Skip to content

chore(deps): bump the npm-security-updates group across 1 directory with 2 updates - #68

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-security-updates-9d22c740c0
Open

chore(deps): bump the npm-security-updates group across 1 directory with 2 updates#68
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-security-updates-9d22c740c0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-security-updates group with 2 updates in the / directory: @angular/common and @angular/core.

Updates @angular/common from 22.0.2 to 22.1.1

Release notes

Sourced from @​angular/common's releases.

22.1.1

core

Commit Description
fix - aa6d3189c1 initialize hydration triggers after late runtime activation
fix - deecb301c8 warn when style property bindings receive invalid values

http

Commit Description
fix - ac3728e79f avoid aborting completed requests in FetchBackend
fix - 688a0a7118 respect content-type charset in fetch backend text decoder
fix - a13b968451 run root interceptors in the terminal request chain
fix - 32af9b525e strip RFC 6265 DQUOTE characters and handle URIError in parseCookieValue

22.1.0

common

Commit Description
fix - 1ad6824d0d skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit Description
feat - af5e4e1131 Add an error for --global-foo cases (#68846)
feat - d579ecaf73 Disable '--global-' error outside of g3 (#68846)
feat - f98547675c Namespace CSS variables to the app (#68846)
feat - 8c8b2f7783 Support css var namespacing in properties (#68846)
fix - 292199aa4d permissive whitespace parsing in default never blocks
fix - 25c744c4d0 support foreign components defined outside top-level scope
fix - 5bd00add07 support foreign components inside control flow blocks (#69674)
perf - 2e442f7876 do not emit tag name when control flow root is foreign component (#69674)

compiler-cli

Commit Description
fix - aeb55c8bc1 allow passing uninvoked signals as foreign component props
fix - 7c60a98b3c support import aliases in foreignImports (#68674)

core

Commit Description
feat - 124ba10ead add custom set option to linkedSignal
feat - eab4847a8b Adds deep linking from Performance panel to DevTools
fix - 091456a214 account for namespaces in host binding sanitization (#69558)
fix - b3748e9fe4 correct container anchor collection order to match DOM layout
fix - 11b206b919 introduce disposal mechanism for Angular views in foreign @content
fix - 56607967db introduce logical-only containers for foreign content
fix - 23cf1a828b sanitize host bindings on concrete hosts (#69558)
fix - 0c07356c5c set current tnode in foreign component instruction on reuse

forms

Commit Description
fix - bbbd357bd2 add utility to assert that value is a field tree

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

22.1.1 (2026-08-06)

core

Commit Type Description
aa6d3189c1 fix initialize hydration triggers after late runtime activation
deecb301c8 fix warn when style property bindings receive invalid values

http

Commit Type Description
ac3728e79f fix avoid aborting completed requests in FetchBackend
688a0a7118 fix respect content-type charset in fetch backend text decoder
a13b968451 fix run root interceptors in the terminal request chain
32af9b525e fix strip RFC 6265 DQUOTE characters and handle URIError in parseCookieValue

22.1.0 (2026-07-29)

Deprecations

http

  • HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit Type Description
1ad6824d0d fix skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit Type Description
af5e4e1131 feat Add an error for --global-foo cases (#68846)
d579ecaf73 feat Disable '--global-' error outside of g3 (#68846)
f98547675c feat Namespace CSS variables to the app (#68846)
8c8b2f7783 feat Support css var namespacing in properties (#68846)
292199aa4d fix permissive whitespace parsing in default never blocks
25c744c4d0 fix support foreign components defined outside top-level scope
5bd00add07 fix support foreign components inside control flow blocks (#69674)
2e442f7876 perf do not emit tag name when control flow root is foreign component (#69674)

compiler-cli

Commit Type Description
aeb55c8bc1 fix allow passing uninvoked signals as foreign component props
7c60a98b3c fix support import aliases in foreignImports (#68674)

core

Commit Type Description
124ba10ead feat add custom set option to linkedSignal
eab4847a8b feat Adds deep linking from Performance panel to DevTools
091456a214 fix account for namespaces in host binding sanitization (#69558)
b3748e9fe4 fix correct container anchor collection order to match DOM layout
11b206b919 fix introduce disposal mechanism for Angular views in foreign @content
56607967db fix introduce logical-only containers for foreign content

... (truncated)

Commits
  • ac3728e fix(http): avoid aborting completed requests in FetchBackend
  • f99e916 refactor(common): modernize directive tests to rely on whenStable
  • 32af9b5 fix(http): strip RFC 6265 DQUOTE characters and handle URIError in parseCooki...
  • 688a0a7 fix(http): respect content-type charset in fetch backend text decoder
  • 6b643ab refactor(common): modernize directive tests to rely on whenStable
  • a13b968 fix(http): run root interceptors in the terminal request chain
  • eb10e93 refactor(common): modernize pipes & non bindable tests to rely on whenStable
  • 79a37f3 refactor(common): replaces the deprecated positional subscribe arguments wi...
  • 6dcb534 refactor(common): remove duplicate helper function
  • ec16a3d fix(http): enable xsrf for root-provided HttpClient
  • Additional commits viewable in compare view

Updates @angular/core from 22.0.2 to 22.1.6

Release notes

Sourced from @​angular/core's releases.

22.1.6

compiler

Commit Description
fix - cbb8702143 namespace @property declarations

compiler-cli

Commit Description
fix - aea121e532 do not flag callable objects with zero parameters in uninvoked track function check

core

Commit Description
fix - c19b948ef8 apply SkipSelf to only the starting node in embedded views

platform-server

Commit Description
fix - d20a379583 avoid sourcemap corruption during domino path substitution

router

Commit Description
fix - 95c01e9cde keep detached route subtree contexts isolated and intact

22.1.5

compiler-cli

Commit Description
fix - d90698dae7 check uninvoked signal aliases in extended diagnostic

core

Commit Description
fix - 2ceeb27078 cancel stale debounce timers to prevent timer leaks
fix - ed2e401d2d don't fail NgModule checks for a pipe that extends a base class
fix - c65d378bb4 validate SVG animation attributes outside the SVG namespace

forms

Commit Description
fix - 43aaeaec29 avoid writing to name input on ControlValueAccessor

migrations

Commit Description
fix - d85288d75f skip tsconfig files of non-Angular projects

platform-server

Commit Description
fix - 3b8723ce3d resolve HTTP(S) URLs without authority as relative during SSR

router

Commit Description
fix - 4340a63c52 avoid view transitions when the user agent provides one

... (truncated)

Commits
  • b9e903c docs: add CommonModule guidance to AI best practices
  • 6da6d7a refactor(core): use native Promise.withResolvers() in remaining tests
  • e3fb44d test(core): remove redundant change detection configuration
  • ef48630 test(core): replace act with actAsync
  • c19b948 fix(core): apply SkipSelf to only the starting node in embedded views
  • ed2e401 fix(core): don't fail NgModule checks for a pipe that extends a base class
  • c65d378 fix(core): validate SVG animation attributes outside the SVG namespace
  • 4340a63 fix(router): avoid view transitions when the user agent provides one
  • d1ccf02 build: update cross-repo angular dependencies
  • 17b7c1f docs: add NG0991 error page and document rxResource's completion contract
  • Additional commits viewable in compare view

Updates @angular/common from 22.0.2 to 22.1.6

Release notes

Sourced from @​angular/common's releases.

22.1.1

core

Commit Description
fix - aa6d3189c1 initialize hydration triggers after late runtime activation
fix - deecb301c8 warn when style property bindings receive invalid values

http

Commit Description
fix - ac3728e79f avoid aborting completed requests in FetchBackend
fix - 688a0a7118 respect content-type charset in fetch backend text decoder
fix - a13b968451 run root interceptors in the terminal request chain
fix - 32af9b525e strip RFC 6265 DQUOTE characters and handle URIError in parseCookieValue

22.1.0

common

Commit Description
fix - 1ad6824d0d skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit Description
feat - af5e4e1131 Add an error for --global-foo cases (#68846)
feat - d579ecaf73 Disable '--global-' error outside of g3 (#68846)
feat - f98547675c Namespace CSS variables to the app (#68846)
feat - 8c8b2f7783 Support css var namespacing in properties (#68846)
fix - 292199aa4d permissive whitespace parsing in default never blocks
fix - 25c744c4d0 support foreign components defined outside top-level scope
fix - 5bd00add07 support foreign components inside control flow blocks (#69674)
perf - 2e442f7876 do not emit tag name when control flow root is foreign component (#69674)

compiler-cli

Commit Description
fix - aeb55c8bc1 allow passing uninvoked signals as foreign component props
fix - 7c60a98b3c support import aliases in foreignImports (#68674)

core

Commit Description
feat - 124ba10ead add custom set option to linkedSignal
feat - eab4847a8b Adds deep linking from Performance panel to DevTools
fix - 091456a214 account for namespaces in host binding sanitization (#69558)
fix - b3748e9fe4 correct container anchor collection order to match DOM layout
fix - 11b206b919 introduce disposal mechanism for Angular views in foreign @content
fix - 56607967db introduce logical-only containers for foreign content
fix - 23cf1a828b sanitize host bindings on concrete hosts (#69558)
fix - 0c07356c5c set current tnode in foreign component instruction on reuse

forms

Commit Description
fix - bbbd357bd2 add utility to assert that value is a field tree

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

22.1.1 (2026-08-06)

core

Commit Type Description
aa6d3189c1 fix initialize hydration triggers after late runtime activation
deecb301c8 fix warn when style property bindings receive invalid values

http

Commit Type Description
ac3728e79f fix avoid aborting completed requests in FetchBackend
688a0a7118 fix respect content-type charset in fetch backend text decoder
a13b968451 fix run root interceptors in the terminal request chain
32af9b525e fix strip RFC 6265 DQUOTE characters and handle URIError in parseCookieValue

22.1.0 (2026-07-29)

Deprecations

http

  • HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit Type Description
1ad6824d0d fix skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit Type Description
af5e4e1131 feat Add an error for --global-foo cases (#68846)
d579ecaf73 feat Disable '--global-' error outside of g3 (#68846)
f98547675c feat Namespace CSS variables to the app (#68846)
8c8b2f7783 feat Support css var namespacing in properties (#68846)
292199aa4d fix permissive whitespace parsing in default never blocks
25c744c4d0 fix support foreign components defined outside top-level scope
5bd00add07 fix support foreign components inside control flow blocks (#69674)
2e442f7876 perf do not emit tag name when control flow root is foreign component (#69674)

compiler-cli

Commit Type Description
aeb55c8bc1 fix allow passing uninvoked signals as foreign component props
7c60a98b3c fix support import aliases in foreignImports (#68674)

core

Commit Type Description
124ba10ead feat add custom set option to linkedSignal
eab4847a8b feat Adds deep linking from Performance panel to DevTools
091456a214 fix account for namespaces in host binding sanitization (#69558)
b3748e9fe4 fix correct container anchor collection order to match DOM layout
11b206b919 fix introduce disposal mechanism for Angular views in foreign @content
56607967db fix introduce logical-only containers for foreign content

... (truncated)

Commits
  • ac3728e fix(http): avoid aborting completed requests in FetchBackend
  • f99e916 refactor(common): modernize directive tests to rely on whenStable
  • 32af9b5 fix(http): strip RFC 6265 DQUOTE characters and handle URIError in parseCooki...
  • 688a0a7 fix(http): respect content-type charset in fetch backend text decoder
  • 6b643ab refactor(common): modernize directive tests to rely on whenStable
  • a13b968 fix(http): run root interceptors in the terminal request chain
  • eb10e93 refactor(common): modernize pipes & non bindable tests to rely on whenStable
  • 79a37f3 refactor(common): replaces the deprecated positional subscribe arguments wi...
  • 6dcb534 refactor(common): remove duplicate helper function
  • ec16a3d fix(http): enable xsrf for root-provided HttpClient
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…ith 2 updates

Bumps the npm-security-updates group with 2 updates in the / directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) and [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core).


Updates `@angular/common` from 22.0.2 to 22.1.1
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v22.1.1/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v22.1.1/packages/common)

Updates `@angular/core` from 22.0.2 to 22.1.6
- [Release notes](https://github.com/angular/angular/releases)
- [Commits](https://github.com/angular/angular/commits/v22.1.6/packages/core)

Updates `@angular/common` from 22.0.2 to 22.1.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v22.1.1/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v22.1.1/packages/common)

---
updated-dependencies:
- dependency-name: "@angular/common"
  dependency-version: 22.1.1
  dependency-type: direct:development
  dependency-group: npm-security-updates
- dependency-name: "@angular/core"
  dependency-version: 22.1.6
  dependency-type: direct:development
  dependency-group: npm-security-updates
- dependency-name: "@angular/common"
  dependency-version: 22.1.6
  dependency-type: direct:development
  dependency-group: npm-security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update JavaScript / TypeScript code labels Sep 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update JavaScript / TypeScript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants