chore(deps): bump the angular group with 17 updates by dependabot[bot] · Pull Request #1638 · koobiq/angular-components

dependabot · 2026-06-16T18:11:02Z

Bumps the angular group with 17 updates:

Package	From	To
@angular/common	`20.3.24`	`20.3.25`
@angular/compiler	`20.3.24`	`20.3.25`
@angular/core	`20.3.24`	`20.3.25`
@angular/forms	`20.3.24`	`20.3.25`
@angular/platform-browser	`20.3.24`	`20.3.25`
@angular-devkit/architect	`0.2003.27`	`0.2003.28`
@angular-devkit/architect-cli	`0.2003.27`	`0.2003.28`
@angular-devkit/build-angular	`20.3.27`	`20.3.28`
@angular-devkit/core	`20.3.27`	`20.3.28`
@angular-devkit/schematics	`20.3.27`	`20.3.28`
@angular/cli	`20.3.27`	`20.3.28`
@angular/compiler-cli	`20.3.24`	`20.3.25`
@angular/platform-browser-dynamic	`20.3.24`	`20.3.25`
@angular/platform-server	`20.3.24`	`20.3.25`
@angular/router	`20.3.24`	`20.3.25`
@angular/ssr	`20.3.27`	`20.3.28`
@schematics/angular	`20.3.27`	`20.3.28`

Updates @angular/common from 20.3.24 to 20.3.25

Release notes

Sourced from @angular/common's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

Changelog

Sourced from @angular/common's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

06be298 fix(http): preserve empty referrer option in HttpRequest
9f443bc fix(common): Limits date format string length
fa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
e2ef1ce fix(http): skip transfer cache for fetch credentialed requests
See full diff in compare view

Updates @angular/compiler from 20.3.24 to 20.3.25

Release notes

Sourced from @angular/compiler's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

Changelog

Sourced from @angular/compiler's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

a68ec70 fix(compiler): sanitize two-way properties
See full diff in compare view

Updates @angular/core from 20.3.24 to 20.3.25

Release notes

Sourced from @angular/core's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

Changelog

Sourced from @angular/core's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)
1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
49368c1 fix(platform-server): harden platform location origin validation during SSR
566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
768a349 fix(core): harden TransferState restoration against DOM clobbering
See full diff in compare view

Updates @angular/forms from 20.3.24 to 20.3.25

Release notes

Sourced from @angular/forms's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

Changelog

Sourced from @angular/forms's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

See full diff in compare view

Updates @angular/platform-browser from 20.3.24 to 20.3.25

Release notes

Sourced from @angular/platform-browser's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

Changelog

Sourced from @angular/platform-browser's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

See full diff in compare view

Updates @angular-devkit/architect from 0.2003.27 to 0.2003.28

Commits

See full diff in compare view

Updates @angular-devkit/architect-cli from 0.2003.27 to 0.2003.28

Commits

See full diff in compare view

Updates @angular-devkit/build-angular from 20.3.27 to 20.3.28

Release notes

Sourced from @angular-devkit/build-angular's releases.

20.3.28

@angular/cli

Commit Description

fallback to deprecated versions when resolving ranges if no non-deprecated version is found

remove forceAuth and unscoped credential parsing

Changelog

Sourced from @angular-devkit/build-angular's changelog.

20.3.28 (2026-06-11)

@angular/cli

Commit Type Description

e3d564667 fix fallback to deprecated versions when resolving ranges if no non-deprecated version is found

f12e17025 fix remove forceAuth and unscoped credential parsing

21.2.15 (2026-06-11)

@angular/cli

Commit Type Description

42ac0ed0f fix remove forceAuth and unscoped credential parsing

c7a7f1955 fix support registry metadata fetching under bun package manager

22.0.1 (2026-06-10)

@angular/cli

Commit Type Description

b54e9a549 fix do not sort migrations of the same version alphabetically

d33311612 fix fallback to local package.json for schematic detection on first run

918102a93 fix isolate temporary package installation from parent pnpm workspace

b048b5f4a fix remove forceAuth and unscoped credential parsing

277934035 fix validate registry option is a valid URL in ng add

4510dae02 perf optimize update schematic registry query counts by fetching package metadata lazily

@schematics/angular

Commit Type Description

c80012294 fix fix browserMode option mapping in refactor-jasmine-vitest

a9b6bd904 fix safely comment out multiline statements in refactor-jasmine-vitest

12199df00 fix use null objects and callbacks in karma-to-vitest migration

@angular/build

| Commit | Type | Description |

... (truncated)

Commits

9eba41c release: cut the v20.3.28 release
2fb9b3b test(@angular/cli): ignore engines in version-specifier E2E test when using yarn
f12e170 fix(@angular/cli): remove forceAuth and unscoped credential parsing
241f9b9 test(@angular/cli): remove unscoped authentication test cases from registry t...
e3d5646 fix(@angular/cli): fallback to deprecated versions when resolving ranges if n...
See full diff in compare view

Updates @angular-devkit/core from 20.3.27 to 20.3.28

Release notes

Sourced from @angular-devkit/core's releases.

20.3.28

@angular/cli

Commit Description

fallback to deprecated versions when resolving ranges if no non-deprecated version is found

remove forceAuth and unscoped credential parsing

Changelog

Sourced from @angular-devkit/core's changelog.

20.3.28 (2026-06-11)

@angular/cli

Commit Type Description

e3d564667 fix fallback to deprecated versions when resolving ranges if no non-deprecated version is found

f12e17025 fix remove forceAuth and unscoped credential parsing

21.2.15 (2026-06-11)

@angular/cli

Commit Type Description

42ac0ed0f fix remove forceAuth and unscoped credential parsing

c7a7f1955 fix support registry metadata fetching under bun package manager

22.0.1 (2026-06-10)

@angular/cli

Commit Type Description

b54e9a549 fix do not sort migrations of the same version alphabetically

d33311612 fix fallback to local package.json for schematic detection on first run

918102a93 fix isolate temporary package installation from parent pnpm workspace

b048b5f4a fix remove forceAuth and unscoped credential parsing

277934035 fix validate registry option is a valid URL in ng add

4510dae02 perf optimize update schematic registry query counts by fetching package metadata lazily

@schematics/angular

Commit Type Description

c80012294 fix fix browserMode option mapping in refactor-jasmine-vitest

a9b6bd904 fix safely comment out multiline statements in refactor-jasmine-vitest

12199df00 fix use null objects and callbacks in karma-to-vitest migration

@angular/build

| Commit | Type | Description |

... (truncated)

Commits

9eba41c release: cut the v20.3.28 release
2fb9b3b test(@angular/cli): ignore engines in version-specifier E2E test when using yarn
f12e170 fix(@angular/cli): remove forceAuth and unscoped credential parsing
241f9b9 test(@angular/cli): remove unscoped authentication test cases from registry t...
e3d5646 fix(@angular/cli): fallback to deprecated versions when resolving ranges if n...
See full diff in compare view

Updates @angular-devkit/schematics from 20.3.27 to 20.3.28

Release notes

Sourced from @angular-devkit/schematics's releases.

20.3.28

@angular/cli

Commit Description

fallback to deprecated versions when resolving ranges if no non-deprecated version is found

remove forceAuth and unscoped credential parsing

Changelog

Sourced from @angular-devkit/schematics's changelog.

20.3.28 (2026-06-11)

@angular/cli

Commit Type Description

e3d564667 fix fallback to deprecated versions when resolving ranges if no non-deprecated version is found

f12e17025 fix remove forceAuth and unscoped credential parsing

Bumps the angular group with 17 updates: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `20.3.24` | `20.3.25` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `20.3.24` | `20.3.25` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `20.3.24` | `20.3.25` | | [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `20.3.24` | `20.3.25` | | [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `20.3.24` | `20.3.25` | | [@angular-devkit/architect](https://github.com/angular/angular-cli) | `0.2003.27` | `0.2003.28` | | [@angular-devkit/architect-cli](https://github.com/angular/angular-cli) | `0.2003.27` | `0.2003.28` | | [@angular-devkit/build-angular](https://github.com/angular/angular-cli) | `20.3.27` | `20.3.28` | | [@angular-devkit/core](https://github.com/angular/angular-cli) | `20.3.27` | `20.3.28` | | [@angular-devkit/schematics](https://github.com/angular/angular-cli) | `20.3.27` | `20.3.28` | | [@angular/cli](https://github.com/angular/angular-cli) | `20.3.27` | `20.3.28` | | [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `20.3.24` | `20.3.25` | | [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) | `20.3.24` | `20.3.25` | | [@angular/platform-server](https://github.com/angular/angular/tree/HEAD/packages/platform-server) | `20.3.24` | `20.3.25` | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `20.3.24` | `20.3.25` | | [@angular/ssr](https://github.com/angular/angular-cli) | `20.3.27` | `20.3.28` | | [@schematics/angular](https://github.com/angular/angular-cli) | `20.3.27` | `20.3.28` | Updates `@angular/common` from 20.3.24 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/common) Updates `@angular/compiler` from 20.3.24 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 20.3.24 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/core) Updates `@angular/forms` from 20.3.24 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/forms) Updates `@angular/platform-browser` from 20.3.24 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/platform-browser) Updates `@angular-devkit/architect` from 0.2003.27 to 0.2003.28 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular-cli/commits) Updates `@angular-devkit/architect-cli` from 0.2003.27 to 0.2003.28 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular-cli/commits) Updates `@angular-devkit/build-angular` from 20.3.27 to 20.3.28 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.27...v20.3.28) Updates `@angular-devkit/core` from 20.3.27 to 20.3.28 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.27...v20.3.28) Updates `@angular-devkit/schematics` from 20.3.27 to 20.3.28 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.27...v20.3.28) Updates `@angular/cli` from 20.3.27 to 20.3.28 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.27...v20.3.28) Updates `@angular/compiler-cli` from 20.3.24 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler-cli) Updates `@angular/platform-browser-dynamic` from 20.3.24 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/platform-browser-dynamic) Updates `@angular/platform-server` from 20.3.24 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/platform-server) Updates `@angular/router` from 20.3.24 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/router) Updates `@angular/ssr` from 20.3.27 to 20.3.28 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.27...v20.3.28) Updates `@schematics/angular` from 20.3.27 to 20.3.28 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v20.3.27...v20.3.28) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/forms" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/platform-browser" dependency-version: 20.3.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular-devkit/architect" dependency-version: 0.2003.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular-devkit/architect-cli" dependency-version: 0.2003.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular-devkit/build-angular" dependency-version: 20.3.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular-devkit/core" dependency-version: 20.3.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular-devkit/schematics" dependency-version: 20.3.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/cli" dependency-version: 20.3.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/compiler-cli" dependency-version: 20.3.25 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/platform-browser-dynamic" dependency-version: 20.3.25 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/platform-server" dependency-version: 20.3.25 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/router" dependency-version: 20.3.25 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/ssr" dependency-version: 20.3.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@schematics/angular" dependency-version: 20.3.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 16, 2026

dependabot Bot requested a review from lskramarov as a code owner June 16, 2026 18:11

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the angular group with 17 updates#1638

chore(deps): bump the angular group with 17 updates#1638
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/angular-1790292c3c

dependabot Bot commented on behalf of github Jun 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69270)

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69256)

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
768a349e6e	fix	harden TransferState restoration against DOM clobbering
ca48b4728d	fix	validate lowercase SVG animation attribute names (#69270)

Commit	Type	Description
06be298267	fix	preserve empty referrer option in HttpRequest
fa940e1f4d	fix	Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a	fix	skip transfer cache for fetch credentialed requests

Commit	Type	Description
49368c1859	fix	harden platform location origin validation during SSR
d55c94ad81	refactor	deprecate ServerXhr (#69256)

Commit	Description
	fallback to deprecated versions when resolving ranges if no non-deprecated version is found
	remove forceAuth and unscoped credential parsing

Commit	Type	Description
e3d564667	fix	fallback to deprecated versions when resolving ranges if no non-deprecated version is found
f12e17025	fix	remove forceAuth and unscoped credential parsing

Commit	Type	Description
42ac0ed0f	fix	remove forceAuth and unscoped credential parsing
c7a7f1955	fix	support registry metadata fetching under bun package manager

Commit	Type	Description
b54e9a549	fix	do not sort migrations of the same version alphabetically
d33311612	fix	fallback to local package.json for schematic detection on first run
918102a93	fix	isolate temporary package installation from parent pnpm workspace
b048b5f4a	fix	remove forceAuth and unscoped credential parsing
277934035	fix	validate registry option is a valid URL in ng add
4510dae02	perf	optimize update schematic registry query counts by fetching package metadata lazily

Commit	Type	Description
c80012294	fix	fix browserMode option mapping in refactor-jasmine-vitest
a9b6bd904	fix	safely comment out multiline statements in refactor-jasmine-vitest
12199df00	fix	use null objects and callbacks in karma-to-vitest migration

Conversation

dependabot Bot commented on behalf of github Jun 16, 2026

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

22.0.0 (2026-06-03)

Breaking Changes

compiler

compiler-cli

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

22.0.0 (2026-06-03)

Breaking Changes

compiler

compiler-cli

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

22.0.0 (2026-06-03)

Breaking Changes

compiler

compiler-cli

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.25 (2026-06-10)

Deprecations

platform-server

`@angular/cli`

`@angular/cli`

`@angular/cli`

`@angular/cli`

`@schematics/angular`

`@angular/build`

`@angular/cli`

`@angular/cli`

`@angular/cli`

`@angular/cli`

`@schematics/angular`

`@angular/build`

`@angular/cli`

`@angular/cli`