
| Commit |
Type |
Description |
| 1ad6824d0d |
fix |
skip transfer cache for uncacheable HTTP traffic (#69017) |
compiler
| Commit |
Type |
Description |
| 25c744c4d0 |
fix |
support foreign components defined outside top-level scope |
compiler-cli
| Commit |
Type |
Description |
| aeb55c8bc1 |
fix |
allow passing uninvoked signals as foreign component props |
| 7c60a98b3c |
fix |
support import aliases in foreignImports (#68674) |
... (truncated)
Commits
74f2b91 refactor(compiler): correct TcbInvalidReferenceOp initializerb32ee7c fix(core): treat iframe credentialless as security-sensitivef309727 refactor(compiler): Collect in-element comments6f11719 fix(compiler): restrict possible event handler check to property names longer...8bb3947 refactor: optimize dom security schema lookups4645850 refactor(compiler): Remove 80 char limit on AbstractEmitterVisitor1ee224c fix(compiler): disallow i18n event attributes5946c18 fix(compiler): sanitize href/xlink:href attributes of any element of the ...393b84c fix(compiler): sanitize two-way properties3d9ca2f fix(compiler-cli): bind switch exhaustive check expressions- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by google-wombot, a new releaser for @angular/compiler since your current version.
Updates @angular/core from 7.0.3 to 20.3.25
Release notes
Sourced from @angular/core's releases.
20.3.25
common
| Commit |
Description |
|
Limits date format string length |
|
skip transfer cache for uncacheable HTTP traffic |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
sanitize two-way properties |
core
| Commit |
Description |
|
harden TransferState restoration against DOM clobbering |
|
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Description |
|
preserve empty referrer option in HttpRequest |
|
Rejects non-HTTP(S) URLs in JSONP requests |
|
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Description |
|
harden platform location origin validation during SSR |
|
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Description |
|
Strips sensitive headers on cross-origin redirects |
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
20.3.24
platform-server
| Commit |
Description |
|
throw on suspicious URLs and restrict protocol-relative URLs |
|
update domino to latest version |
20.3.23
compiler
| Commit |
Description |
|
prevent namespaced SVG elements from being stripped |
20.3.22
common
... (truncated)
Changelog
Sourced from @angular/core's changelog.
20.3.25 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
common
| Commit |
Type |
Description |
| 9f443bc24c |
fix |
Limits date format string length |
| 566ad05f20 |
fix |
skip transfer cache for uncacheable HTTP traffic |
| 1a62130a6b |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| a68ec702a0 |
fix |
sanitize two-way properties |
core
| Commit |
Type |
Description |
| 768a349e6e |
fix |
harden TransferState restoration against DOM clobbering |
| ca48b4728d |
fix |
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Type |
Description |
| 06be298267 |
fix |
preserve empty referrer option in HttpRequest |
| fa940e1f4d |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
| e2ef1ce72a |
fix |
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Type |
Description |
| 49368c1859 |
fix |
harden platform location origin validation during SSR |
| d55c94ad81 |
refactor |
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Type |
Description |
| d65a5f457b |
fix |
Strips sensitive headers on cross-origin redirects |
22.0.0 (2026-06-03)
Blog post "Announcing Angular v22".
Breaking Changes
compiler
- This change will trigger the
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
- data prefixed attribute no-longer bind inputs nor outputs.
- The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
in variables will throw in template expressions.
compiler-cli
... (truncated)
Commits
ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...49368c1 fix(platform-server): harden platform location origin validation during SSR566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic768a349 fix(core): harden TransferState restoration against DOM clobbering7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...6595409 test(core): update golden symbols and host bindings sanitization spec (#68926)d86e4e7 fix(core): reject script element as a dynamic component host (#68926)b8f1f72 test(core): remove obsolete blockquote cite host binding tests (#68926)36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by google-wombot, a new releaser for @angular/core since your current version.
Removes form-data
Updates @angular/common from 11.0.0 to 20.3.25
Release notes
Sourced from @angular/common's releases.
20.3.25
common
| Commit |
Description |
|
Limits date format string length |
|
skip transfer cache for uncacheable HTTP traffic |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
sanitize two-way properties |
core
| Commit |
Description |
|
harden TransferState restoration against DOM clobbering |
|
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Description |
|
preserve empty referrer option in HttpRequest |
|
Rejects non-HTTP(S) URLs in JSONP requests |
|
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Description |
|
harden platform location origin validation during SSR |
|
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Description |
|
Strips sensitive headers on cross-origin redirects |
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
20.3.24
platform-server
| Commit |
Description |
|
throw on suspicious URLs and restrict protocol-relative URLs |
|
update domino to latest version |
20.3.23
compiler
| Commit |
Description |
|
prevent namespaced SVG elements from being stripped |
20.3.22
common
... (truncated)
Changelog
Sourced from @angular/common's changelog.
20.3.25 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
common
| Commit |
Type |
Description |
| 9f443bc24c |
fix |
Limits date format string length |
| 566ad05f20 |
fix |
skip transfer cache for uncacheable HTTP traffic |
| 1a62130a6b |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| a68ec702a0 |
fix |
sanitize two-way properties |
core
| Commit |
Type |
Description |
| 768a349e6e |
fix |
harden TransferState restoration against DOM clobbering |
| ca48b4728d |
fix |
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Type |
Description |
| 06be298267 |
fix |
preserve empty referrer option in HttpRequest |
| fa940e1f4d |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
| e2ef1ce72a |
fix |
skip transfer cache for fetch credentialed requestsDescription has been truncated
Ecosystem:
npm
Version Change:
7.0.3 → 20.3.25
Update Type:
Major
Ecosystem:
npm
Version Change:
7.0.3 → 20.3.25
Update Type:
Major
Ecosystem:
npm
Version Change:
7.0.3 → 22.0.2
Update Type:
Major
| ID: |
16076065 |
| UUID: |
4709681835 |
| Node ID: |
PR_kwDOErJCo87o0hPD |
| Host: |
GitHub |
| Repository: |
stevewithington/JavaScript-Demos |
|
![dependabot[bot]](https://github.com/dependabot.png){kind=small}
dependabot[bot]