fraujulian/Personal-Portfolio-Website
1
0
Fork 0
Code Issues Pull Requests 7 Actions Projects Releases 2 Wiki Activity

Bump the npm_and_yarn group across 1 directory with 8 updates #10

Open
dependabot[bot] wants to merge 1 commits from dependabot/npm_and_yarn/npm_and_yarn-ff37f5454c into main
pull from: dependabot/npm_and_yarn/npm_and_yarn-ff37f5454c
merge into: :main
Conversation 0 Commits 1 Files Changed 2
+286 -281
dependabot[bot] commented 2025-12-16 20:37:35 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
@angular/common 19.2.14 19.2.16
@angular/compiler 19.2.14 19.2.17
@angular/platform-server 19.2.14 19.2.16
@angular/ssr 19.2.15 19.2.19
vite 6.2.7 6.4.1
js-yaml 4.1.0 4.1.1
node-forge 1.3.1 1.3.3
on-headers 1.0.2 1.1.0

Updates @angular/common from 19.2.14 to 19.2.16

Release notes

Sourced from @​angular/common's releases.

19.2.16

http

Commit Description
fix - 05fe6686a9 prevent XSRF token leakage to protocol-relative URLs

19.2.15

core

Commit Description
fix - 70d0639bc1 introduce BootstrapContext for improved server bootstrapping (#63639)

Breaking Changes

core

  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

    Before:

    const bootstrap = () => bootstrapApplication(AppComponent, config);

    After:

    const bootstrap = (context: BootstrapContext) =>
  bootstrapApplication(AppComponent, config, context);

    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

For more information please see: https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7

Changelog

Sourced from @​angular/common's changelog.

19.2.16 (2025-11-26)

http

Commit Type Description
05fe6686a9 fix prevent XSRF token leakage to protocol-relative URLs

21.1.0-next.0 (2025-11-25)

platform-browser

Commit Type Description
ec9dc94cee feat add context to createApplication
ab67988d2e feat resolve JIT resources in createApplication

router

Commit Type Description
a03c82564d feat Add scroll behavior controls on router navigation
c25d749d85 feat Execute RunGuardsAndResolvers function in injection context
c84d372778 feat Support wildcard params with segments trailing (#64737)

20.3.14 (2025-11-25)

http

Commit Type Description
0276479e7d fix prevent XSRF token leakage to protocol-relative URLs

21.0.1 (2025-11-25)

compiler-cli

| Commit | Type | Description |

... (truncated)

Commits
  • 05fe668 fix(http): prevent XSRF token leakage to protocol-relative URLs
  • See full diff in compare view

Updates @angular/compiler from 19.2.14 to 19.2.17

Release notes

Sourced from @​angular/compiler's releases.

19.2.17

compiler

Commit Description
fix - 7c42e2ebeb prevent XSS via SVG animation attributeName and MathML/SVG URLs

19.2.16

http

Commit Description
fix - 05fe6686a9 prevent XSRF token leakage to protocol-relative URLs

19.2.15

core

Commit Description
fix - 70d0639bc1 introduce BootstrapContext for improved server bootstrapping (#63639)

Breaking Changes

core

  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

    Before:

    const bootstrap = () => bootstrapApplication(AppComponent, config);

    After:

    const bootstrap = (context: BootstrapContext) =>
  bootstrapApplication(AppComponent, config, context);

    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

For more information please see: https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7

Changelog

Sourced from @​angular/compiler's changelog.

19.2.17 (2025-12-01)

compiler

Commit Type Description
7c42e2ebeb fix prevent XSS via SVG animation attributeName and MathML/SVG URLs

19.2.16 (2025-11-26)

http

Commit Type Description
05fe6686a9 fix prevent XSRF token leakage to protocol-relative URLs

21.1.0-next.0 (2025-11-25)

platform-browser

Commit Type Description
ec9dc94cee feat add context to createApplication
ab67988d2e feat resolve JIT resources in createApplication

router

Commit Type Description
a03c82564d feat Add scroll behavior controls on router navigation
c25d749d85 feat Execute RunGuardsAndResolvers function in injection context
c84d372778 feat Support wildcard params with segments trailing (#64737)

20.3.14 (2025-11-25)

http

| Commit | Type | Description |

... (truncated)

Commits
  • 7c42e2e fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
  • See full diff in compare view

Updates @angular/platform-server from 19.2.14 to 19.2.16

Release notes

Sourced from @​angular/platform-server's releases.

19.2.16

http

Commit Description
fix - 05fe6686a9 prevent XSRF token leakage to protocol-relative URLs

19.2.15

core

Commit Description
fix - 70d0639bc1 introduce BootstrapContext for improved server bootstrapping (#63639)

Breaking Changes

core

  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

    Before:

    const bootstrap = () => bootstrapApplication(AppComponent, config);

    After:

    const bootstrap = (context: BootstrapContext) =>
  bootstrapApplication(AppComponent, config, context);

    A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

    In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

For more information please see: https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7

Changelog

Sourced from @​angular/platform-server's changelog.

19.2.16 (2025-11-26)

http

Commit Type Description
05fe6686a9 fix prevent XSRF token leakage to protocol-relative URLs

21.1.0-next.0 (2025-11-25)

platform-browser

Commit Type Description
ec9dc94cee feat add context to createApplication
ab67988d2e feat resolve JIT resources in createApplication

router

Commit Type Description
a03c82564d feat Add scroll behavior controls on router navigation
c25d749d85 feat Execute RunGuardsAndResolvers function in injection context
c84d372778 feat Support wildcard params with segments trailing (#64737)

20.3.14 (2025-11-25)

http

Commit Type Description
0276479e7d fix prevent XSRF token leakage to protocol-relative URLs

21.0.1 (2025-11-25)

compiler-cli

| Commit | Type | Description |

... (truncated)

Commits
  • 70d0639 fix(core): introduce BootstrapContext for improved server bootstrapping (#6...
  • See full diff in compare view

Updates @angular/ssr from 19.2.15 to 19.2.19

Release notes

Sourced from @​angular/ssr's releases.

19.2.19

@​angular/build

Commit Description
fix - 4d8ea27a1 update vite to v6.4.1

19.2.18

@​angular/ssr

Commit Description
fix - 9136a5d13 prevent malicious URL from overriding host

19.2.17

@​angular/build

Commit Description
fix - 365d525b5 update vite to 6.3.6

19.2.16

@​angular-devkit/build-angular

Commit Description
fix - b0f4330a9 avoid extra tick in SSR builds

@​angular/build

Commit Description
fix - ee5c5f823 avoid extra tick in SSR dev-server builds

@​angular/ssr

Commit Description
feat - 32980f7e7 introduce BootstrapContext for isolated server-side rendering

Breaking Changes

@​angular/ssr

  • The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

    Before:

    const bootstrap = () => bootstrapApplication(AppComponent, config);

    After:

    const bootstrap = (context: BootstrapContext) =>
  bootstrapApplication(AppComponent, config, context);

For more information please see: https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7

Changelog

Sourced from @​angular/ssr's changelog.

19.2.19 (2025-10-29)

@​angular/build

Commit Type Description
4d8ea27a1 fix update vite to v6.4.1

20.3.7 (2025-10-22)

@​angular-devkit/schematics

Commit Type Description
a31533cf4 fix respect --force option when schematic contains host.create

@​angular/build

Commit Type Description
8cdda111c fix resolve Angular locale data namespace in esbuild
5847ccc54 fix update vite to 7.11.1

@​angular/ssr

Commit Type Description
3a28fb6a1 fix correctly handle routes with matrix parameters
5db6d6487 fix ensure server-side navigation triggers a redirect

20.3.6 (2025-10-15)

@​angular/ssr

Commit Type Description
5271547c8 fix prevent malicious URL from overriding host

... (truncated)

Commits
  • 399c3ec release: cut the v19.2.19 release
  • 4d8ea27 fix(@​angular/build): update vite to v6.4.1
  • 8590f19 release: cut the v19.2.18 release
  • 9136a5d fix(@​angular/ssr): prevent malicious URL from overriding host
  • 12b0a1f release: cut the v19.2.17 release
  • 365d525 fix(@​angular/build): update vite to 6.3.6
  • 3ea403a ci: several CI fixes
  • fe9ea0d release: cut the v19.2.16 release
  • c4278aa build: update Angular FW packages to latest patch
  • ee5c5f8 fix(@​angular/build): avoid extra tick in SSR dev-server builds
  • Additional commits viewable in compare view

Updates vite from 6.2.7 to 6.4.1

Release notes

Sourced from vite's releases.

create-vite@6.4.1

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

create-vite@6.4.0

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

v6.3.5

Please refer to CHANGELOG.md for details.

v6.3.4

Please refer to CHANGELOG.md for details.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

v6.3.1

Please refer to CHANGELOG.md for details.

v6.3.0

Please refer to CHANGELOG.md for details.

v6.3.0-beta.2

Please refer to CHANGELOG.md for details.

v6.3.0-beta.1

Please refer to CHANGELOG.md for details.

Commits
  • a7349ef release: v6.3.1
  • a152b7c fix: backward compat for internal plugin transform calls (#19878)
  • 35c7f35 fix: avoid using Promise.allSettled in preload function (#19805)
  • 5fdcfe7 release: v6.3.0
  • d4ee5e8 fix(hmr): avoid infinite loop happening with hot.invalidate in circular dep...
  • 5003434 fix(preview): use host url to open browser (#19836)
  • bf9728e release: v6.3.0-beta.2
  • 380c10e fix(hmr): run HMR handler sequentially (#19793)
  • 8bed1de fix: addWatchFile doesn't work if base is specified (fixes #19792) (#19794)
  • 0a0c50a refactor: simplify pluginFilter implementation (#19828)
  • Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates node-forge from 1.3.1 to 1.3.3

Changelog

Sourced from node-forge's changelog.

1.3.3 - 2025-12-02

Fixed

  • [pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.

1.3.2 - 2025-11-25

Security

  • HIGH: ASN.1 Validator Desynchronization
    • An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-12816
    • GHSA ID: GHSA-5gfm-wpxj-wjgq
  • HIGH: ASN.1 Unbounded Recursion
    • An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66031
    • GHSA ID: GHSA-554w-wpv2-vw27
  • MODERATE: ASN.1 OID Integer Truncation
    • An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66030
    • GHSA ID: GHSA-65ch-62r8-g69g

Fixed

  • [asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.
  • [asn1] Add fromDer() max recursion depth check.
    • Add a asn1.maxDepth global configurable maximum depth of 256.
    • Add a asn1.fromDer() per-call maxDepth option.
    • NOTE: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.
    • NOTE: The per-call maxDepth parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default

... (truncated)

Commits

Updates on-headers from 1.0.2 to 1.1.0

Release notes

Sourced from on-headers's releases.

1.1.0

Important

What's Changed

New Contributors

Full Changelog: https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0

Changelog

Sourced from on-headers's changelog.

1.1.0 / 2025-07-17

Commits
  • 4b017af 1.1.0
  • b636f2d ♻️ refactor header array code
  • 3e2c2d4 ✨ ignore falsy header keys, matching node behavior
  • 172eb41 ✨ support duplicate headers
  • c6e3849 🔒️ fix array handling
  • 6893518 💚 update CI - add newer node versions
  • 56a345d ✨ add script to update known hashes
  • 175ab21 👷 add upstream change detection (#31)
  • ce0b2c8 ci: apply OSSF Scorecard security best practices (#20)
  • 1a38c54 fix: use ubuntu-latest as ci runner (#19)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for on-headers since your current version.


You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note


Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the npm_and_yarn group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `19.2.14` | `19.2.16` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `19.2.14` | `19.2.17` | | [@angular/platform-server](https://github.com/angular/angular/tree/HEAD/packages/platform-server) | `19.2.14` | `19.2.16` | | [@angular/ssr](https://github.com/angular/angular-cli) | `19.2.15` | `19.2.19` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.2.7` | `6.4.1` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.3.1` | `1.3.3` | | [on-headers](https://github.com/jshttp/on-headers) | `1.0.2` | `1.1.0` | Updates `@angular/common` from 19.2.14 to 19.2.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases"><code>@​angular/common</code>'s releases</a>.</em></p> <blockquote> <h2>19.2.16</h2> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc"><img src="https://img.shields.io/badge/05fe6686a9-fix-green" alt="fix - 05fe6686a9" /></a></td> <td>prevent XSRF token leakage to protocol-relative URLs</td> </tr> </tbody> </table> <h2>19.2.15</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/70d0639bc19e376af1a0491898f54a026d3227e2"><img src="https://img.shields.io/badge/70d0639bc1-fix-green" alt="fix - 70d0639bc1" /></a></td> <td>introduce <code>BootstrapContext</code> for improved server bootstrapping (<a href="https://github.com/angular/angular/tree/HEAD/packages/common/issues/63639">#63639</a>)</td> </tr> </tbody> </table> <h2>Breaking Changes</h2> <h3>core</h3> <ul> <li> <p>The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.</p> <p>Before:</p> <pre lang="ts"><code>const bootstrap = () =&gt; bootstrapApplication(AppComponent, config); </code></pre> <p>After:</p> <pre lang="ts"><code>const bootstrap = (context: BootstrapContext) =&gt; bootstrapApplication(AppComponent, config, context); </code></pre> <p>A schematic is provided to automatically update <code>main.server.ts</code> files to pass the <code>BootstrapContext</code> to the <code>bootstrapApplication</code> call.</p> <p>In addition, <code>getPlatform()</code> and <code>destroyPlatform()</code> will now return <code>null</code> and be a no-op respectively when running in a server environment.</p> </li> </ul> <p>For more information please see: <a href="https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7">https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md"><code>@​angular/common</code>'s changelog</a>.</em></p> <blockquote> <h1>19.2.16 (2025-11-26)</h1> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc">05fe6686a9</a></td> <td>fix</td> <td>prevent XSRF token leakage to protocol-relative URLs</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>21.1.0-next.0 (2025-11-25)</h1> <h3>platform-browser</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ec9dc94ceeb3c026c64e01c6889b7f5c6fd25a66">ec9dc94cee</a></td> <td>feat</td> <td>add <code>context</code> to <code>createApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ab67988d2e5242eff0034483f984428d684acd02">ab67988d2e</a></td> <td>feat</td> <td>resolve JIT resources in <code>createApplication</code></td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a03c82564da6824e199ff48d5249ea8708040951">a03c82564d</a></td> <td>feat</td> <td>Add scroll behavior controls on router navigation</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c25d749d85374fff7745980cd9bb2673c661105a">c25d749d85</a></td> <td>feat</td> <td>Execute RunGuardsAndResolvers function in injection context</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c84d37277874cf7cbd7582a295d796ff113b9cc1">c84d372778</a></td> <td>feat</td> <td>Support wildcard params with segments trailing (<a href="https://redirect.github.com/angular/angular/pull/64737">#64737</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.14 (2025-11-25)</h1> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f">0276479e7d</a></td> <td>fix</td> <td>prevent XSRF token leakage to protocol-relative URLs</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>21.0.1 (2025-11-25)</h1> <h3>compiler-cli</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc"><code>05fe668</code></a> fix(http): prevent XSRF token leakage to protocol-relative URLs</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/19.2.16/packages/common">compare view</a></li> </ul> </details> <br /> Updates `@angular/compiler` from 19.2.14 to 19.2.17 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases"><code>@​angular/compiler</code>'s releases</a>.</em></p> <blockquote> <h2>19.2.17</h2> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/7c42e2ebebc135e9949a9e9a0295ef3ccf261b82"><img src="https://img.shields.io/badge/7c42e2ebeb-fix-green" alt="fix - 7c42e2ebeb" /></a></td> <td>prevent XSS via SVG animation <code>attributeName</code> and MathML/SVG URLs</td> </tr> </tbody> </table> <h2>19.2.16</h2> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc"><img src="https://img.shields.io/badge/05fe6686a9-fix-green" alt="fix - 05fe6686a9" /></a></td> <td>prevent XSRF token leakage to protocol-relative URLs</td> </tr> </tbody> </table> <h2>19.2.15</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/70d0639bc19e376af1a0491898f54a026d3227e2"><img src="https://img.shields.io/badge/70d0639bc1-fix-green" alt="fix - 70d0639bc1" /></a></td> <td>introduce <code>BootstrapContext</code> for improved server bootstrapping (<a href="https://github.com/angular/angular/tree/HEAD/packages/compiler/issues/63639">#63639</a>)</td> </tr> </tbody> </table> <h2>Breaking Changes</h2> <h3>core</h3> <ul> <li> <p>The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.</p> <p>Before:</p> <pre lang="ts"><code>const bootstrap = () =&gt; bootstrapApplication(AppComponent, config); </code></pre> <p>After:</p> <pre lang="ts"><code>const bootstrap = (context: BootstrapContext) =&gt; bootstrapApplication(AppComponent, config, context); </code></pre> <p>A schematic is provided to automatically update <code>main.server.ts</code> files to pass the <code>BootstrapContext</code> to the <code>bootstrapApplication</code> call.</p> <p>In addition, <code>getPlatform()</code> and <code>destroyPlatform()</code> will now return <code>null</code> and be a no-op respectively when running in a server environment.</p> </li> </ul> <p>For more information please see: <a href="https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7">https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md"><code>@​angular/compiler</code>'s changelog</a>.</em></p> <blockquote> <h1>19.2.17 (2025-12-01)</h1> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/7c42e2ebebc135e9949a9e9a0295ef3ccf261b82">7c42e2ebeb</a></td> <td>fix</td> <td>prevent XSS via SVG animation <code>attributeName</code> and MathML/SVG URLs</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.16 (2025-11-26)</h1> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc">05fe6686a9</a></td> <td>fix</td> <td>prevent XSRF token leakage to protocol-relative URLs</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>21.1.0-next.0 (2025-11-25)</h1> <h3>platform-browser</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ec9dc94ceeb3c026c64e01c6889b7f5c6fd25a66">ec9dc94cee</a></td> <td>feat</td> <td>add <code>context</code> to <code>createApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ab67988d2e5242eff0034483f984428d684acd02">ab67988d2e</a></td> <td>feat</td> <td>resolve JIT resources in <code>createApplication</code></td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a03c82564da6824e199ff48d5249ea8708040951">a03c82564d</a></td> <td>feat</td> <td>Add scroll behavior controls on router navigation</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c25d749d85374fff7745980cd9bb2673c661105a">c25d749d85</a></td> <td>feat</td> <td>Execute RunGuardsAndResolvers function in injection context</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c84d37277874cf7cbd7582a295d796ff113b9cc1">c84d372778</a></td> <td>feat</td> <td>Support wildcard params with segments trailing (<a href="https://redirect.github.com/angular/angular/pull/64737">#64737</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.14 (2025-11-25)</h1> <h3>http</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/7c42e2ebebc135e9949a9e9a0295ef3ccf261b82"><code>7c42e2e</code></a> fix(compiler): prevent XSS via SVG animation <code>attributeName</code> and MathML/SVG URLs</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/19.2.17/packages/compiler">compare view</a></li> </ul> </details> <br /> Updates `@angular/platform-server` from 19.2.14 to 19.2.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases"><code>@​angular/platform-server</code>'s releases</a>.</em></p> <blockquote> <h2>19.2.16</h2> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc"><img src="https://img.shields.io/badge/05fe6686a9-fix-green" alt="fix - 05fe6686a9" /></a></td> <td>prevent XSRF token leakage to protocol-relative URLs</td> </tr> </tbody> </table> <h2>19.2.15</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/70d0639bc19e376af1a0491898f54a026d3227e2"><img src="https://img.shields.io/badge/70d0639bc1-fix-green" alt="fix - 70d0639bc1" /></a></td> <td>introduce <code>BootstrapContext</code> for improved server bootstrapping (<a href="https://github.com/angular/angular/tree/HEAD/packages/platform-server/issues/63639">#63639</a>)</td> </tr> </tbody> </table> <h2>Breaking Changes</h2> <h3>core</h3> <ul> <li> <p>The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.</p> <p>Before:</p> <pre lang="ts"><code>const bootstrap = () =&gt; bootstrapApplication(AppComponent, config); </code></pre> <p>After:</p> <pre lang="ts"><code>const bootstrap = (context: BootstrapContext) =&gt; bootstrapApplication(AppComponent, config, context); </code></pre> <p>A schematic is provided to automatically update <code>main.server.ts</code> files to pass the <code>BootstrapContext</code> to the <code>bootstrapApplication</code> call.</p> <p>In addition, <code>getPlatform()</code> and <code>destroyPlatform()</code> will now return <code>null</code> and be a no-op respectively when running in a server environment.</p> </li> </ul> <p>For more information please see: <a href="https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7">https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md"><code>@​angular/platform-server</code>'s changelog</a>.</em></p> <blockquote> <h1>19.2.16 (2025-11-26)</h1> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc">05fe6686a9</a></td> <td>fix</td> <td>prevent XSRF token leakage to protocol-relative URLs</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>21.1.0-next.0 (2025-11-25)</h1> <h3>platform-browser</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ec9dc94ceeb3c026c64e01c6889b7f5c6fd25a66">ec9dc94cee</a></td> <td>feat</td> <td>add <code>context</code> to <code>createApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ab67988d2e5242eff0034483f984428d684acd02">ab67988d2e</a></td> <td>feat</td> <td>resolve JIT resources in <code>createApplication</code></td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a03c82564da6824e199ff48d5249ea8708040951">a03c82564d</a></td> <td>feat</td> <td>Add scroll behavior controls on router navigation</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c25d749d85374fff7745980cd9bb2673c661105a">c25d749d85</a></td> <td>feat</td> <td>Execute RunGuardsAndResolvers function in injection context</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c84d37277874cf7cbd7582a295d796ff113b9cc1">c84d372778</a></td> <td>feat</td> <td>Support wildcard params with segments trailing (<a href="https://redirect.github.com/angular/angular/pull/64737">#64737</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.14 (2025-11-25)</h1> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f">0276479e7d</a></td> <td>fix</td> <td>prevent XSRF token leakage to protocol-relative URLs</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>21.0.1 (2025-11-25)</h1> <h3>compiler-cli</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/70d0639bc19e376af1a0491898f54a026d3227e2"><code>70d0639</code></a> fix(core): introduce <code>BootstrapContext</code> for improved server bootstrapping (<a href="https://github.com/angular/angular/tree/HEAD/packages/platform-server/issues/6">#6</a>...</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/19.2.16/packages/platform-server">compare view</a></li> </ul> </details> <br /> Updates `@angular/ssr` from 19.2.15 to 19.2.19 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular-cli/releases"><code>@​angular/ssr</code>'s releases</a>.</em></p> <blockquote> <h2>19.2.19</h2> <h3><code>@​angular/build</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/4d8ea27a1726709b8398a26915395e7611571dae"><img src="https://img.shields.io/badge/4d8ea27a1-fix-green" alt="fix - 4d8ea27a1" /></a></td> <td>update vite to v6.4.1</td> </tr> </tbody> </table> <h2>19.2.18</h2> <h3><code>@​angular/ssr</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/9136a5d1302bb224ea245460ae29474bd2a3a10b"><img src="https://img.shields.io/badge/9136a5d13-fix-green" alt="fix - 9136a5d13" /></a></td> <td>prevent malicious URL from overriding host</td> </tr> </tbody> </table> <h2>19.2.17</h2> <h3><code>@​angular/build</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/365d525b596b437ad0b1a74b1417eaae6aa8694e"><img src="https://img.shields.io/badge/365d525b5-fix-green" alt="fix - 365d525b5" /></a></td> <td>update <code>vite</code> to <code>6.3.6</code></td> </tr> </tbody> </table> <h2>19.2.16</h2> <h3><code>@​angular-devkit/build-angular</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/b0f4330a9a2f598b71f12d07e49b6c7c6891febd"><img src="https://img.shields.io/badge/b0f4330a9-fix-green" alt="fix - b0f4330a9" /></a></td> <td>avoid extra tick in SSR builds</td> </tr> </tbody> </table> <h3><code>@​angular/build</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/ee5c5f823c87a36c9bcb92db2fc9b4e652dc16c2"><img src="https://img.shields.io/badge/ee5c5f823-fix-green" alt="fix - ee5c5f823" /></a></td> <td>avoid extra tick in SSR dev-server builds</td> </tr> </tbody> </table> <h3><code>@​angular/ssr</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/32980f7e7a5821bc9bd311dda6e134970e735722"><img src="https://img.shields.io/badge/32980f7e7-feat-blue" alt="feat - 32980f7e7" /></a></td> <td>introduce BootstrapContext for isolated server-side rendering</td> </tr> </tbody> </table> <h2>Breaking Changes</h2> <h3><code>@​angular/ssr</code></h3> <ul> <li> <p>The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.</p> <p>Before:</p> <pre lang="ts"><code>const bootstrap = () =&gt; bootstrapApplication(AppComponent, config); </code></pre> <p>After:</p> <pre lang="ts"><code>const bootstrap = (context: BootstrapContext) =&gt; bootstrapApplication(AppComponent, config, context); </code></pre> </li> </ul> <p>For more information please see: <a href="https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7">https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular-cli/blob/main/CHANGELOG.md"><code>@​angular/ssr</code>'s changelog</a>.</em></p> <blockquote> <h1>19.2.19 (2025-10-29)</h1> <h3><code>@​angular/build</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/4d8ea27a1726709b8398a26915395e7611571dae">4d8ea27a1</a></td> <td>fix</td> <td>update vite to v6.4.1</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.7 (2025-10-22)</h1> <h3><code>@​angular-devkit/schematics</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/a31533cf492048f62a41b9c09e53779269ee172d">a31533cf4</a></td> <td>fix</td> <td>respect <code>--force</code> option when schematic contains <code>host.create</code></td> </tr> </tbody> </table> <h3><code>@​angular/build</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/8cdda111cc0b343aa5eb6a7ccbad93302a543226">8cdda111c</a></td> <td>fix</td> <td>resolve Angular locale data namespace in esbuild</td> </tr> <tr> <td><a href="https://github.com/angular/angular-cli/commit/5847ccc545e54eb77a78b2435db7970faf748156">5847ccc54</a></td> <td>fix</td> <td>update <code>vite</code> to <code>7.11.1</code></td> </tr> </tbody> </table> <h3><code>@​angular/ssr</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/3a28fb6a13061215b881c49232db979fc3c2f641">3a28fb6a1</a></td> <td>fix</td> <td>correctly handle routes with matrix parameters</td> </tr> <tr> <td><a href="https://github.com/angular/angular-cli/commit/5db6d64870c7ce0b883722a07c828946b7d2217d">5db6d6487</a></td> <td>fix</td> <td>ensure server-side navigation triggers a redirect</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.6 (2025-10-15)</h1> <h3><code>@​angular/ssr</code></h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb">5271547c8</a></td> <td>fix</td> <td>prevent malicious URL from overriding host</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular-cli/commit/399c3ec2f2242ba21bb30275a6142d1f00e5cb8f"><code>399c3ec</code></a> release: cut the v19.2.19 release</li> <li><a href="https://github.com/angular/angular-cli/commit/4d8ea27a1726709b8398a26915395e7611571dae"><code>4d8ea27</code></a> fix(<code>@​angular/build</code>): update vite to v6.4.1</li> <li><a href="https://github.com/angular/angular-cli/commit/8590f19236e2ccc30c0b93c415ee716933628e93"><code>8590f19</code></a> release: cut the v19.2.18 release</li> <li><a href="https://github.com/angular/angular-cli/commit/9136a5d1302bb224ea245460ae29474bd2a3a10b"><code>9136a5d</code></a> fix(<code>@​angular/ssr</code>): prevent malicious URL from overriding host</li> <li><a href="https://github.com/angular/angular-cli/commit/12b0a1f26f7f37dfa3628820e96511851ff54969"><code>12b0a1f</code></a> release: cut the v19.2.17 release</li> <li><a href="https://github.com/angular/angular-cli/commit/365d525b596b437ad0b1a74b1417eaae6aa8694e"><code>365d525</code></a> fix(<code>@​angular/build</code>): update <code>vite</code> to <code>6.3.6</code></li> <li><a href="https://github.com/angular/angular-cli/commit/3ea403a5d9d39229ffb86c2ab8ed8ec545fc9a41"><code>3ea403a</code></a> ci: several CI fixes</li> <li><a href="https://github.com/angular/angular-cli/commit/fe9ea0d285e0281f788f18ab49311201576029ba"><code>fe9ea0d</code></a> release: cut the v19.2.16 release</li> <li><a href="https://github.com/angular/angular-cli/commit/c4278aa02f3a085ba7100bbbff3f94aab926d7c3"><code>c4278aa</code></a> build: update Angular FW packages to latest patch</li> <li><a href="https://github.com/angular/angular-cli/commit/ee5c5f823c87a36c9bcb92db2fc9b4e652dc16c2"><code>ee5c5f8</code></a> fix(<code>@​angular/build</code>): avoid extra tick in SSR dev-server builds</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular-cli/compare/19.2.15...19.2.19">compare view</a></li> </ul> </details> <br /> Updates `vite` from 6.2.7 to 6.4.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>create-vite@6.4.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@6.4.1/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.4.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.4.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>create-vite@6.4.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@6.4.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.4.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.4.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.0-beta.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.0-beta.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.0-beta.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.0-beta.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/a7349ef31e3c2d7d9889ca629d43935745b7044e"><code>a7349ef</code></a> release: v6.3.1</li> <li><a href="https://github.com/vitejs/vite/commit/a152b7cbac72e05668f8fc23074d531ecebb77a5"><code>a152b7c</code></a> fix: backward compat for internal plugin <code>transform</code> calls (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19878">#19878</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/35c7f35e2b67f2158ededf2af58ecec53b3f16c5"><code>35c7f35</code></a> fix: avoid using <code>Promise.allSettled</code> in preload function (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19805">#19805</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/5fdcfe77a93ca7bc90a5427a2a20eceaee1c4da1"><code>5fdcfe7</code></a> release: v6.3.0</li> <li><a href="https://github.com/vitejs/vite/commit/d4ee5e8655a85f4d6bebc695b063d69406ab53ac"><code>d4ee5e8</code></a> fix(hmr): avoid infinite loop happening with <code>hot.invalidate</code> in circular dep...</li> <li><a href="https://github.com/vitejs/vite/commit/50034340401b4043bb0b158f18ffb7ae1b7f5c86"><code>5003434</code></a> fix(preview): use host url to open browser (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19836">#19836</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/bf9728e79e8df905de457e15001e65e33cf13f0e"><code>bf9728e</code></a> release: v6.3.0-beta.2</li> <li><a href="https://github.com/vitejs/vite/commit/380c10e665e78ef732a8d7b6c8f60a1226fc4c3b"><code>380c10e</code></a> fix(hmr): run HMR handler sequentially (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19793">#19793</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/8bed1de5710f2a097af0e22a196545446d98f988"><code>8bed1de</code></a> fix: addWatchFile doesn't work if base is specified (fixes <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19792">#19792</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19794">#19794</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/0a0c50a7ed38017469ed6dcec941c2d8d0efd0d0"><code>0a0c50a</code></a> refactor: simplify pluginFilter implementation (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19828">#19828</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/create-vite@6.4.1/packages/vite">compare view</a></li> </ul> </details> <br /> Updates `js-yaml` from 4.1.0 to 4.1.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>[4.1.1] - 2025-11-12</h2> <h3>Security</h3> <ul> <li>Fix prototype pollution issue in yaml merge (&lt;&lt;) operator.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/cc482e775913e6625137572a3712d2826170e53a"><code>cc482e7</code></a> 4.1.1 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/50968b862e75866ef90e626572fe0b2f97b55f9f"><code>50968b8</code></a> dist rebuild</li> <li><a href="https://github.com/nodeca/js-yaml/commit/d092d866031751cb27c12d93f3e2470ad74d678b"><code>d092d86</code></a> lint fix</li> <li><a href="https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879"><code>383665f</code></a> fix prototype pollution in merge (&lt;&lt;)</li> <li><a href="https://github.com/nodeca/js-yaml/commit/0d3ca7a27b03a6c974790a30a89e456007d62976"><code>0d3ca7a</code></a> README.md: HTTP =&gt; HTTPS (<a href="https://redirect.github.com/nodeca/js-yaml/issues/678">#678</a>)</li> <li><a href="https://github.com/nodeca/js-yaml/commit/49baadd52af887d2991e2c39a6639baa56d6c71b"><code>49baadd</code></a> doc: 'empty' style option for !!null</li> <li><a href="https://github.com/nodeca/js-yaml/commit/ba3460eb9d3e4478edcbc29edabe17c2157fc9ce"><code>ba3460e</code></a> Fix demo link (<a href="https://redirect.github.com/nodeca/js-yaml/issues/618">#618</a>)</li> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/compare/4.1.0...4.1.1">compare view</a></li> </ul> </details> <br /> Updates `node-forge` from 1.3.1 to 1.3.3 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md">node-forge's changelog</a>.</em></p> <blockquote> <h2>1.3.3 - 2025-12-02</h2> <h3>Fixed</h3> <ul> <li>[pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.</li> </ul> <h2>1.3.2 - 2025-11-25</h2> <h3>Security</h3> <ul> <li><strong>HIGH</strong>: ASN.1 Validator Desynchronization <ul> <li>An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.</li> <li>Reported by Hunter Wodzenski.</li> <li>CVE ID: <a href="https://www.cve.org/CVERecord?id=CVE-2025-12816">CVE-2025-12816</a></li> <li>GHSA ID: <a href="https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq">GHSA-5gfm-wpxj-wjgq</a></li> </ul> </li> <li><strong>HIGH</strong>: ASN.1 Unbounded Recursion <ul> <li>An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.</li> <li>Reported by Hunter Wodzenski.</li> <li>CVE ID: <a href="https://www.cve.org/CVERecord?id=CVE-2025-66031">CVE-2025-66031</a></li> <li>GHSA ID: <a href="https://github.com/digitalbazaar/forge/security/advisories/GHSA-554w-wpv2-vw27">GHSA-554w-wpv2-vw27</a></li> </ul> </li> <li><strong>MODERATE</strong>: ASN.1 OID Integer Truncation <ul> <li>An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.</li> <li>Reported by Hunter Wodzenski.</li> <li>CVE ID: <a href="https://www.cve.org/CVERecord?id=CVE-2025-66030">CVE-2025-66030</a></li> <li>GHSA ID: <a href="https://github.com/digitalbazaar/forge/security/advisories/GHSA-65ch-62r8-g69g">GHSA-65ch-62r8-g69g</a></li> </ul> </li> </ul> <h3>Fixed</h3> <ul> <li>[asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.</li> <li>[asn1] Add <code>fromDer()</code> max recursion depth check. <ul> <li>Add a <code>asn1.maxDepth</code> global configurable maximum depth of 256.</li> <li>Add a <code>asn1.fromDer()</code> per-call <code>maxDepth</code> option.</li> <li><strong>NOTE</strong>: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.</li> <li><strong>NOTE</strong>: The per-call <code>maxDepth</code> parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/digitalbazaar/forge/commit/1cea0aff4901589ae86e314f25782bbe312f9f69"><code>1cea0af</code></a> Release 1.3.3.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/5265989cf5e54cfe1e27a10d71523007ce0507b1"><code>5265989</code></a> Update changelog.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/e4f3961406395dd8e985dcf841852ceca73ac3a9"><code>e4f3961</code></a> Fix changelog for release.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/503979b0295cf633a30199d6bd937f4a222481a0"><code>503979b</code></a> Update changelog.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/c3b3b32a8c157ac57752934d3af63b5f798b58b8"><code>c3b3b32</code></a> Make digestAlgorithm parameters optional</li> <li><a href="https://github.com/digitalbazaar/forge/commit/6f70043a6db1abb9f3304f3d432efed3ba50fcca"><code>6f70043</code></a> Update CVE details.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/f547b0d292745094190ecb250429d21e8804a375"><code>f547b0d</code></a> Start 1.3.3-0.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/235ad3e70e4fdfdca4fdeb662dfba6588e2c38bd"><code>235ad3e</code></a> Release 1.3.2.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/25982441171dc9815c87d3d886c5c8a1d092b334"><code>2598244</code></a> Update changelog.</li> <li><a href="https://github.com/digitalbazaar/forge/commit/0032dd0be8b6fb1b1092ef754d1dde91c10a95ad"><code>0032dd0</code></a> Fix typos.</li> <li>Additional commits viewable in <a href="https://github.com/digitalbazaar/forge/compare/v1.3.1...v1.3.3">compare view</a></li> </ul> </details> <br /> Updates `on-headers` from 1.0.2 to 1.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jshttp/on-headers/releases">on-headers's releases</a>.</em></p> <blockquote> <h2>1.1.0</h2> <h2>Important</h2> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2025-7339">CVE-2025-7339</a> (<a href="https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q">GHSA-76c9-3jph-rj3q</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>Migrate CI pipeline to GitHub actions by <a href="https://github.com/carpasse"><code>@​carpasse</code></a> in <a href="https://redirect.github.com/jshttp/on-headers/pull/12">jshttp/on-headers#12</a></li> <li>fix README.md badges by <a href="https://github.com/carpasse"><code>@​carpasse</code></a> in <a href="https://redirect.github.com/jshttp/on-headers/pull/13">jshttp/on-headers#13</a></li> <li>add OSSF scorecard action by <a href="https://github.com/carpasse"><code>@​carpasse</code></a> in <a href="https://redirect.github.com/jshttp/on-headers/pull/14">jshttp/on-headers#14</a></li> <li>fix: use <code>ubuntu-latest</code> as ci runner by <a href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a> in <a href="https://redirect.github.com/jshttp/on-headers/pull/19">jshttp/on-headers#19</a></li> <li>ci: apply OSSF Scorecard security best practices by <a href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a> in <a href="https://redirect.github.com/jshttp/on-headers/pull/20">jshttp/on-headers#20</a></li> <li>👷 add upstream change detection by <a href="https://github.com/ctcpip"><code>@​ctcpip</code></a> in <a href="https://redirect.github.com/jshttp/on-headers/pull/31">jshttp/on-headers#31</a></li> <li>✨ add script to update known hashes by <a href="https://github.com/ctcpip"><code>@​ctcpip</code></a> in <a href="https://redirect.github.com/jshttp/on-headers/pull/32">jshttp/on-headers#32</a></li> <li>💚 update CI - add newer node versions by <a href="https://github.com/ctcpip"><code>@​ctcpip</code></a> in <a href="https://redirect.github.com/jshttp/on-headers/pull/33">jshttp/on-headers#33</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/carpasse"><code>@​carpasse</code></a> made their first contribution in <a href="https://redirect.github.com/jshttp/on-headers/pull/12">jshttp/on-headers#12</a></li> <li><a href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a> made their first contribution in <a href="https://redirect.github.com/jshttp/on-headers/pull/19">jshttp/on-headers#19</a></li> <li><a href="https://github.com/ctcpip"><code>@​ctcpip</code></a> made their first contribution in <a href="https://redirect.github.com/jshttp/on-headers/pull/31">jshttp/on-headers#31</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0">https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jshttp/on-headers/blob/master/HISTORY.md">on-headers's changelog</a>.</em></p> <blockquote> <h1>1.1.0 / 2025-07-17</h1> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2025-7339">CVE-2025-7339</a> (<a href="https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q">GHSA-76c9-3jph-rj3q</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jshttp/on-headers/commit/4b017af88f5375bbdf3ad2ee732d2c122e4f52b0"><code>4b017af</code></a> 1.1.0</li> <li><a href="https://github.com/jshttp/on-headers/commit/b636f2d08e6c1e0a784b53a13cd61e05c09bb118"><code>b636f2d</code></a> ♻️ refactor header array code</li> <li><a href="https://github.com/jshttp/on-headers/commit/3e2c2d46c3e9592f6a1c3a3a1dbe622401f95d39"><code>3e2c2d4</code></a> ✨ ignore falsy header keys, matching node behavior</li> <li><a href="https://github.com/jshttp/on-headers/commit/172eb41b99a5a290b27a2c43fe602ca33aa1c8ce"><code>172eb41</code></a> ✨ support duplicate headers</li> <li><a href="https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867"><code>c6e3849</code></a> 🔒️ fix array handling</li> <li><a href="https://github.com/jshttp/on-headers/commit/6893518341bb4e5363285df086b3158302d3b216"><code>6893518</code></a> 💚 update CI - add newer node versions</li> <li><a href="https://github.com/jshttp/on-headers/commit/56a345d82b51a0dcb8d09f061f87b1fd1dc4c01e"><code>56a345d</code></a> ✨ add script to update known hashes</li> <li><a href="https://github.com/jshttp/on-headers/commit/175ab217155d525371a5416ff059f895a3a532a6"><code>175ab21</code></a> 👷 add upstream change detection (<a href="https://redirect.github.com/jshttp/on-headers/issues/31">#31</a>)</li> <li><a href="https://github.com/jshttp/on-headers/commit/ce0b2c8fcd313d38d3534fb731050dc16e105bf6"><code>ce0b2c8</code></a> ci: apply OSSF Scorecard security best practices (<a href="https://redirect.github.com/jshttp/on-headers/issues/20">#20</a>)</li> <li><a href="https://github.com/jshttp/on-headers/commit/1a38c543e75cd06217b449531de10b1758e35299"><code>1a38c54</code></a> fix: use <code>ubuntu-latest</code> as ci runner (<a href="https://redirect.github.com/jshttp/on-headers/issues/19">#19</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~ulisesgascon">ulisesgascon</a>, a new releaser for on-headers since your current version.</p> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/FrauJulian/Personal-Portfolio-Website/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
This pull request has changes conflicting with the target branch.
  • package-lock.json
  • package.json
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin dependabot/npm_and_yarn/npm_and_yarn-ff37f5454c:dependabot/npm_and_yarn/npm_and_yarn-ff37f5454c
git checkout dependabot/npm_and_yarn/npm_and_yarn-ff37f5454c
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
fraujulian (Julian Lechner)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fraujulian/Personal-Portfolio-Website#10