chore(deps): bump the npm_and_yarn group across 3 directories with 16 updates by dependabot[bot] · Pull Request #1594 · a2ui-project/a2ui

dependabot · 2026-06-09T18:08:10Z

Bumps the npm_and_yarn group with 16 updates in the / directory:

Package	From	To
@vitest/browser	`4.1.2`	`4.1.6`
vite	`5.4.21`	`6.4.2`
dompurify	`3.3.1`	`3.4.0`
@angular/platform-server	`21.2.7`	`21.2.13`
@angular/ssr	`21.2.6`	`21.2.9`
uuid	`13.0.0`	`14.0.0`
hono	`4.12.9`	`4.12.21`
@hono/node-server	`1.19.12`	`1.19.14`
@tootallnate/once	`2.0.0`	`2.0.1`
basic-ftp	`5.2.0`	`5.3.1`
fast-uri	`3.1.0`	`3.1.2`
fast-xml-builder	`1.1.4`	`1.2.0`
follow-redirects	`1.15.11`	`1.16.0`
mermaid	`11.13.0`	`11.15.0`
protobufjs	`7.5.4`	`7.6.2`
systeminformation	`5.31.5`	`5.31.7`

Bumps the npm_and_yarn group with 1 update in the /renderers/markdown/markdown-it directory: dompurify.
Bumps the npm_and_yarn group with 1 update in the /samples/mcp/mcp-apps-calculator/apps/src directory: vite.

Updates @vitest/browser from 4.1.2 to 4.1.6

Release notes

Sourced from @vitest/browser's releases.

v4.1.6

   🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in vitest-dev/vitest#10138 (31882)

Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in vitest-dev/vitest#10196 (2847d)

browser: Simplify orchestrator otel carrier - by @hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

Stringify diff objects only once - by @sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

v4.1.5

   🚀 Experimental Features

coverage: Istanbul to support instrumenter option - by @BartWaardenburg and @AriPerkkio in vitest-dev/vitest#10119 (0e0ff)

   🐞 Bug Fixes

--project negation excludes browser instances - by @felamaslen in vitest-dev/vitest#10131 (9423d)

Project color label on html reporter - by @hi-ogawa in vitest-dev/vitest#10142 (596f7)

Fix vi.defineHelper called as object method - by @hi-ogawa in vitest-dev/vitest#10163 (122c2)

Alias agent reporter to minimal - by @sheremet-va in vitest-dev/vitest#10157 (663b9)

Respect diff config options in soft assertions - by @Copilot, sheremet-va and @sheremet-va in vitest-dev/vitest#8696 (9787d)

Respect diff config options in soft assertions " - by @sheremet-va in vitest-dev/vitest#8696 (7dc6d)

ast-collect: Recognize _vi_import prefix in static test discovery - by @Yejneshwar in vitest-dev/vitest#10129 (32546)

coverage: Descriptive error message when reports directory is removed during test run - by @DaveT1991 and @AriPerkkio in vitest-dev/vitest#10117 (14133)

snapshot: Increase default snapshot max output length - by @hi-ogawa and Codex in vitest-dev/vitest#10150 (21e66)

ui: Fix jsx/tsx syntax highlight - by @hi-ogawa in vitest-dev/vitest#10152 (f1b1f)

web-worker: Support MessagePort objects referenced inside postMessage data - by @whitphx and Claude Opus 4.6 (1M context) in vitest-dev/vitest#9927 and vitest-dev/vitest#10124 (7ad7d)

api: Make test-specification options writable - by @sheremet-va in vitest-dev/vitest#10154 (6abd5)

    View changes on GitHub

v4.1.4

   🚀 Experimental Features

coverage:

Default to text reporter skipFull if agent detected - by @hi-ogawa in vitest-dev/vitest#10018 (53757)

experimental:

Expose assertion as a public field - by @sheremet-va in vitest-dev/vitest#10095 (a120e)

Support aria snapshot - by @hi-ogawa, Claude Opus 4.6 (1M context), @AriPerkkio, Codex and @sheremet-va in vitest-dev/vitest#9668 (d4fbb)

reporter:

Add filterMeta option to json reporter - by @nami8824 and @sheremet-va in vitest-dev/vitest#10078 (b77de)

   🐞 Bug Fixes

Use "black" foreground for labeled terminal message to ensure contrast - by @hi-ogawa in vitest-dev/vitest#10076 (203f0)

Make expect(..., message) consistent as error message prefix - by @hi-ogawa and Codex in vitest-dev/vitest#10068 (a1b5f)

... (truncated)

Commits

a8fd24c chore: release v4.1.6
18af98c fix(browser): simplify orchestrator otel carrier (#10285)
3188260 feat(browser): provide project reference in ToMatchScreenshotResolvePath (#...
e399846 chore: release v4.1.5
ac04bac chore: release v4.1.4
d4fbb5c feat(experimental): support aria snapshot (#9668)
65c9d55 fix(browser): spread user server options into browser Vite server in project ...
2dc0d62 chore: release v4.1.3
487990a feat(experimental): support browser.locators.exact option (#10013)
66751c9 fix(expect): remove JestExtendError.context from verbose error reporting (#...
See full diff in compare view

Updates vite from 5.4.21 to 6.4.2

Release notes

Sourced from vite's releases.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965

fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940

refactor: remove duplicate plugin context type (#19935) (d6d01c2), closes #19935

6.3.3 (2025-04-24)

fix: ignore malformed uris in tranform middleware (#19853) (e4d5201), closes #19853

... (truncated)

Commits

6b3fad0 release: v6.4.2
ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
5487f4f release: v6.4.1
1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
f12697c release: v6.4.0
ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
0e173d8 release: v6.3.7
c59a222 fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940)
3f337c5 release: v6.3.6
Additional commits viewable in compare view

Updates dompurify from 3.3.1 to 3.4.0

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5

Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver

Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1

Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif

Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs

Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran

Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth

Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth

Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others

Fixed an issue with closing tags leading to possible mXSS, thanks @frevadiscor

Fixed a problem with the type dentition patcher after Node version bump

Fixed freezing BS runs by reducing the tested browsers array

Bumped several dependencies where possible

Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

DOMPurify 3.3.3

Fixed an engine requirement for Node 20 which caused hiccups, thanks @Rotzbua

DOMPurify 3.3.2

Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters

Fixed a prototype pollution issue when working with custom elements, thanks @christos-eth

Fixed a lenient config parsing in _isValidAttribute, thanks @christos-eth

Bumped and removed several dependencies, thanks @Rotzbua

Fixed the test suite after bumping dependencies, thanks @Rotzbua

Commits

5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
8bcbf73 chore: Preparing 3.3.3 release
5faddd6 fix: engine requirement (#1210)
0f91e3a Update README.md
d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
c3efd48 fix: moved back from jsdom 28 to jsdom 20
988b888 fix: moved back from jsdom 28 to jsdom 20
2726c74 chore: Preparing 3.3.2 release
6202c7e build(deps): bump @tootallnate/once and jsdom (#1204)
302b51d fix: Expanded the regex ever so slightly to also cover script
Additional commits viewable in compare view

Updates @angular/platform-server from 21.2.7 to 21.2.13

Release notes

Sourced from @angular/platform-server's releases.

21.2.13

core

Commit Description

disallow event attribute bindings in host bindings unconditionally

platform-server

Commit Description

add allowedHosts option to renderModule and renderApplication

forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit Description

allow explicit read generic with signal input transforms

i18n flags leaking on errors

respect ngSkipHydration on components with projectable nodes in LContainers

sanitizer typings

validate security-sensitive attributes in i18n bindings

visit ng-let expression value in signal migration schematics

forms

Commit Description

prohibit concurrent submits in signal forms

21.2.11

common

Commit Description

prevent focus from scrollToAnchor

compiler

Commit Description

let declaration span not including end character

core

Commit Description

fix ordering of view queries metadata in JIT mode

guard against non-object events and avoid listener wrapper identity mismatch

prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit Description

ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit Description

... (truncated)

Changelog

Sourced from @angular/platform-server's changelog.

21.2.13 (2026-05-13)

core

Commit Type Description

1c6553e97d fix disallow event attribute bindings in host bindings unconditionally

platform-server

Commit Type Description

629905d537 fix add allowedHosts option to renderModule and renderApplication

0b7192f441 fix forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit Type Description

83a640516f fix disallow event attribute bindings in host bindings unconditionally (#68469)

24a0103a98 fix validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit Type Description

8569db8875 fix add allowedHosts option to renderModule and renderApplication

837a710217 fix ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit Type Description

f584840e2e fix add allowedHosts option to renderModule and renderApplication

21.2.12 (2026-05-06)

core

Commit Type Description

fe13bb669d fix allow explicit read generic with signal input transforms

3430251fef fix i18n flags leaking on errors

1aeebbe304 fix respect ngSkipHydration on components with projectable nodes in LContainers

9e38ed7d57 fix sanitizer typings

7a05a9a71a fix validate security-sensitive attributes in i18n bindings

c37f6ca42f fix visit ng-let expression value in signal migration schematics

forms

| Commit | Type | Description |

... (truncated)

Commits

0b7192f fix(platform-server): forward BEFORE_APP_SERIALIZED errors to ErrorHandler
629905d fix(platform-server): add allowedHosts option to renderModule and `render...
1aeebbe fix(core): respect ngSkipHydration on components with projectable nodes in LC...
41e4851 docs: update documentation for platform server URL token options
be1f80a fix(platform-server): ensure origin has a trailing slash when parsing url
7a64aff fix(core): prevent event replay double-invocation when element hydrates befor...
b24ead5 refactor: Improve hydration mismatch errors for third-party scripts
e0b5078 fix(platform-server): prevent SSRF bypasses via protocol-relative and backsla...
f603d47 fix(core): escape forward slashes in transfer state to prevent crawler indexing
04f5841 test(platform-server): fix race condition in incremental hydration test
Additional commits viewable in compare view

Updates @angular/ssr from 21.2.6 to 21.2.9

Release notes

Sourced from @angular/ssr's releases.

21.2.9

@schematics/angular

Commit Description

add missing imports for focus and skip APIs in refactor-jasmine-vitest

@angular/cli

Commit Description

fix broken img ref in ai-tutor

introduce initial package manager workspace awareness

remove standalone true ref in ai tutor

@angular/ssr

Commit Description

introduce trustProxyHeaders option to safely validate and sanitize proxy headers

add support for configuring trusted proxy headers via environment variable

decode route segments when building and matching route tree

use router to normalize URLs for comparison

21.2.8

@angular/cli

Commit Description

dynamically resolve project Angular CLI executable inside MCP tools

ignore EBADF file system errors during MCP project scan

use headless option in MCP test tool

@angular-devkit/build-angular

Commit Description

ensure route has leading slash in prerender builder

fix app-shell route format and

@angular/build

Commit Description

use rootDir for HMR component updates path resolution

validate V8 coverage support for browsers in Vitest

21.2.7

@angular/cli

Commit Description

handle missing package manager during analytics initialization

@angular/build

Commit Description

preserve coverage ignore comments in development

show clear error when styleUrl points to a TypeScript file

Changelog

Sourced from @angular/ssr's changelog.

21.2.9 (2026-04-29)

@angular/cli

Commit Type Description

233deef01 fix fix broken img ref in ai-tutor

7cea9885c fix introduce initial package manager workspace awareness

5b1a5b743 fix remove standalone true ref in ai tutor

@schematics/angular

Commit Type Description

e7abeb5c7 fix add missing imports for focus and skip APIs in refactor-jasmine-vitest

@angular/ssr

Commit Type Description

94023f62c fix introduce trustProxyHeaders option to safely validate and sanitize proxy headers

5ffe5c309 fix add support for configuring trusted proxy headers via environment variable

930ada9b7 fix decode route segments when building and matching route tree

0dc8a440c fix use router to normalize URLs for comparison

20.3.25 (2026-04-29)

@angular-devkit/build-angular

Commit Type Description

5e01ef40e fix upgrade postcss to 8.5.12

@angular/ssr

Commit Type Description

6686848d9 fix introduce trustProxyHeaders option to safely validate and sanitize proxy headers

20.3.24 (2026-04-15)

@angular/build

... (truncated)

Commits

564b108 release: cut the v21.2.9 release
dbda92b build: update cross-repo angular dependencies
828c175 build: update pnpm to v10.33.2
a887b94 build: lock file maintenance
56d19be build: update cross-repo angular dependencies
f2f4851 build: update dependency postcss to v8.5.12
5ffe5c3 fix(@angular/ssr): add support for configuring trusted proxy headers via envi...
930ada9 fix(@angular/ssr): decode route segments when building and matching route tree
0dc8a44 fix(@angular/ssr): use router to normalize URLs for comparison
7cea988 fix(@angular/cli): introduce initial package manager workspace awareness
Additional commits viewable in compare view

Updates uuid from 13.0.0 to 14.0.0

Release notes

Sourced from uuid's releases.

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

expect crypto to be global everywhere (requires node@20+) (#935)

drop node@18 support (#934)

Features

drop node@18 support (#934) (dc4ddb8)

Bug Fixes

expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)

Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

crypto is now expected to be globally defined (requires node@20+) (#935)

drop node@18 support (#934)

upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

Commits

7c1ea08 chore(main): release 14.0.0 (#926)
3d2c5b0 Merge commit from fork
f2c235f fix!: expect crypto to be global everywhere (requires node@20+) (#935)
529ef08 chore: upgrade TypeScript and fixup types (#927)
086fd79 chore: update dependencies (#933)
dc4ddb8 feat!: drop node@18 support (#934)
0f1f9c9 chore: switch to Biome for parsing and linting (#932)
e2879e6 chore: use maintained version of npm-run-all (#930)
ffa3138 fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)
0423d49 docs: remove obsolete v1 option notes (#915)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Updates hono from 4.12.9 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

fix(route): preserve the base path of the mounted route() app by @usualoma in honojs/hono#4942

fix(jsx): widen jsx and jsxFn children to Child[] by @ashunar0 in honojs/hono#4947

New Contributors

@ashunar0 made their first contribution in honojs/hono#4947

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

What's Changed

ci: pin GitHub Actions to SHAs by @yusukebe in honojs/hono#4932

fix(serveStatic): make options parameter optional in all adapters by @mixelburg in honojs/hono#4934

fix(cookie): return the first cookie when there are multiple cookies with the same name by @usualoma in honojs/hono#4922

feat(bearer-auth): make bearerAuth generic for typed context in verifyToken by @justinnais in honojs/hono#4913

feat(cache): key cache entries by configured vary headers by @usualoma in honojs/hono#4915

feat(request): add bytes() by @yusukebe in honojs/hono#4921

fix(stream): upgrade @hono/node-server to v2 and fix abort handling by @yusukebe in honojs/hono#4940

New Contributors

@justinnais made their first contribution in honojs/hono#4913

Full Changelog: honojs/hono@v4.12.18...v4.12.19

... (truncated)

Commits

a83ddb8 4.12.21
6cbb025 Merge commit from fork
c831020 Merge commit from fork
905aedb Merge commit from fork
5463db2 Merge commit from fork
c657a39 4.12.20
...
Description has been truncated

… updates Bumps the npm_and_yarn group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@vitest/browser](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser) | `4.1.2` | `4.1.6` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `6.4.2` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.1` | `3.4.0` | | [@angular/platform-server](https://github.com/angular/angular/tree/HEAD/packages/platform-server) | `21.2.7` | `21.2.13` | | [@angular/ssr](https://github.com/angular/angular-cli) | `21.2.6` | `21.2.9` | | [uuid](https://github.com/uuidjs/uuid) | `13.0.0` | `14.0.0` | | [hono](https://github.com/honojs/hono) | `4.12.9` | `4.12.21` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.12` | `1.19.14` | | [@tootallnate/once](https://github.com/TooTallNate/once) | `2.0.0` | `2.0.1` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.2.0` | `5.3.1` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.4` | `1.2.0` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.11` | `1.16.0` | | [mermaid](https://github.com/mermaid-js/mermaid) | `11.13.0` | `11.15.0` | | [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.4` | `7.6.2` | | [systeminformation](https://github.com/sebhildebrandt/systeminformation) | `5.31.5` | `5.31.7` | Bumps the npm_and_yarn group with 1 update in the /renderers/markdown/markdown-it directory: [dompurify](https://github.com/cure53/DOMPurify). Bumps the npm_and_yarn group with 1 update in the /samples/mcp/mcp-apps-calculator/apps/src directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@vitest/browser` from 4.1.2 to 4.1.6 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/browser) Updates `vite` from 5.4.21 to 6.4.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) Updates `dompurify` from 3.3.1 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.1...3.4.0) Updates `@angular/platform-server` from 21.2.7 to 21.2.13 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/platform-server) Updates `@angular/ssr` from 21.2.6 to 21.2.9 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v21.2.6...v21.2.9) Updates `uuid` from 13.0.0 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v13.0.0...v14.0.0) Updates `hono` from 4.12.9 to 4.12.21 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.9...v4.12.21) Updates `@hono/node-server` from 1.19.12 to 1.19.14 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.12...v1.19.14) Updates `@tootallnate/once` from 2.0.0 to 2.0.1 - [Release notes](https://github.com/TooTallNate/once/releases) - [Changelog](https://github.com/TooTallNate/once/blob/v2.0.1/CHANGELOG.md) - [Commits](TooTallNate/once@2.0.0...v2.0.1) Updates `basic-ftp` from 5.2.0 to 5.3.1 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.2.0...v5.3.1) Updates `fast-uri` from 3.1.0 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) Updates `fast-xml-builder` from 1.1.4 to 1.2.0 - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-builder@v1.1.4...v1.2.0) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `mermaid` from 11.13.0 to 11.15.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.13.0...mermaid@11.15.0) Updates `protobufjs` from 7.5.4 to 7.6.2 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.2/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.4...protobufjs-v7.6.2) Updates `systeminformation` from 5.31.5 to 5.31.7 - [Release notes](https://github.com/sebhildebrandt/systeminformation/releases) - [Changelog](https://github.com/sebhildebrandt/systeminformation/blob/master/CHANGELOG.md) - [Commits](sebhildebrandt/systeminformation@v5.31.5...v5.31.7) Updates `dompurify` from 3.3.1 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.1...3.4.0) Updates `vite` from 5.4.21 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) --- updated-dependencies: - dependency-name: "@vitest/browser" dependency-version: 4.1.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/platform-server" dependency-version: 21.2.13 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/ssr" dependency-version: 21.2.9 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@tootallnate/once" dependency-version: 2.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: basic-ftp dependency-version: 5.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-builder dependency-version: 1.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mermaid dependency-version: 11.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-version: 7.6.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: systeminformation dependency-version: 5.31.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-10T22:36:38Z

Superseded by #1604.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 9, 2026

github-project-automation Bot added this to A2UI Jun 9, 2026

dependabot Bot added the javascript Pull requests that update javascript code label Jun 9, 2026

github-project-automation Bot moved this to Todo in A2UI Jun 9, 2026

dependabot Bot closed this Jun 10, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-a5db1704bf branch June 10, 2026 22:36

github-project-automation Bot moved this from Todo to Done in A2UI Jun 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 3 directories with 16 updates#1594

chore(deps): bump the npm_and_yarn group across 3 directories with 16 updates#1594
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-a5db1704bf

dependabot Bot commented on behalf of github Jun 9, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	add `allowedHosts` option to `renderModule` and `renderApplication`
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

Commit	Type	Description
629905d537	fix	add `allowedHosts` option to `renderModule` and `renderApplication`
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

Commit	Type	Description
8569db8875	fix	add `allowedHosts` option to `renderModule` and `renderApplication`
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

Commit	Type	Description
fe13bb669d	fix	allow explicit read generic with signal input transforms
3430251fef	fix	i18n flags leaking on errors
1aeebbe304	fix	respect ngSkipHydration on components with projectable nodes in LContainers
9e38ed7d57	fix	sanitizer typings
7a05a9a71a	fix	validate security-sensitive attributes in i18n bindings
c37f6ca42f	fix	visit ng-let expression value in signal migration schematics

Commit	Description
	fix broken img ref in ai-tutor
	introduce initial package manager workspace awareness
	remove standalone true ref in ai tutor

Commit	Description
	introduce trustProxyHeaders option to safely validate and sanitize proxy headers
	add support for configuring trusted proxy headers via environment variable
	decode route segments when building and matching route tree
	use router to normalize URLs for comparison

Commit	Description
	dynamically resolve project Angular CLI executable inside MCP tools
	ignore EBADF file system errors during MCP project scan
	use headless option in MCP test tool

Commit	Description
	ensure route has leading slash in prerender builder
	fix app-shell route format and

Commit	Description
	use rootDir for HMR component updates path resolution
	validate V8 coverage support for browsers in Vitest

Commit	Description
	preserve coverage ignore comments in development
	show clear error when styleUrl points to a TypeScript file

Commit	Type	Description
233deef01	fix	fix broken img ref in ai-tutor
7cea9885c	fix	introduce initial package manager workspace awareness
5b1a5b743	fix	remove standalone true ref in ai tutor

Commit	Type	Description
94023f62c	fix	introduce trustProxyHeaders option to safely validate and sanitize proxy headers
5ffe5c309	fix	add support for configuring trusted proxy headers via environment variable
930ada9b7	fix	decode route segments when building and matching route tree
0dc8a440c	fix	use router to normalize URLs for comparison

Conversation

dependabot Bot commented on behalf of github Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.1.6

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v4.1.5

🚀 Experimental Features

🐞 Bug Fixes

View changes on GitHub

v4.1.4

🚀 Experimental Features

🐞 Bug Fixes

v6.4.2

v6.4.1

v6.4.0

v6.3.7

v6.3.6

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

6.3.7 (2025-10-14)

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

6.3.3 (2025-04-24)

DOMPurify 3.4.0

DOMPurify 3.3.3

DOMPurify 3.3.2

21.2.13

core

platform-server

21.2.12

core

forms

21.2.11

common

compiler

core

platform-server

21.2.10

docs

21.2.13 (2026-05-13)

core

platform-server

19.2.22 (2026-05-12)

core

platform-server

20.3.21 (2026-05-12)

platform-server

21.2.12 (2026-05-06)

core

forms

21.2.9

@​schematics/angular

@​angular/cli

@​angular/ssr

21.2.8

@​angular/cli

@​angular-devkit/build-angular

@​angular/build

21.2.7

@​angular/cli

@​angular/build

21.2.9 (2026-04-29)

@​angular/cli

@​schematics/angular

@​angular/ssr

20.3.25 (2026-04-29)

@​angular-devkit/build-angular

@​angular/ssr

20.3.24 (2026-04-15)

@​angular/build

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

Features

Bug Fixes

v13.0.2

dependabot Bot commented on behalf of github Jun 9, 2026 •

edited

Loading

`@schematics/angular`

`@angular/cli`

`@angular/ssr`

`@angular/cli`

`@angular-devkit/build-angular`

`@angular/build`

`@angular/cli`

`@angular/build`

`@angular/cli`

`@schematics/angular`

`@angular/ssr`

`@angular-devkit/build-angular`

`@angular/ssr`

`@angular/build`