Skip to content

build(deps): bump @angular/compiler from 21.1.2 to 21.2.17 - #233

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/angular/compiler-21.2.17
Open

build(deps): bump @angular/compiler from 21.1.2 to 21.2.17#233
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/angular/compiler-21.2.17

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubJun 15, 2026

Copy link
Copy Markdown
Contributor

Bumps @angular/compiler from 21.1.2 to 21.2.17.

Release notes

Sourced from @​angular/compiler's releases.

21.2.17

common

CommitDescription
fix - 86a56dc279Limits date format string length
fix - d846326b07skip transfer cache for uncacheable HTTP traffic
fix - bc55749698use cryptographically secure SHA-256 for transfer cache key generation

compiler

CommitDescription
fix - dc9c99636dsanitize two-way properties

core

CommitDescription
fix - 1523061137harden TransferState restoration against DOM clobbering
fix - 88832c84f8validate lowercase SVG animation attribute names (#69269)

http

CommitDescription
fix - bcb1b7ea25preserve empty referrer option in HttpRequest
fix - a810a319d1Rejects non-HTTP(S) URLs in JSONP requests
fix - e245d40c4dskip transfer cache for fetch credentialed requests

platform-server

CommitDescription
fix - 35510746b7harden platform location origin validation during SSR
refactor - 13fb0afe93deprecate ServerXhr (#69255)

service-worker

CommitDescription
fix - b9d29381bbStrips sensitive headers on cross-origin redirects

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

21.2.16

common

CommitDescription
fix - f6d8e642b0only strip a literal /index.html suffix from URLs

compiler

CommitDescription
fix - ae1c8a1f7amove projection attributes into constants

core

CommitDescription
fix - 3fd6897a67harden inherit definition feature against polluted prototypes
fix - 7e38336dc7use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.17 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

CommitTypeDescription
86a56dc279fixLimits date format string length
d846326b07fixskip transfer cache for uncacheable HTTP traffic
bc55749698fixuse cryptographically secure SHA-256 for transfer cache key generation

compiler

CommitTypeDescription
dc9c99636dfixsanitize two-way properties

core

CommitTypeDescription
1523061137fixharden TransferState restoration against DOM clobbering
88832c84f8fixvalidate lowercase SVG animation attribute names (#69269)

http

CommitTypeDescription
bcb1b7ea25fixpreserve empty referrer option in HttpRequest
a810a319d1fixRejects non-HTTP(S) URLs in JSONP requests
e245d40c4dfixskip transfer cache for fetch credentialed requests

platform-server

CommitTypeDescription
35510746b7fixharden platform location origin validation during SSR
13fb0afe93refactordeprecate ServerXhr (#69255)

service-worker

CommitTypeDescription
b9d29381bbfixStrips sensitive headers on cross-origin redirects

20.3.25 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

CommitTypeDescription
9f443bc24cfixLimits date format string length
566ad05f20fixskip transfer cache for uncacheable HTTP traffic
1a62130a6bfixuse cryptographically secure SHA-256 for transfer cache key generation

compiler

| Commit | Type | Description |

... (truncated)

Commits
  • dc9c996 fix(compiler): sanitize two-way properties
  • ae1c8a1 fix(compiler): move projection attributes into constants
  • eb1cbbf fix(compiler): prevent namespaced SVG <style> elements from being stripped
  • 29ceeff docs: fix typos in source code comments
  • 782e015 fix(compiler): strip namespaced SVG script elements during template compilati...
  • ff12fe5 fix(core): normalize tag names in runtime i18n attribute security context loo...
  • 0b07f47 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
  • cc1378d fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
  • daaf329 fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
  • 68282df fix(compiler): strip namespaced SVG script elements during template compilation
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) from 21.1.2 to 21.2.17.
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.17/packages/compiler)
---
updated-dependencies:
- dependency-name: "@angular/compiler"
dependency-version: 21.2.17
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 15, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants