Skip to content

build(deps): bump @angular/common from 16.0.0 to 20.3.25 - #80

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/angular/common-20.3.25
Open

build(deps): bump @angular/common from 16.0.0 to 20.3.25#80
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/angular/common-20.3.25

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubJul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps @angular/common from 16.0.0 to 20.3.25.

Release notes

Sourced from @​angular/common's releases.

20.3.25

common

CommitDescription
fix - 9f443bc24cLimits date format string length
fix - 566ad05f20skip transfer cache for uncacheable HTTP traffic
fix - 1a62130a6buse cryptographically secure SHA-256 for transfer cache key generation

compiler

CommitDescription
fix - a68ec702a0sanitize two-way properties

core

CommitDescription
fix - 768a349e6eharden TransferState restoration against DOM clobbering
fix - ca48b4728dvalidate lowercase SVG animation attribute names (#69270)

http

CommitDescription
fix - 06be298267preserve empty referrer option in HttpRequest
fix - fa940e1f4dRejects non-HTTP(S) URLs in JSONP requests
fix - e2ef1ce72askip transfer cache for fetch credentialed requests

platform-server

CommitDescription
fix - 49368c1859harden platform location origin validation during SSR
refactor - d55c94ad81deprecate ServerXhr (#69256)

service-worker

CommitDescription
fix - d65a5f457bStrips sensitive headers on cross-origin redirects

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

CommitDescription
fix - 6ca433e56bthrow on suspicious URLs and restrict protocol-relative URLs
fix - 8680b5152fupdate domino to latest version

20.3.23

compiler

CommitDescription
fix - d40acc6431prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

CommitTypeDescription
9f443bc24cfixLimits date format string length
566ad05f20fixskip transfer cache for uncacheable HTTP traffic
1a62130a6bfixuse cryptographically secure SHA-256 for transfer cache key generation

compiler

CommitTypeDescription
a68ec702a0fixsanitize two-way properties

core

CommitTypeDescription
768a349e6efixharden TransferState restoration against DOM clobbering
ca48b4728dfixvalidate lowercase SVG animation attribute names (#69270)

http

CommitTypeDescription
06be298267fixpreserve empty referrer option in HttpRequest
fa940e1f4dfixRejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72afixskip transfer cache for fetch credentialed requests

platform-server

CommitTypeDescription
49368c1859fixharden platform location origin validation during SSR
d55c94ad81refactordeprecate ServerXhr (#69256)

service-worker

CommitTypeDescription
d65a5f457bfixStrips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

  • This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
  • data prefixed attribute no-longer bind inputs nor outputs.
  • The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
  • in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits
  • 06be298 fix(http): preserve empty referrer option in HttpRequest
  • 9f443bc fix(common): Limits date format string length
  • fa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
  • 1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
  • 566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
  • e2ef1ce fix(http): skip transfer cache for fetch credentialed requests
  • 3d135ce fix(common): add upper bounds for digitsInfo
  • 39a4b4c fix(common): sanitize placeholder
  • de7b2a6 fix(http): exclude withCredentials requests from transfer cache
  • 4233188 fix(http): skip TransferCache for cookie-bearing requests by default
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) from 16.0.0 to 20.3.25.
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/common)
---
updated-dependencies:
- dependency-name: "@angular/common"
dependency-version: 20.3.25
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants