chore(deps): bump @angular/platform-server from 21.2.8 to 21.2.9 #237

2026-04-17T02:21:48+02:00

admin-backup commented

2026-04-17 02:21:48 +02:00

(Migrated from 172.24.0.1:8928)

Bumps @angular/platform-server from 21.2.8 to 21.2.9.

Release notes

Sourced from @angular/platform-server's releases.

21.2.9

core

Commit Description

escape forward slashes in transfer state to prevent crawler indexing

http

Commit Description

add CSP nonce support to JsonpClientBackend

Don't on Passthru outside of reactive context

platform-server

Commit Description

prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Description

normalize multiple leading slashes in URL parser

Changelog

Sourced from @angular/platform-server's changelog.

21.2.9 (2026-04-15)

core

Commit Type Description

f603d4714f fix escape forward slashes in transfer state to prevent crawler indexing

http

Commit Type Description

540536c386 fix add CSP nonce support to JsonpClientBackend

63a857b874 fix Don't on Passthru outside of reactive context

platform-server

Commit Type Description

e0b5078cf2 fix prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Type Description

684e9fd53d fix normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.

TypeScript versions older than 6.0 are no longer supported.

ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.

ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit Type Description

2ce0e98f79 fix handle nested brackets in host object bindings

compiler-cli

Commit Type Description

7f9450219f feat Adds warning for prefetch without main defer trigger

ab061a7610 fix error for type parameter declarations

9218140348 fix resolve TCB mapping failure for safe property reads with as any

core

Commit Type Description

a0aa8304cd feat bootstrap via ApplicationRef with config

9c55fcb3e6 feat de-duplicate host directives

8fe025f514 feat drop support for TypeScript 5.9

77f1ca08e4 fix handle missing serialized container hydration data

... (truncated)

Commits

e0b5078 fix(platform-server): prevent SSRF bypasses via protocol-relative and backsla...
f603d47 fix(core): escape forward slashes in transfer state to prevent crawler indexing
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@angular/platform-server](https://github.com/angular/angular/tree/HEAD/packages/platform-server) from 21.2.8 to 21.2.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases"><code>@angular/platform-server</code>'s releases</a>.</em></p> <blockquote> <h2>21.2.9</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix - f603d4714f" /></a></td> <td>escape forward slashes in transfer state to prevent crawler indexing</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img src="https://img.shields.io/badge/540536c386-fix-green" alt="fix - 540536c386" /></a></td> <td>add CSP nonce support to JsonpClientBackend</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix - 63a857b874" /></a></td> <td>Don't on Passthru outside of reactive context</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix - e0b5078cf2" /></a></td> <td>prevent SSRF bypasses via protocol-relative and backslash URLs</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/684e9fd53daacb9e910f42d98c6017f9e5cb4180"><img src="https://img.shields.io/badge/684e9fd53d-fix-green" alt="fix - 684e9fd53d" /></a></td> <td>normalize multiple leading slashes in URL parser</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md"><code>@angular/platform-server</code>'s changelog</a>.</em></p> <blockquote> <h1>21.2.9 (2026-04-15)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac">f603d4714f</a></td> <td>fix</td> <td>escape forward slashes in transfer state to prevent crawler indexing</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec">540536c386</a></td> <td>fix</td> <td>add CSP nonce support to JsonpClientBackend</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229">63a857b874</a></td> <td>fix</td> <td>Don't on Passthru outside of reactive context</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d">e0b5078cf2</a></td> <td>fix</td> <td>prevent SSRF bypasses via protocol-relative and backslash URLs</td> </tr> </tbody> </table> <h3>router</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/684e9fd53daacb9e910f42d98c6017f9e5cb4180">684e9fd53d</a></td> <td>fix</td> <td>normalize multiple leading slashes in URL parser</td> </tr> </tbody> </table>  <p></p> <h1>22.0.0-next.7 (2026-04-08)</h1> <h2>Breaking Changes</h2> <h3>core</h3> <ul> <li>The second arguement of appRef.bootstrap does not accept <code>any</code> anymore. Make sure the element you pass is not nullable.</li> <li> <ul> <li>TypeScript versions older than 6.0 are no longer supported.</li> </ul> </li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponentFunction</code>.</li> <li><code>ComponentFactoryResolver</code> and <code>ComponentFactory</code> are no longer available. Pass the component class directly to APIs that previously required a factory, such as <code>ViewContainerRef.createComponent</code> or use the standalone <code>createComponent</code> function.</li> </ul> <h3>platform-browser</h3> <ul> <li>This removes styles when they appear to no longer be used by an associated <code>host</code>. However other DOM on the page may still be affected by those styles if not leveraging <code>ViewEncapsulation.Emulated</code> or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.</li> </ul> <h3>router</h3> <ul> <li>The <code>currentSnapshot</code> parameter in <code>CanMatchFn</code> and the <code>canMatch</code> method of the <code>CanMatch</code> interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of <code>CanMatch</code> must now include the third argument to satisfy the interface.</li> </ul> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/2ce0e98f79a02ddc550d00580e8e232cfed3bfb2">2ce0e98f79</a></td> <td>fix</td> <td>handle nested brackets in host object bindings</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/7f9450219f5c30d1ce0a90061864e8c844c8807c">7f9450219f</a></td> <td>feat</td> <td>Adds warning for prefetch without main defer trigger</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/ab061a7610bfcc5aad15fdc2d812085ae3e8d9b1">ab061a7610</a></td> <td>fix</td> <td>error for type parameter declarations</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9218140348cb2e3ad301c1e7f37db4b0cdad4f9d">9218140348</a></td> <td>fix</td> <td>resolve TCB mapping failure for safe property reads with as any</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a0aa8304cd78a58a990c3b648e41f6888b50b1b3">a0aa8304cd</a></td> <td>feat</td> <td>bootstrap via <code>ApplicationRef</code> with config</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9c55fcb3e65ffcde32d7ac438ea40a69ffc2b3b6">9c55fcb3e6</a></td> <td>feat</td> <td>de-duplicate host directives</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/8fe025f5149d7eb460e784a5a17bb467f85b9080">8fe025f514</a></td> <td>feat</td> <td>drop support for TypeScript 5.9</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/77f1ca08e4aa1d1ddd1a8062c602eac0d1044d5a">77f1ca08e4</a></td> <td>fix</td> <td>handle missing serialized container hydration data</td> </tr> </tbody> </table>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><code>e0b5078</code></a> fix(platform-server): prevent SSRF bypasses via protocol-relative and backsla...</li> <li><a href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><code>f603d47</code></a> fix(core): escape forward slashes in transfer state to prevent crawler indexing</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.9/packages/platform-server">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@angular/platform-server&package-manager=npm_and_yarn&previous-version=21.2.8&new-version=21.2.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/THoguet/vac-optimizer/network/alerts). </details>

gitlab-35-mergerequest-159.md

3.8 KiB

gitlab-35-mergerequest-159.json

21 KiB

admin-backup commented

2026-04-17 02:21:58 +02:00

(Migrated from 172.24.0.1:8928)

Merged by: github-actions[bot] at 2026-04-17 00:21:58 UTC

*Merged by: github-actions[bot] at 2026-04-17 00:21:58 UTC*

admin-backup (Migrated from 172.24.0.1:8928) merged commit into main

2026-04-17 02:21:58 +02:00

admin-backup (Migrated from 172.24.0.1:8928) closed this pull request

2026-04-17 02:21:59 +02:00

gitea-emergency commented

2026-10-11 22:11:52 +02:00

Preserved GitLab !159 history: source attribution, exact timestamps, discussion grouping and review positions. Historical diff snapshots: 1; visible source notes: 1.

gitlab-35-mergerequest-159.md (SHA-256 383fdacc1f774ab3fb8bc60aa5d574824a77f5234e4d0e0ba192b7320ef5a82a)

gitlab-35-mergerequest-159.json (SHA-256 80806a6b7ff36ca30f3ea2bf5d95f782d0c876a985adefb5bb42914bc3fe8cf8)

Old CI job execution and reports are omitted. Original source files and rollback backups remain protected.

Preserved GitLab !159 history: source attribution, exact timestamps, discussion grouping and review positions. Historical diff snapshots: 1; visible source notes: 1. [gitlab-35-mergerequest-159.md](https://gitea.nessar.fr/attachments/1b880d4e-163f-4da6-8a92-26704f01034c) (SHA-256 `383fdacc1f774ab3fb8bc60aa5d574824a77f5234e4d0e0ba192b7320ef5a82a`) [gitlab-35-mergerequest-159.json](https://gitea.nessar.fr/attachments/0c70e7a4-3efb-49e1-9ee7-69b513e0c9d4) (SHA-256 `80806a6b7ff36ca30f3ea2bf5d95f782d0c876a985adefb5bb42914bc3fe8cf8`) Old CI job execution and reports are omitted. Original source files and rollback backups remain protected.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: nessar/vac-optimizer#237

Commit	Description
	add CSP nonce support to JsonpClientBackend
	Don't on Passthru outside of reactive context

Commit	Type	Description
540536c386	fix	add CSP nonce support to JsonpClientBackend
63a857b874	fix	Don't on Passthru outside of reactive context

Commit	Type	Description
7f9450219f	feat	Adds warning for prefetch without main defer trigger
ab061a7610	fix	error for type parameter declarations
9218140348	fix	resolve TCB mapping failure for safe property reads with as any

Commit	Type	Description
a0aa8304cd	feat	bootstrap via `ApplicationRef` with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
77f1ca08e4	fix	handle missing serialized container hydration data