Bump the angular group across 1 directory with 11 updates by dependabot[bot] · Pull Request #1408 · morganstanley/ComposeUI

dependabot · 2026-07-15T11:02:24Z

Bumps the angular group with 11 updates in the / directory:

Package	From	To
@angular/animations	`20.3.16`	`20.3.26`
@angular/common	`20.3.25`	`20.3.26`
@angular/compiler	`20.3.16`	`20.3.26`
@angular/core	`20.3.16`	`20.3.26`
@angular/forms	`20.3.16`	`20.3.26`
@angular/platform-browser	`20.3.16`	`20.3.26`
@angular/platform-browser-dynamic	`20.3.16`	`20.3.26`
@angular/router	`20.3.16`	`20.3.26`
@angular/build	`20.3.16`	`20.3.32`
@angular/cli	`20.3.16`	`20.3.32`
@angular/compiler-cli	`20.3.16`	`20.3.26`

Updates @angular/animations from 20.3.16 to 20.3.26

Release notes

Sourced from @angular/animations's releases.

... (truncated)

Changelog

Sourced from @angular/animations's changelog.

... (truncated)

Commits

See full diff in compare view

Updates @angular/common from 20.3.25 to 20.3.26

Release notes

Sourced from @angular/common's releases.

Changelog

Sourced from @angular/common's changelog.

... (truncated)

Commits

b963f61 fix(http): prevent caching of responses with Set-Cookie headers
See full diff in compare view

Updates @angular/compiler from 20.3.16 to 20.3.26

Release notes

Sourced from @angular/compiler's releases.

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

... (truncated)

Commits

a68ec70 fix(compiler): sanitize two-way properties
d40acc6 fix(compiler): prevent namespaced SVG <style> elements from being stripped
7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
823b37f test(compiler): remove obsolete schema_extractor import (#68926)
e345a58 fix(core): normalize tag names in runtime i18n attribute security context loo...
8f35b18 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
64a89e9 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
6404edf fix(compiler): strip namespaced SVG script elements during template compilati...
dc631ef fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
Additional commits viewable in compare view

Updates @angular/core from 20.3.16 to 20.3.26

Release notes

Sourced from @angular/core's releases.

... (truncated)

Changelog

Sourced from @angular/core's changelog.

... (truncated)

Commits

8eb7aea fix(core): reject dynamic script host elements
26831d0 fix(core): avoid caching missing locale data
ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)
1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
49368c1 fix(platform-server): harden platform location origin validation during SSR
566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
768a349 fix(core): harden TransferState restoration against DOM clobbering
7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
6595409 test(core): update golden symbols and host bindings sanitization spec (#68926)
d86e4e7 fix(core): reject script element as a dynamic component host (#68926)
Additional commits viewable in compare view

Updates @angular/forms from 20.3.16 to 20.3.26

Release notes

Sourced from @angular/forms's releases.

... (truncated)

Changelog

Sourced from @angular/forms's changelog.

... (truncated)

Commits

See full diff in compare view

Updates @angular/platform-browser from 20.3.16 to 20.3.26

Release notes

Sourced from @angular/platform-browser's releases.

... (truncated)

Changelog

Sourced from @angular/platform-browser's changelog.

... (truncated)

Commits

af04936 fix(core): sanitize meta selectors
See full diff in compare view

Updates @angular/platform-browser-dynamic from 20.3.16 to 20.3.26

Release notes

Sourced from @angular/platform-browser-dynamic's releases.

Bumps the angular group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@angular/animations](https://github.com/angular/angular/tree/HEAD/packages/animations) | `20.3.16` | `20.3.26` | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `20.3.25` | `20.3.26` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `20.3.16` | `20.3.26` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `20.3.16` | `20.3.26` | | [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `20.3.16` | `20.3.26` | | [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `20.3.16` | `20.3.26` | | [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) | `20.3.16` | `20.3.26` | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `20.3.16` | `20.3.26` | | [@angular/build](https://github.com/angular/angular-cli) | `20.3.16` | `20.3.32` | | [@angular/cli](https://github.com/angular/angular-cli) | `20.3.16` | `20.3.32` | | [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `20.3.16` | `20.3.26` | Updates `@angular/animations` from 20.3.16 to 20.3.26 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.26/packages/animations) Updates `@angular/common` from 20.3.25 to 20.3.26 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.26/packages/common) Updates `@angular/compiler` from 20.3.16 to 20.3.26 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.26/packages/compiler) Updates `@angular/core` from 20.3.16 to 20.3.26 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.26/packages/core) Updates `@angular/forms` from 20.3.16 to 20.3.26 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.26/packages/forms) Updates `@angular/platform-browser` from 20.3.16 to 20.3.26 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.26/packages/platform-browser) Updates `@angular/platform-browser-dynamic` from 20.3.16 to 20.3.26 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.26/packages/platform-browser-dynamic) Updates `@angular/router` from 20.3.16 to 20.3.26 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.26/packages/router) Updates `@angular/build` from 20.3.16 to 20.3.32 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.16...v20.3.32) Updates `@angular/cli` from 20.3.16 to 20.3.32 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.16...v20.3.32) Updates `@angular/compiler-cli` from 20.3.16 to 20.3.26 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.26/packages/compiler-cli) --- updated-dependencies: - dependency-name: "@angular/animations" dependency-version: 20.3.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/common" dependency-version: 20.3.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/compiler" dependency-version: 20.3.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/core" dependency-version: 20.3.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/forms" dependency-version: 20.3.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/platform-browser" dependency-version: 20.3.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/platform-browser-dynamic" dependency-version: 20.3.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/router" dependency-version: 20.3.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/build" dependency-version: 20.3.32 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/cli" dependency-version: 20.3.32 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/compiler-cli" dependency-version: 20.3.26 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 15, 2026

dependabot Bot requested a review from a team as a code owner July 15, 2026 11:02

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the angular group across 1 directory with 11 updates#1408

Bump the angular group across 1 directory with 11 updates#1408
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/angular-8bd07ba336

dependabot Bot commented on behalf of github Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69270)

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69256)

Commit	Type	Description
26831d0cbd	fix	avoid caching missing locale data
8eb7aea08b	fix	reject dynamic script host elements

Commit	Type	Description
1fdf234168	fix	preserve referrer in asset requests
baa093ba68	fix	preserve referrer policy in asset requests

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 15, 2026

20.3.26

compiler-cli

core

http

service-worker

20.3.25

common

compiler

core

http

platform-server

service-worker

20.3.26 (2026-07-08)

compiler-cli

core

http

service-worker

21.2.18 (2026-07-08)

compiler-cli

core

http

service-worker

22.1.0-next.5 (2026-07-08)

compiler

20.3.26

compiler-cli

core

http

service-worker

20.3.26 (2026-07-08)

compiler-cli

core

http

service-worker

21.2.18 (2026-07-08)

compiler-cli

core

http

service-worker

22.1.0-next.5 (2026-07-08)

compiler

20.3.26

compiler-cli

core

http

service-worker

20.3.25

common

compiler

core

http

platform-server

service-worker

20.3.26 (2026-07-08)

compiler-cli

core

http

service-worker

21.2.18 (2026-07-08)

compiler-cli

core

http

service-worker

22.1.0-next.5 (2026-07-08)

compiler

20.3.26

compiler-cli

core

http

service-worker

20.3.25

common

compiler

core

http

platform-server

service-worker