Bump the angular group across 1 directory with 8 updates by dependabot[bot] · Pull Request #1384 · morganstanley/ComposeUI

dependabot · 2026-06-29T18:53:54Z

Bumps the angular group with 8 updates in the / directory:

Package	From	To
@angular/compiler	`20.3.16`	`20.3.25`
@angular/core	`20.3.16`	`20.3.25`
@angular/forms	`20.3.16`	`20.3.25`
@angular/platform-browser	`20.3.16`	`20.3.25`
@angular/router	`20.3.16`	`20.3.25`
@angular/build	`20.3.16`	`20.3.30`
@angular/cli	`20.3.16`	`20.3.30`
@angular/compiler-cli	`20.3.16`	`20.3.25`

Updates @angular/compiler from 20.3.16 to 20.3.25

Release notes

Sourced from @angular/compiler's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

20.3.23

compiler

Commit Description

prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

a68ec70 fix(compiler): sanitize two-way properties
d40acc6 fix(compiler): prevent namespaced SVG <style> elements from being stripped
7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
823b37f test(compiler): remove obsolete schema_extractor import (#68926)
e345a58 fix(core): normalize tag names in runtime i18n attribute security context loo...
8f35b18 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
64a89e9 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
6404edf fix(compiler): strip namespaced SVG script elements during template compilati...
dc631ef fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
Additional commits viewable in compare view

Updates @angular/core from 20.3.16 to 20.3.25

Release notes

Sourced from @angular/core's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

20.3.23

compiler

Commit Description

prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @angular/core's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)
1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
49368c1 fix(platform-server): harden platform location origin validation during SSR
566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
768a349 fix(core): harden TransferState restoration against DOM clobbering
7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
6595409 test(core): update golden symbols and host bindings sanitization spec (#68926)
d86e4e7 fix(core): reject script element as a dynamic component host (#68926)
b8f1f72 test(core): remove obsolete blockquote cite host binding tests (#68926)
36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
Additional commits viewable in compare view

Updates @angular/forms from 20.3.16 to 20.3.25

Release notes

Sourced from @angular/forms's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

20.3.23

compiler

Commit Description

prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @angular/forms's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

See full diff in compare view

Updates @angular/platform-browser from 20.3.16 to 20.3.25

Release notes

Sourced from @angular/platform-browser's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

20.3.23

compiler

Commit Description

prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @angular/platform-browser's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

af04936 fix(core): sanitize meta selectors
See full diff in compare view

Updates @angular/router from 20.3.16 to 20.3.25

Release notes

Sourced from @angular/router's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

20.3.23

compiler

Commit Description

prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @angular/router's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

See full diff in compare view

Updates @angular/build from 20.3.16 to 20.3.30

Release notes

Sourced from @angular/build's releases.

20.3.30

@angular/build

Commit Description

bump @babel/core to 7.29.7

bump esbuild to 0.28.1

bump piscina to 5.2.0

bump vite to 7.3.5

20.3.29

@angular/cli

Commit Description

update pacote to 21.5.1

@angular/ssr

Commit Description

prioritize options over environment variables in AngularNodeAppEngine

20.3.28

@angular/cli

Commit Description

fallback to deprecated versions when resolving ranges if no non-deprecated version is found

remove forceAuth and unscoped credential parsing

20.3.27

@angular/ssr

Commit Description

add support for configuring trusted proxy headers via environment variable

20.3.26

@angular/ssr

Commit Description

allow all hosts in common engine rendering options to prevent validation errors

20.3.25

@angular-devkit/build-angular

Commit Description

upgrade postcss to 8.5.12

@angular/ssr

Commit Description

introduce trustProxyHeaders option to safely validate and sanitize proxy headers

20.3.24

@angular/build

... (truncated)

Changelog

Sourced from @angular/build's changelog.

20.3.30 (2026-06-24)

@angular/build

Commit Type Description

36adca99c fix bump @babel/core to 7.29.7

7f236cfea fix bump esbuild to 0.28.1

94fb3c122 fix bump piscina to 5.2.0

1f283a41c fix bump vite to 7.3.5

22.0.3 (2026-06-18)

@schematics/angular

Commit Type Description

0eddea898 fix remove default workspace vscode mcp.json configuration

21.2.16 (2026-06-17)

@angular/cli

Commit Type Description

77c9047ac fix update pacote to 21.5.1

@angular/ssr

Commit Type Description

d052e97da fix prioritize options over environment variables in AngularNodeAppEngine

20.3.29 (2026-06-17)

@angular/cli

| Commit | Type | Description |

... (truncated)

Commits

41d34b5 release: cut the v20.3.30 release

Bumps the angular group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `20.3.16` | `20.3.25` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `20.3.16` | `20.3.25` | | [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `20.3.16` | `20.3.25` | | [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `20.3.16` | `20.3.25` | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `20.3.16` | `20.3.25` | | [@angular/build](https://github.com/angular/angular-cli) | `20.3.16` | `20.3.30` | | [@angular/cli](https://github.com/angular/angular-cli) | `20.3.16` | `20.3.30` | | [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `20.3.16` | `20.3.25` | Updates `@angular/compiler` from 20.3.16 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 20.3.16 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/core) Updates `@angular/forms` from 20.3.16 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/forms) Updates `@angular/platform-browser` from 20.3.16 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/platform-browser) Updates `@angular/router` from 20.3.16 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/router) Updates `@angular/build` from 20.3.16 to 20.3.30 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.16...v20.3.30) Updates `@angular/cli` from 20.3.16 to 20.3.30 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.16...v20.3.30) Updates `@angular/compiler-cli` from 20.3.16 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler-cli) --- updated-dependencies: - dependency-name: "@angular/build" dependency-version: 20.3.30 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/cli" dependency-version: 20.3.30 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/compiler-cli" dependency-version: 20.3.25 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/forms" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/platform-browser" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/router" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-30T13:34:31Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 29, 2026

dependabot Bot requested a review from a team as a code owner June 29, 2026 18:53

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 29, 2026

dependabot Bot changed the title ~~Bump the angular group with 8 updates~~ Bump the angular group across 1 directory with 8 updates Jun 29, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/angular-592e47b6d5 branch from 01f8d66 to 7f940dd Compare June 29, 2026 22:15

psmulovics closed this Jun 30, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/angular-592e47b6d5 branch June 30, 2026 13:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the angular group across 1 directory with 8 updates#1384

Bump the angular group across 1 directory with 8 updates#1384
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/angular-592e47b6d5

dependabot Bot commented on behalf of github Jun 29, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69270)

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69256)

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
768a349e6e	fix	harden TransferState restoration against DOM clobbering
ca48b4728d	fix	validate lowercase SVG animation attribute names (#69270)

Commit	Type	Description
06be298267	fix	preserve empty referrer option in HttpRequest
fa940e1f4d	fix	Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a	fix	skip transfer cache for fetch credentialed requests

Commit	Type	Description
49368c1859	fix	harden platform location origin validation during SSR
d55c94ad81	refactor	deprecate ServerXhr (#69256)

Commit	Description
	bump `@babel/core` to 7.29.7
	bump esbuild to 0.28.1
	bump piscina to 5.2.0
	bump vite to 7.3.5

Commit	Description
	fallback to deprecated versions when resolving ranges if no non-deprecated version is found
	remove forceAuth and unscoped credential parsing

Commit	Type	Description
36adca99c	fix	bump `@babel/core` to 7.29.7
7f236cfea	fix	bump esbuild to 0.28.1
94fb3c122	fix	bump piscina to 5.2.0
1f283a41c	fix	bump vite to 7.3.5

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.24

platform-server

20.3.23

compiler

20.3.22

common

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

22.0.0 (2026-06-03)

Breaking Changes

compiler

compiler-cli

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.24

platform-server

20.3.23

compiler

20.3.22

common

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

22.0.0 (2026-06-03)

Breaking Changes

compiler

compiler-cli

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.24

platform-server

20.3.23

compiler

20.3.22

common

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

dependabot Bot commented on behalf of github Jun 29, 2026 •

edited

Loading