Bump the npm_and_yarn group across 2 directories with 13 updates by dependabot[bot] · Pull Request #3 · ewdlop/Apps

dependabot · 2026-02-27T23:01:19Z

Bumps the npm_and_yarn group with 7 updates in the /angular-material-app directory:

Package	From	To
@angular/common	`20.0.0`	`20.3.14`
@angular/compiler	`20.0.0`	`20.3.16`
@angular/core	`20.0.0`	`20.3.17`
playwright	`1.52.0`	`1.58.2`
qs	`6.13.0`	`6.14.2`
tar	`6.2.1`	`7.5.9`
lodash	`4.17.21`	`4.17.23`

Bumps the npm_and_yarn group with 6 updates in the /express-backend directory:

Package	From	To
qs	`6.14.0`	`6.15.0`
body-parser	`2.2.0`	`2.2.2`
lodash	`4.17.21`	`4.17.23`
jws	`3.2.2`	`3.2.3`
on-headers	`1.0.2`	`1.1.0`
validator	`13.12.0`	`13.15.26`

Updates @angular/common from 20.0.0 to 20.3.14

Release notes

Sourced from @angular/common's releases.

20.3.14

http

Commit Description

prevent XSRF token leakage to protocol-relative URLs

20.3.13

No release notes provided.

20.3.12

No release notes provided.

20.3.11

common

Commit Description

remove placeholder image listeners once view is removed

compiler

Commit Description

support arbitrary nesting in :host-context()

support commas in :host() argument

support complex selectors in :nth-child()

support one additional level of nesting in :host()

core

Commit Description

skip leave animations on view swaps

20.3.10

compiler-cli

Commit Description

make required inputs diagnostic less noisy

migrations

Commit Description

Prevent removal of templates referenced with preceding whitespace characters

20.3.9

No release notes provided.

20.3.8

common

Commit Description

Blocks IPv6 localhost from preconnect checks

core

Commit Description

... (truncated)

Changelog

Sourced from @angular/common's changelog.

20.3.14 (2025-11-25)

http

Commit Type Description

0276479e7d fix prevent XSRF token leakage to protocol-relative URLs

21.0.1 (2025-11-25)

compiler-cli

Commit Type Description

39c577bc36 fix do not type check native controls with ControlValueAccessor

8d3a89a477 fix escape angular control flow in jsdoc

bc34083d34 fix ignore non-existent files

core

Commit Type Description

0ea1e07174 fix apply bootstrap-options migration to platformBrowserDynamic

70507b8c1c fix debug data causing memory leak for root effects

a55482fca3 fix notify profiler events in case of errors

49ad7c6508 fix use injected DOCUMENT for CSP_NONCE

cc1ec09931 perf avoid repeat searches for field directive

forms

Commit Type Description

7d5c7cf99a feat add DI option for classes on Field directive

8acf5d2756 fix allow dynamic type bindings on signal form controls

de5fca94c5 fix run reset as untracked

http

Commit Type Description

3240d856d9 fix prevent XSRF token leakage to protocol-relative URLs

migrations

Commit Type Description

... (truncated)

Commits

0276479 fix(http): prevent XSRF token leakage to protocol-relative URLs
a8c577d docs: add reference to Built-in Pipes in multiple pipe files
8922cae Revert "refactor(http): migrate XSRF classes to use inject() function"
5047849 fix(common): remove placeholder image listeners once view is removed
4c66fe4 refactor(core): mark VERSION as @__PURE__ for better tree-shaking
2ad6b72 refactor(http): migrate XSRF classes to use inject() function
ee578d3 build: format md files
744cd5c refactor(http): simplifies destruction tracking using destroyed property
5ce9d88 docs: Adds guide links to HTTP API docs for better discoverability
020f176 feat(common): Blocks IPv6 localhost from preconnect checks
Additional commits viewable in compare view

Updates @angular/compiler from 20.0.0 to 20.3.16

Release notes

Sourced from @angular/compiler's releases.

20.3.16

core

Commit Description

sanitize sensitive attributes on SVG script elements

20.3.15

compiler

Commit Description

prevent XSS via SVG animation attributeName and MathML/SVG URLs

20.3.14

http

Commit Description

prevent XSRF token leakage to protocol-relative URLs

20.3.13

No release notes provided.

20.3.12

No release notes provided.

20.3.11

common

Commit Description

remove placeholder image listeners once view is removed

compiler

Commit Description

support arbitrary nesting in :host-context()

support commas in :host() argument

support complex selectors in :nth-child()

support one additional level of nesting in :host()

core

Commit Description

skip leave animations on view swaps

20.3.10

compiler-cli

Commit Description

make required inputs diagnostic less noisy

migrations

Commit Description

Prevent removal of templates referenced with preceding whitespace characters

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

20.3.16 (2026-01-07)

core

Commit Type Description

c2c2b4aaa8 fix sanitize sensitive attributes on SVG script elements

19.2.18 (2026-01-07)

core

Commit Type Description

26cdc53d9c fix sanitize sensitive attributes on SVG script elements

21.0.7 (2026-01-07)

compiler

Commit Type Description

8e808740c9 fix better types for a few expression AST nodes

63b1cdcf70 fix produce accurate span for typeof and void expressions

3c3ae0cb64 fix provide location information for literal map keys

523dbaf1c3 fix stop ThisReceiver inheritance from ImplicitReceiver

compiler-cli

Commit Type Description

4d9c4567ed fix ensure component import diagnostics are reported within the imports expression

cd405685af fix fix up spelling of diagnostic

778460fcca fix support qualified names in typeof type references

core

Commit Type Description

7c74674eb0 fix avoid leaking view data in animations

0edbee4550 fix explicitly cast signal node value to String

f9c29572d2 fix sanitize sensitive attributes on SVG script elements

forms

Commit Type Description

e3fba182f9 feat add [formField] directive

561772b152 fix allow custom controls to require dirty input

f0fb1d8581 fix allow custom controls to require hidden input

ec110f170b fix allow custom controls to require pending input

ae1dc16bb0 fix clean up abort listener after timeout

9748b0d5da fix support custom controls with non signal-based models

6bd22df987 fix Support readonly arrays in signal forms

router

| Commit | Type | Description |

... (truncated)

Commits

c2c2b4a fix(core): sanitize sensitive attributes on SVG script elements
d1ca8ae fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
f689269 Revert "fix(compiler): support one additional level of nesting in :host()"
7b2e6ca Revert "fix(compiler): support arbitrary nesting in :host-context()"
6036eef Revert "fix(compiler): support commas in :host() argument"
a44658b Revert "fix(compiler): support complex selectors in :nth-child()"
9419ea3 fix(compiler): support complex selectors in :nth-child()
2531863 test(compiler): add test for :host:has(> .foo)
106b904 fix(compiler): support commas in :host() argument
f9d0818 fix(compiler): support arbitrary nesting in :host-context()
Additional commits viewable in compare view

Updates @angular/core from 20.0.0 to 20.3.17

Release notes

Sourced from @angular/core's releases.

20.3.17

core

Commit Description

block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

(cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

20.3.16

core

Commit Description

sanitize sensitive attributes on SVG script elements

20.3.15

compiler

Commit Description

prevent XSS via SVG animation attributeName and MathML/SVG URLs

20.3.14

http

Commit Description

prevent XSRF token leakage to protocol-relative URLs

20.3.13

No release notes provided.

20.3.12

No release notes provided.

20.3.11

common

Commit Description

remove placeholder image listeners once view is removed

compiler

Commit Description

support arbitrary nesting in :host-context()

support commas in :host() argument

support complex selectors in :nth-child()

support one additional level of nesting in :host()

core

Commit Description

... (truncated)

Changelog

Sourced from @angular/core's changelog.

20.3.17 (2026-02-25)

Breaking Changes

core

Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

(cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

core

Commit Type Description

7f9de3c118 fix block creation of sensitive URI attributes from ICU messages

21.2.0 (2026-02-25)

common

Commit Type Description

18003a33bb feat add an 'outlet' injector option for ngTemplateOutlet

8bbe6dc46c feat Add Location strategies to manage trailing slash on write

51cc914807 feat support height in ImageLoaderConfig and built-in loaders

compiler

Commit Type Description

72534e2a34 feat Add support for the instanceof binary operator

95b3f37d4a feat Exhaustive checks for switch blocks

04ba09a8d9 feat support AstVisitor.visitEmptyExpr()

ce80136e7b fix optimize away unnecessary restore/reset view calls

3242a61bae fix variable counter visiting some expressions twice

compiler-cli

Commit Type Description

473dd3e1cb fix attach source spans to object literal keys in TCB

a904d9f77b fix support nested component declaration

2ea6dfc6c9 fix update diagnostic to flag no-op arrow functions in listeners

core

Commit Type Description

8d5210c9fe feat add ChangeDetectionStrategy.Eager alias for Default

92d2498910 feat add host node to DeferBlockData (#66546)

ea2016a6dc feat add support for nested animations

81cabc1477 feat add support for TypeScript 6

1ba9b7ac50 feat resource composition via snapshots

d9923b72a2 feat support arrow functions in expressions

a7e8abbb7e fix correctly handle SkipSelf when resolving from embedded view injector

0806ee3826 fix prevent animated element duplication with dynamic components in zoneless mode

ed78fa05c7 fix Remove note to skip arrow functions in best practices

forms

Commit Type Description

... (truncated)

Commits

7f9de3c fix(core): block creation of sensitive URI attributes from ICU messages
c2c2b4a fix(core): sanitize sensitive attributes on SVG script elements
d1ca8ae fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
820bb39 Revert "refactor(core): let the profiler handle asymmetric events leniently"
2dccdcd Revert "fix(core): notify profiler events in case of errors"
a966ff1 refactor(core): let the profiler handle asymmetric events leniently
52cf658 fix(core): notify profiler events in case of errors
daae263 docs: Adds links to relevant guides for APIs in core package
d10f110 docs: add documentation for HostAttributeToken
2c3691d docs: add documentation for DOCUMENT injection token usage in SSR
Additional commits viewable in compare view

Updates playwright from 1.52.0 to 1.58.2

Release notes

Sourced from playwright's releases.

v1.58.2

Highlights

#39121 fix(trace viewer): make paths via stdin work #39129 fix: do not force swiftshader on chromium mac

Browser Versions

Chromium 145.0.7632.6

Mozilla Firefox 146.0.1

WebKit 26.0

v1.58.1

Highlights

#39036 fix(msedge): fix local network permissions #39037 chore: update cft download location #38995 chore(webkit): disable frame sessions on fronzen builds

Browser Versions

Chromium 145.0.7632.6

Mozilla Firefox 146.0.1

WebKit 26.0

v1.58.0

📣 Playwright CLI+SKILLs 📣

We are adding a new token-efficient CLI mode of operation to Playwright with the skills located at playwright-cli. This brings the long-awaited official SKILL-focused CLI mode to our story and makes it more coding agent-friendly.

It is the first snapshot with the essential command set (which is already larger than the original MCP!), but we expect it to grow rapidly. Unlike the token use, that one we expect to go down since snapshots are no longer forced into the LLM!

Timeline

If you're using merged reports, the HTML report Speedboard tab now shows the Timeline:

UI Mode and Trace Viewer Improvements

New 'system' theme option follows your OS dark/light mode preference

Search functionality (Cmd/Ctrl+F) is now available in code editors

Network details panel has been reorganized for better usability

JSON responses are now automatically formatted for readability

Thanks to @cpAdm for contributing these improvements!

Miscellaneous

browserType.connectOverCDP() now accepts an isLocal option. When set to true, it tells Playwright that it runs on the same host as the CDP server, enabling file system optimizations.

Breaking Changes ⚠️

Removed _react and _vue selectors. See locators guide for alternatives.

... (truncated)

Commits

ce480a9 cherry-pick(#39171): devops: add ubuntu-22.04-arm bot
e40c137 chore: mark v1.58.2 (#39155)
50b7296 cherry-pick(#39152): chore: fix execSync inheriting stdio
f3dcf50 cherry-pick(#39129): fix: do not force swiftshader on chromium mac
8684e08 cherry-pick(#39121): fix(trace viewer): make paths via stdin work
97bc385 cherry-pick(#38995): chore(webkit): disable frame sessions on fronzen builds
ad625fe chore: mark v1.58.1 (#39055)
f07234d cherry-pick(#39036): fix(msedge): fix local network permissions (#39053)
ab8136c cherry-pick(#39037): chore: update cft download location (#39052)
aa6ffeb cherry-pick(#39014): docs: add 1.58 release notes for Java, Python, and C#
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for playwright since your current version.

Updates qs from 6.13.0 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

6.14.1

[Fix] ensure arrayLimit applies to [] notation as well

[Fix] parse: when a custom decoder returns null for a key, ignore that key

[Refactor] parse: extract key segment splitting helper

[meta] add threat model

[actions] add workflow permissions

[Tests] stringify: increase coverage

[Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

6.14.0

[New] parse: add throwOnParameterLimitExceeded option (#517)

[Refactor] parse: use utils.combine more

[patch] parse: add explicit throwOnLimitExceeded default

[actions] use shared action; re-add finishers

[meta] Fix changelog formatting bug

[Deps] update side-channel

[Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols

[Tests] increase coverage

6.13.3

[Fix] fix regressions from robustness refactor [actions] update reusable workflows

6.13.2

[Robustness] avoid .push, use void

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] replace runkit CI badge with shields.io check-runs badge

[actions] fix rebase workflow permissions

6.13.1

[Fix] stringify: avoid a crash when a filter key is null

[Fix] utils.merge: functions should not be stringified into keys

[Fix] parse: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset

[Fix] stringify: ensure a non-string filter does not crash

[Refactor] use __proto__ syntax instead of Object.create for null objects

[Refactor] misc cleanup

... (truncated)

Commits

bdcf0c7 v6.14.2
294db90 [readme] document that addQueryPrefix does not add ? to empty output
5c308e5 [readme] clarify parseArrays and arrayLimit documentation
6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
1b9a8b4 [actions] fix rebase workflow permissions
2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
Additional commits viewable in compare view

Updates tar from 6.2.1 to 7.5.9

Changelog

Sourced from tar's changelog.

Changelog

7.5

Added zstd compression support.

Consistent TOCTOU behavior in sync t.list

Only read from ustar block if not specified in Pax

Fix sync tar.list when file size reduces while reading

Sanitize absolute linkpaths properly

Prevent writing hardlink entries to the archive ahead of their file target

7.4

Deprecate onentry in favor of onReadEntry for clarity.

7.3

Add onWriteEntry option

7.2

DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

Update minipass to v7.1.0

Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

Drop support for node <18

Rewrite in TypeScript, provide ESM and CommonJS hybrid interface

Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.

Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.

Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

1f0c2c9 7.5.9
fbb0851 build minified version as default export
6b8eba0 7.5.8
2cb1120 fix(unpack): improve UnpackSync symlink error "into" path accuracy
d18e4e1 fix: do not write linkpaths through symlinks
4a37eb9 7.5.7
f4a7aa9 fix: properly sanitize hard links containing ..
394ece6 7.5.6
7d4cc17 fix race puting a Link ahead of its target File
26ab904 7.5.5
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates tmp from 0.0.33 to 0.2.3

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

#278 Closes #268: Revert "fix #246: remove any double quotes or single quotes… (@mbargiel)

📝 Documentation

#279 Closes #266: move paragraph on graceful cleanup to the head of the documentation (@silkentrance)

Committers: 5

Carsten Klein (@silkentrance)

Dave Nicolson (@dnicolson)

KARASZI István (@raszi)

Maxime Bargiel (@mbargiel)

@robertoaceves

v0.2.1 (2020-04-28)

🚀 Enhancement

#252 Closes #250: introduce tmpdir option for overriding the system tmp dir (@silkentrance)

🏠 Internal

#253 Closes #191: generate changelog from pull requests using lerna-changelog (@silkentrance)

Committers: 1

Carsten Klein (@silkentrance)

v0.2.0 (2020-04-25)

🚀 Enhancement

#234 feat: stabilize tmp for v0.2.0 release (@silkentrance)

🐛 Bug Fix

#231 Closes #230: regression after fix for #197 (@silkentrance)

#220 Closes #197: return sync callback when using the sync interface, otherwise return the async callback (@silkentrance)

#193 Closes #192: tmp must not exit the process on its own (@silkentrance)

📝 Documentation

#221 Gh 206 document name option (@silkentrance)

🏠 Internal

#226 Closes #212: enable direct name option test (@silkentrance)

#225 Closes #211: existing tests must clean up after themselves (@silkentrance)

#224 Closes #217: name tests must use tmpName (@silkentrance)

#223 Closes #214: refactor tests and lib (@silkentrance)

#198 Update dependencies to latest versions (@matsev)

... (truncated)

Commits

5f0b252 Merge pull request #297 from raszi/feat/release-v0.2.3
998eec5 Fix formatting
7a82d1f Add .tool-versions
4057ffa Update changelog
4aba61e Ignore .env
062efbb Add a small note about the compatibility
b8f7d78 Update version
6ed89d5 Merge pull request #296 from kevinoid/drop-rimraf
eafb034 Use fs.rm() instead of rimraf
9fcf3ce Merge pull request #294 from raszi/fix/update-version
Additional commits viewable in compare view

Updates form-data from 4.0.2 to 4.0.5

Release notes

Sourced from form-data's releases.

v4.0.4

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] use a shared config 426ba9a

[eslint] fix some spacing issues 2094191

[Refactor] use hasown 81ab41b

[Fix] validate boundary type in setBoundary() method 8d8e469

[Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1

[Dev Deps] remove unused deps 870e4e6

[meta] remove local commit hooks e6e83cc

[Dev Deps] update eslint 4066fd6

[meta] fix scripts to use prepublishOnly c4bbb13

Changelog

Sourced from form-data's changelog.

v4.0.5 - 2025-11-17

Commits

[Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076

[Dev Deps] update @ljharb/eslint-config, eslint 5822467

[Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] us...
Description has been truncated

Bumps the npm_and_yarn group with 7 updates in the /angular-material-app directory: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `20.0.0` | `20.3.14` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `20.0.0` | `20.3.16` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `20.0.0` | `20.3.17` | | [playwright](https://github.com/microsoft/playwright) | `1.52.0` | `1.58.2` | | [qs](https://github.com/ljharb/qs) | `6.13.0` | `6.14.2` | | [tar](https://github.com/isaacs/node-tar) | `6.2.1` | `7.5.9` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | Bumps the npm_and_yarn group with 6 updates in the /express-backend directory: | Package | From | To | | --- | --- | --- | | [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.15.0` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.0` | `2.2.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [jws](https://github.com/brianloveswords/node-jws) | `3.2.2` | `3.2.3` | | [on-headers](https://github.com/jshttp/on-headers) | `1.0.2` | `1.1.0` | | [validator](https://github.com/validatorjs/validator.js) | `13.12.0` | `13.15.26` | Updates `@angular/common` from 20.0.0 to 20.3.14 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/20.3.14/packages/common) Updates `@angular/compiler` from 20.0.0 to 20.3.16 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.16/packages/compiler) Updates `@angular/core` from 20.0.0 to 20.3.17 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.17/packages/core) Updates `playwright` from 1.52.0 to 1.58.2 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.52.0...v1.58.2) Updates `qs` from 6.13.0 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.14.2) Updates `tar` from 6.2.1 to 7.5.9 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.1...v7.5.9) Updates `tmp` from 0.0.33 to 0.2.3 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.0.33...v0.2.3) Updates `form-data` from 4.0.2 to 4.0.5 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.2...v4.0.5) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `qs` from 6.14.0 to 6.15.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.14.2) Updates `body-parser` from 2.2.0 to 2.2.2 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.0...v2.2.2) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `jws` from 3.2.2 to 3.2.3 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v3.2.2...v3.2.3) Updates `on-headers` from 1.0.2 to 1.1.0 - [Release notes](https://github.com/jshttp/on-headers/releases) - [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md) - [Commits](jshttp/on-headers@v1.0.2...v1.1.0) Updates `validator` from 13.12.0 to 13.15.26 - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@13.12.0...13.15.26) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 20.3.14 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 20.3.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 20.3.17 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: playwright dependency-version: 1.58.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: 0.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jws dependency-version: 3.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: on-headers dependency-version: 1.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: validator dependency-version: 13.15.26 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 2 directories with 13 updates#3

Bump the npm_and_yarn group across 2 directories with 13 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/angular-material-app/npm_and_yarn-18588491df

dependabot Bot commented on behalf of github Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	support arbitrary nesting in :host-context()
	support commas in :host() argument
	support complex selectors in :nth-child()
	support one additional level of nesting in :host()

Commit	Type	Description
39c577bc36	fix	do not type check native controls with ControlValueAccessor
8d3a89a477	fix	escape angular control flow in jsdoc
bc34083d34	fix	ignore non-existent files

Commit	Type	Description
0ea1e07174	fix	apply bootstrap-options migration to `platformBrowserDynamic`
70507b8c1c	fix	debug data causing memory leak for root effects
a55482fca3	fix	notify profiler events in case of errors
49ad7c6508	fix	use injected `DOCUMENT` for `CSP_NONCE`
cc1ec09931	perf	avoid repeat searches for field directive

Commit	Type	Description
7d5c7cf99a	feat	add DI option for classes on `Field` directive
8acf5d2756	fix	allow dynamic `type` bindings on signal form controls
de5fca94c5	fix	run reset as untracked

Commit	Type	Description
8e808740c9	fix	better types for a few expression AST nodes
63b1cdcf70	fix	produce accurate span for typeof and void expressions
3c3ae0cb64	fix	provide location information for literal map keys
523dbaf1c3	fix	stop ThisReceiver inheritance from ImplicitReceiver

Commit	Type	Description
4d9c4567ed	fix	ensure component import diagnostics are reported within the `imports` expression
cd405685af	fix	fix up spelling of diagnostic
778460fcca	fix	support qualified names in `typeof` type references

Commit	Type	Description
7c74674eb0	fix	avoid leaking view data in animations
0edbee4550	fix	explicitly cast signal node value to String
f9c29572d2	fix	sanitize sensitive attributes on SVG script elements

Commit	Type	Description
e3fba182f9	feat	add `[formField]` directive
561772b152	fix	allow custom controls to require `dirty` input
f0fb1d8581	fix	allow custom controls to require `hidden` input
ec110f170b	fix	allow custom controls to require `pending` input
ae1dc16bb0	fix	clean up abort listener after timeout
9748b0d5da	fix	support custom controls with non signal-based models
6bd22df987	fix	Support readonly arrays in signal forms

Commit	Type	Description
18003a33bb	feat	add an 'outlet' injector option for ngTemplateOutlet
8bbe6dc46c	feat	Add Location strategies to manage trailing slash on write
51cc914807	feat	support height in ImageLoaderConfig and built-in loaders

Commit	Type	Description
72534e2a34	feat	Add support for the `instanceof` binary operator
95b3f37d4a	feat	Exhaustive checks for switch blocks
04ba09a8d9	feat	support `AstVisitor.visitEmptyExpr()`
ce80136e7b	fix	optimize away unnecessary restore/reset view calls
3242a61bae	fix	variable counter visiting some expressions twice

Commit	Type	Description
473dd3e1cb	fix	attach source spans to object literal keys in TCB
a904d9f77b	fix	support nested component declaration
2ea6dfc6c9	fix	update diagnostic to flag no-op arrow functions in listeners

Commit	Type	Description
8d5210c9fe	feat	add ChangeDetectionStrategy.Eager alias for Default
92d2498910	feat	add host node to DeferBlockData (#66546)
ea2016a6dc	feat	add support for nested animations
81cabc1477	feat	add support for TypeScript 6
1ba9b7ac50	feat	resource composition via snapshots
d9923b72a2	feat	support arrow functions in expressions
a7e8abbb7e	fix	correctly handle SkipSelf when resolving from embedded view injector
0806ee3826	fix	prevent animated element duplication with dynamic components in zoneless mode
ed78fa05c7	fix	Remove note to skip arrow functions in best practices

Conversation

dependabot Bot commented on behalf of github Feb 27, 2026

20.3.14

http

20.3.13

20.3.12

20.3.11

common

compiler

core

20.3.10

compiler-cli

migrations

20.3.9

20.3.8

common

core

20.3.14 (2025-11-25)

http

21.0.1 (2025-11-25)

compiler-cli

core

forms

http

migrations

20.3.16

core

20.3.15

compiler

20.3.14

http

20.3.13

20.3.12

20.3.11

common

compiler

core

20.3.10

compiler-cli

migrations

20.3.16 (2026-01-07)

core

19.2.18 (2026-01-07)

core

21.0.7 (2026-01-07)

compiler

compiler-cli

core

forms

router

20.3.17

core

Breaking Changes

core

20.3.16

core

20.3.15

compiler

20.3.14

http

20.3.13

20.3.12

20.3.11

common

compiler

core

20.3.17 (2026-02-25)

Breaking Changes

core

core

21.2.0 (2026-02-25)

common

compiler

compiler-cli

core

forms

v1.58.2

Highlights

Browser Versions

v1.58.1