Skip to content

build(deps): bump @angular/core from 21.0.8 to 21.2.17 - #2961

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/angular/core-21.2.17
Closed

build(deps): bump @angular/core from 21.0.8 to 21.2.17#2961
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/angular/core-21.2.17

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubJun 15, 2026

Copy link
Copy Markdown
Contributor

Bumps @angular/core from 21.0.8 to 21.2.17.

Release notes

Sourced from @​angular/core's releases.

21.2.17

common

CommitDescription
fix - 86a56dc279Limits date format string length
fix - d846326b07skip transfer cache for uncacheable HTTP traffic
fix - bc55749698use cryptographically secure SHA-256 for transfer cache key generation

compiler

CommitDescription
fix - dc9c99636dsanitize two-way properties

core

CommitDescription
fix - 1523061137harden TransferState restoration against DOM clobbering
fix - 88832c84f8validate lowercase SVG animation attribute names (#69269)

http

CommitDescription
fix - bcb1b7ea25preserve empty referrer option in HttpRequest
fix - a810a319d1Rejects non-HTTP(S) URLs in JSONP requests
fix - e245d40c4dskip transfer cache for fetch credentialed requests

platform-server

CommitDescription
fix - 35510746b7harden platform location origin validation during SSR
refactor - 13fb0afe93deprecate ServerXhr (#69255)

service-worker

CommitDescription
fix - b9d29381bbStrips sensitive headers on cross-origin redirects

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

21.2.16

common

CommitDescription
fix - f6d8e642b0only strip a literal /index.html suffix from URLs

compiler

CommitDescription
fix - ae1c8a1f7amove projection attributes into constants

core

CommitDescription
fix - 3fd6897a67harden inherit definition feature against polluted prototypes
fix - 7e38336dc7use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

21.2.17 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

CommitTypeDescription
86a56dc279fixLimits date format string length
d846326b07fixskip transfer cache for uncacheable HTTP traffic
bc55749698fixuse cryptographically secure SHA-256 for transfer cache key generation

compiler

CommitTypeDescription
dc9c99636dfixsanitize two-way properties

core

CommitTypeDescription
1523061137fixharden TransferState restoration against DOM clobbering
88832c84f8fixvalidate lowercase SVG animation attribute names (#69269)

http

CommitTypeDescription
bcb1b7ea25fixpreserve empty referrer option in HttpRequest
a810a319d1fixRejects non-HTTP(S) URLs in JSONP requests
e245d40c4dfixskip transfer cache for fetch credentialed requests

platform-server

CommitTypeDescription
35510746b7fixharden platform location origin validation during SSR
13fb0afe93refactordeprecate ServerXhr (#69255)

service-worker

CommitTypeDescription
b9d29381bbfixStrips sensitive headers on cross-origin redirects

20.3.25 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

CommitTypeDescription
9f443bc24cfixLimits date format string length
566ad05f20fixskip transfer cache for uncacheable HTTP traffic
1a62130a6bfixuse cryptographically secure SHA-256 for transfer cache key generation

compiler

| Commit | Type | Description |

... (truncated)

Commits
  • 88832c8 fix(core): validate lowercase SVG animation attribute names (#69269)
  • 3551074 fix(platform-server): harden platform location origin validation during SSR
  • bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
  • d846326 fix(common): skip transfer cache for uncacheable HTTP traffic
  • e245d40 fix(http): skip transfer cache for fetch credentialed requests
  • 1523061 fix(core): harden TransferState restoration against DOM clobbering
  • 736c4ab refactor(core): fix broken unit test.
  • 3fd6897 fix(core): harden inherit definition feature against polluted prototypes
  • 7e38336 fix(core): use Object.create(null) for LOCALE_DATA as a hardening measure
  • 29ceeff docs: fix typos in source code comments
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 21.0.8 to 21.2.17.
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.17/packages/core)
---
updated-dependencies:
- dependency-name: "@angular/core"
dependency-version: 21.2.17
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added the dependencies Pull requests that update a dependency file label Jun 15, 2026
@dependabot@github

dependabotBot commented on behalf of githubAug 3, 2026

Copy link
Copy Markdown
ContributorAuthor

Superseded by #2979.

@dependabotdependabotBot closed this Aug 3, 2026
@dependabot
dependabotBot deleted the dependabot/npm_and_yarn/angular/core-21.2.17 branch August 3, 2026 16:31
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants