Bump the npm_and_yarn group across 1 directory with 32 updates

[dependabot]

Bumps the npm_and_yarn group with 21 updates in the /ng directory:

Package	From	To
@angular/common	19.2.18	20.3.25
@angular/compiler	19.2.18	20.3.25
@angular/core	19.2.18	22.0.7
lodash	4.17.23	4.18.1
postcss	8.5.6	8.5.19
storybook	8.6.15	8.6.17
@babel/plugin-transform-modules-systemjs	7.28.5	7.29.7
@sigstore/core	2.0.0	3.2.1
axios	1.13.4	1.18.1
fast-uri	3.1.0	3.1.3
flatted	3.3.3	3.4.2
form-data	4.0.5	4.0.6
immutable	5.1.4	5.1.9
morgan	1.10.1	1.11.0
node-forge	1.3.3	1.4.0
piscina	4.8.0	5.2.0
qs	6.14.1	6.15.3
serialize-javascript	6.0.2	7.0.7
shell-quote	1.8.3	1.10.0
websocket-driver	0.7.4	0.7.5
ws	8.18.0	8.21.1

Updates @angular/common from 19.2.18 to 20.3.25

Release notes

Sourced from @​angular/common's releases.

20.3.25

common

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	sanitize two-way properties

core

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69270)

http

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

platform-server

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69256)

service-worker

Commit	Description
	Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

20.3.23

compiler

Commit	Description
	prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
a68ec702a0	fix	sanitize two-way properties

core

Commit	Type	Description
768a349e6e	fix	harden TransferState restoration against DOM clobbering
ca48b4728d	fix	validate lowercase SVG animation attribute names (#69270)

http

Commit	Type	Description
06be298267	fix	preserve empty referrer option in HttpRequest
fa940e1f4d	fix	Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a	fix	skip transfer cache for fetch credentialed requests

platform-server

Commit	Type	Description
49368c1859	fix	harden platform location origin validation during SSR
d55c94ad81	refactor	deprecate ServerXhr (#69256)

service-worker

Commit	Type	Description
d65a5f457b	fix	Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

• This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
• data prefixed attribute no-longer bind inputs nor outputs.
• The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
• in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

• 06be298 fix(http): preserve empty referrer option in HttpRequest
• 9f443bc fix(common): Limits date format string length
• fa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
• 1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
• 566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
• e2ef1ce fix(http): skip transfer cache for fetch credentialed requests
• 3d135ce fix(common): add upper bounds for digitsInfo
• 39a4b4c fix(common): sanitize placeholder
• de7b2a6 fix(http): exclude withCredentials requests from transfer cache
• 4233188 fix(http): skip TransferCache for cookie-bearing requests by default
• Additional commits viewable in compare view

Updates @angular/compiler from 19.2.18 to 20.3.25

Release notes

Sourced from @​angular/compiler's releases.

20.3.25

common

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	sanitize two-way properties

core

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69270)

http

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

platform-server

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69256)

service-worker

Commit	Description
	Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

20.3.23

compiler

Commit	Description
	prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
a68ec702a0	fix	sanitize two-way properties

core

Commit	Type	Description
768a349e6e	fix	harden TransferState restoration against DOM clobbering
ca48b4728d	fix	validate lowercase SVG animation attribute names (#69270)

http

Commit	Type	Description
06be298267	fix	preserve empty referrer option in HttpRequest
fa940e1f4d	fix	Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a	fix	skip transfer cache for fetch credentialed requests

platform-server

Commit	Type	Description
49368c1859	fix	harden platform location origin validation during SSR
d55c94ad81	refactor	deprecate ServerXhr (#69256)

service-worker

Commit	Type	Description
d65a5f457b	fix	Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

• This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
• data prefixed attribute no-longer bind inputs nor outputs.
• The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
• in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

• a68ec70 fix(compiler): sanitize two-way properties
• d40acc6 fix(compiler): prevent namespaced SVG <style> elements from being stripped
• 7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
• 36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
• 823b37f test(compiler): remove obsolete schema_extractor import (#68926)
• e345a58 fix(core): normalize tag names in runtime i18n attribute security context loo...
• 8f35b18 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
• 64a89e9 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
• 6404edf fix(compiler): strip namespaced SVG script elements during template compilati...
• dc631ef fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
• Additional commits viewable in compare view

Updates @angular/core from 19.2.18 to 22.0.7

Release notes

Sourced from @​angular/core's releases.

22.0.7

common

Commit	Description
	avoid prototype lookups in date format caches

compiler

Commit	Description
	parsing of an empty template literal interpolation

compiler-cli

Commit	Description
	re-tag SourceFiles after TsCreateProgramDriver.updateFiles()

core

Commit	Description
	allow static attributes for explicit input transforms
	ignore processing instruction syntax in templates
	preserve explicit input transform write type

forms

Commit	Description
	allow multiple async validators
	preserve intermediate number values in signal forms
	prevent stale CVA writeback during debounce

http

Commit	Description
	prevent interceptor signal reads from leaking into calling reactive contexts

localize

Commit	Description
	build runtime translations map with a null prototype
	use Object.hasOwn for placeholder lookup in translate

platform-browser

Commit	Description
	prevent ReDoS in SOURCEMAP_URL_REGEXP

22.0.6

compiler

Commit	Description
	use regular optional chaining expression for safe function calls in TCBs

compiler-cli

Commit	Description
	apply debugName transform to required signal queries
	detect uninvoked signals in bound expressions using ternary

forms/signals

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

22.0.7 (2026-07-15)

common

Commit	Type	Description
91e33aa1de	fix	avoid prototype lookups in date format caches

compiler

Commit	Type	Description
5b516e3a58	fix	parsing of an empty template literal interpolation

compiler-cli

Commit	Type	Description
c88ddde1c9	fix	re-tag SourceFiles after TsCreateProgramDriver.updateFiles()

core

Commit	Type	Description
94d9591b51	fix	allow static attributes for explicit input transforms
c89f71a74c	fix	ignore processing instruction syntax in templates
70500e4067	fix	preserve explicit input transform write type

forms

Commit	Type	Description
1b9964675f	fix	allow multiple async validators
64d6d47a0c	fix	preserve intermediate number values in signal forms
6cf7446afa	fix	prevent stale CVA writeback during debounce

http

Commit	Type	Description
20b7dc3023	fix	prevent interceptor signal reads from leaking into calling reactive contexts

localize

Commit	Type	Description
22d5a091d1	fix	build runtime translations map with a null prototype
8ce1fcf7fa	fix	use Object.hasOwn for placeholder lookup in translate

platform-browser

Commit	Type	Description
b34bf0dce8	fix	prevent ReDoS in SOURCEMAP_URL_REGEXP

20.3.26 (2026-07-08)

compiler-cli

Commit	Type	Description
406aaa31e6	fix	update babel dependencies to latest v7

core

Commit	Type	Description

... (truncated)

Commits

• 829d98e build: update cross-repo angular dependencies to v22.0.7
• 70500e4 fix(core): preserve explicit input transform write type
• e881b96 refactor(core): move signal debug graph interfaces to primitives/devtools
• 1046fd9 refactor(core): remove deprecated unregisterTool from ModelContext
• 5936ffb refactor(core): update WebMCP tool registration to be asynchronous
• c82ae67 Revert "fix(core): allow static attributes for explicit input transforms"
• ec9b479 build: update cross-repo angular dependencies
• 94d9591 fix(core): allow static attributes for explicit input transforms
• 1b99646 fix(forms): allow multiple async validators
• 748faa4 docs(docs-infra): Add build-time validation for API and guide links using rou...
• Additional commits viewable in compare view

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.19

Release notes

Sourced from postcss's releases.

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

8.5.8

• Fixed Processor#version.

8.5.7

• Improved source map annotation cleaning performance (by CodeAnt AI).

Changelog

Sourced from postcss's changelog.

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

... (truncated)

Commits

• 9543b22 Release 8.5.19 version
• 3d13bf9 Fix CI on Windows too
• 00d0dd2 Keep explicitly set raws.before when inserting nodes into root (#2111)
• 7a05b33 Temporary fix CI
• 4c0d194 Release 8.5.18 version
• 92b4e78 Update dependencies
• 95663d3 Limit where source map can be loaded for security reasons
• 74e25ae Release 8.5.17 version
• d1518af Fix Maximum call stack size exceeded error
• 2421312 Fix linter
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates storybook from 8.6.15 to 8.6.17

Release notes

Sourced from storybook's releases.

v8.6.17

8.6.17

• Harden websocket connection

v8.6.16

8.6.16

• No-op release. No changes.

Changelog

Sourced from storybook's changelog.

8.6.17

• Harden websocket connection

8.6.16

• No-op release. No changes.

8.6.14

• CLI: Add skip onboarding, recommended/minimal config - #30930, thanks @​shilman!
• Core: Fix using dates in expect statements - #28413, thanks @​yann-combarnous!
• React Native Web: Fix expo router by setting JSX to automatic - #31484, thanks @​dannyhw!
• Test: Make sure that lit arrays are not cloned - #31435, thanks @​kasperpeulen!

8.6.13

• Controls: Fix boxShadow on empty controls - #27193, thanks @​H0onnn!
• React Native Web: Update react-native-web - #31324, thanks @​ndelangen!

8.6.12

• CLI: Only install Visual Test Addon if test feature is selected - #30966, thanks @​ghengeveld!
• Core: Fix telemetry error on Storybook UI - #30953, thanks @​yannbf!
• Ember: Fix ember-template-compiler import for ember 6+ - #30682, thanks @​leoeuclids!
• Next: Update vite-plugin-storybook-nextjs to 2.0.0--canary.33.17a2310.0 - #30997, thanks @​kasperpeulen!
• Svelte: Exclude node_modules from docgen - #30981, thanks @​JReinhold!

8.6.11

• Angular: Fix zone.js support for Angular libraries - #30941, thanks @​valentinpalkovic!

8.6.10

• Addon-docs: Fix non-string handling in Stories block - #30913, thanks @​JamesIves!
• Nextjs: Fix styled-jsx optimize vite warnings - #30932, thanks @​kasperpeulen!
• React: Fix actImplementation is not a function - #30929, thanks @​kasperpeulen!

8.6.9

• Next: Fix react aliases in next vite plugin - #30914, thanks @​kasperpeulen!

8.6.8

• Angular: Export all files in Angular package.json - #30849, thanks @​kasperpeulen!
• CLI: Don't add packageManager entry to package.json automatically - #30855, thanks @​kasperpeulen!
• React: Allow portable stories to be used in SSR - #30847, thanks @​kasperpeulen!
• Svelte: Adjust Svelte typings to include Svelte 5 function components - #30852, thanks @​dummdidumm!
• Telemetry: Make sure that telemetry doesn't fail on init - #30857, thanks @​kasperpeulen!
• Vite: Update HMR filter to target specific story file types - #30845, thanks @​kasperpeulen!

... (truncated)

Commits

• c6e550a Bump version from "8.6.16" to "8.6.17" [skip ci]
• 9cf9d89 Core: Require token for websocket connections
• 7e51515 Bump version from "8.6.15" to "8.6.16" [skip ci]
• See full diff in compare view

Updates vite from 6.3.6 to 6.4.2

Release notes

Sourced from vite's releases.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.2 (2026-04-06)

• fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163
• fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

• feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

• fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

Commits

• 6b3fad0 release: v6.4.2
• ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
• fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)

[johnnyelwailer]

Automated AFK-pipeline review: this fix was produced by an automated pipeline and has not been human-reviewed yet. Existing PR comments, reviews, and inline threads were checked; none covered this dependency-resolution defect.

Stacked fix: #60

PR #58 mixes Angular 22 runtime packages with Angular 19 compiler/CLI dependencies, so the dependency graph cannot resolve and the build stops before tests run.

• Draft #60 is based on the unchanged contributor head 8dd7120fe6ba4e11963e243b3c14b5207c409555.
• In a clean clone, npm install --package-lock-only --ignore-scripts --no-audit --no-fund and npm ci --dry-run --ignore-scripts --no-audit --no-fund passed (2,438 packages).
• Root manifest/lock metadata match and git diff --check passed; no full Nx build/test/lint run was claimed.