Skip to content

Bump the npm_and_yarn group across 1 directory with 23 updates - #44

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/my-first-app/npm_and_yarn-9d06d0ca4d
Open

Bump the npm_and_yarn group across 1 directory with 23 updates#44
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/my-first-app/npm_and_yarn-9d06d0ca4d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 11 updates in the /my-first-app directory:

Package From To
@angular/common 8.2.14 20.3.25
@angular/compiler 8.2.14 20.3.25
@angular/core 8.2.14 20.3.25
@angular/platform-server 8.2.14 19.2.25
@nguniversal/express-engine 8.2.6 16.2.0
express 4.17.1 4.22.2
cipher-base 1.0.4 1.0.7
ws 6.2.1 6.2.4
follow-redirects 1.14.8 1.16.0
ip 1.1.5 removed
lodash 4.17.21 4.18.1

Updates @angular/common from 8.2.14 to 20.3.25

Release notes

Sourced from @​angular/common's releases.

20.3.25

common

Commit Description
fix - 9f443bc24c Limits date format string length
fix - 566ad05f20 skip transfer cache for uncacheable HTTP traffic
fix - 1a62130a6b use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description
fix - a68ec702a0 sanitize two-way properties

core

Commit Description
fix - 768a349e6e harden TransferState restoration against DOM clobbering
fix - ca48b4728d validate lowercase SVG animation attribute names (#69270)

http

Commit Description
fix - 06be298267 preserve empty referrer option in HttpRequest
fix - fa940e1f4d Rejects non-HTTP(S) URLs in JSONP requests
fix - e2ef1ce72a skip transfer cache for fetch credentialed requests

platform-server

Commit Description
fix - 49368c1859 harden platform location origin validation during SSR
refactor - d55c94ad81 deprecate ServerXhr (#69256)

service-worker

Commit Description
fix - d65a5f457b Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description
fix - 6ca433e56b throw on suspicious URLs and restrict protocol-relative URLs
fix - 8680b5152f update domino to latest version

20.3.23

compiler

Commit Description
fix - d40acc6431 prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description
9f443bc24c fix Limits date format string length
566ad05f20 fix skip transfer cache for uncacheable HTTP traffic
1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description
a68ec702a0 fix sanitize two-way properties

core

Commit Type Description
768a349e6e fix harden TransferState restoration against DOM clobbering
ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description
06be298267 fix preserve empty referrer option in HttpRequest
fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description
49368c1859 fix harden platform location origin validation during SSR
d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description
d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

  • This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
  • data prefixed attribute no-longer bind inputs nor outputs.
  • The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
  • in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits
  • 06be298 fix(http): preserve empty referrer option in HttpRequest
  • 9f443bc fix(common): Limits date format string length
  • fa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
  • 1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
  • 566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
  • e2ef1ce fix(http): skip transfer cache for fetch credentialed requests
  • 3d135ce fix(common): add upper bounds for digitsInfo
  • 39a4b4c fix(common): sanitize placeholder
  • de7b2a6 fix(http): exclude withCredentials requests from transfer cache
  • 4233188 fix(http): skip TransferCache for cookie-bearing requests by default
  • Additional commits viewable in compare view

Updates @angular/compiler from 8.2.14 to 20.3.25

Release notes

Sourced from @​angular/compiler's releases.

20.3.25

common

Commit Description
fix - 9f443bc24c Limits date format string length
fix - 566ad05f20 skip transfer cache for uncacheable HTTP traffic
fix - 1a62130a6b use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description
fix - a68ec702a0 sanitize two-way properties

core

Commit Description
fix - 768a349e6e harden TransferState restoration against DOM clobbering
fix - ca48b4728d validate lowercase SVG animation attribute names (#69270)

http

Commit Description
fix - 06be298267 preserve empty referrer option in HttpRequest
fix - fa940e1f4d Rejects non-HTTP(S) URLs in JSONP requests
fix - e2ef1ce72a skip transfer cache for fetch credentialed requests

platform-server

Commit Description
fix - 49368c1859 harden platform location origin validation during SSR
refactor - d55c94ad81 deprecate ServerXhr (#69256)

service-worker

Commit Description
fix - d65a5f457b Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description
fix - 6ca433e56b throw on suspicious URLs and restrict protocol-relative URLs
fix - 8680b5152f update domino to latest version

20.3.23

compiler

Commit Description
fix - d40acc6431 prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description
9f443bc24c fix Limits date format string length
566ad05f20 fix skip transfer cache for uncacheable HTTP traffic
1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description
a68ec702a0 fix sanitize two-way properties

core

Commit Type Description
768a349e6e fix harden TransferState restoration against DOM clobbering
ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description
06be298267 fix preserve empty referrer option in HttpRequest
fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description
49368c1859 fix harden platform location origin validation during SSR
d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description
d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

  • This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
  • data prefixed attribute no-longer bind inputs nor outputs.
  • The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
  • in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits
  • a68ec70 fix(compiler): sanitize two-way properties
  • d40acc6 fix(compiler): prevent namespaced SVG <style> elements from being stripped
  • 7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
  • 36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
  • 823b37f test(compiler): remove obsolete schema_extractor import (#68926)
  • e345a58 fix(core): normalize tag names in runtime i18n attribute security context loo...
  • 8f35b18 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
  • 64a89e9 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
  • 6404edf fix(compiler): strip namespaced SVG script elements during template compilati...
  • dc631ef fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
  • Additional commits viewable in compare view

Updates @angular/core from 8.2.14 to 20.3.25

Release notes

Sourced from @​angular/core's releases.

20.3.25

common

Commit Description
fix - 9f443bc24c Limits date format string length
fix - 566ad05f20 skip transfer cache for uncacheable HTTP traffic
fix - 1a62130a6b use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description
fix - a68ec702a0 sanitize two-way properties

core

Commit Description
fix - 768a349e6e harden TransferState restoration against DOM clobbering
fix - ca48b4728d validate lowercase SVG animation attribute names (#69270)

http

Commit Description
fix - 06be298267 preserve empty referrer option in HttpRequest
fix - fa940e1f4d Rejects non-HTTP(S) URLs in JSONP requests
fix - e2ef1ce72a skip transfer cache for fetch credentialed requests

platform-server

Commit Description
fix - 49368c1859 harden platform location origin validation during SSR
refactor - d55c94ad81 deprecate ServerXhr (#69256)

service-worker

Commit Description
fix - d65a5f457b Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description
fix - 6ca433e56b throw on suspicious URLs and restrict protocol-relative URLs
fix - 8680b5152f update domino to latest version

20.3.23

compiler

Commit Description
fix - d40acc6431 prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description
9f443bc24c fix Limits date format string length
566ad05f20 fix skip transfer cache for uncacheable HTTP traffic
1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description
a68ec702a0 fix sanitize two-way properties

core

Commit Type Description
768a349e6e fix harden TransferState restoration against DOM clobbering
ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description
06be298267 fix preserve empty referrer option in HttpRequest
fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description
49368c1859 fix harden platform location origin validation during SSR
d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description
d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

  • This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
  • data prefixed attribute no-longer bind inputs nor outputs.
  • The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
  • in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits
  • ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)
  • 1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
  • 49368c1 fix(platform-server): harden platform location origin validation during SSR
  • 566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
  • 768a349 fix(core): harden TransferState restoration against DOM clobbering
  • 7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
  • 6595409 test(core): update golden symbols and host bindings sanitization spec (#68926)
  • d86e4e7 fix(core): reject script element as a dynamic component host (#68926)
  • b8f1f72 test(core): remove obsolete blockquote cite host binding tests (#68926)
  • 36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
  • Additional commits viewable in compare view

Updates @angular/platform-server from 8.2.14 to 19.2.25

Release notes

Sourced from @​angular/platform-server's releases.

19.2.25

platform-server

Commit Description
fix - e2fb854d55 throw on suspicious URLs and restrict protocol-relative URLs
fix - 0a8befb493 update domino to latest version

19.2.24

compiler

Commit Description
fix - 6ea6379123 prevent namespaced SVG elements from being stripped

19.2.23

common

Commit Description
fix - 62dd27d6af add upper bounds for digitsInfo
fix - 17326725ba sanitize placeholder

compiler

Commit Description
fix - 932e0728db normalize tag names with custom namespaces in DomElementSchemaRegistry
fix - 2e3d0371ab sanitize dynamic href and xlink:href bindings on SVG a elements
fix - fe1207e8c5 strip namespaced SVG script elements during template compilation

core

Commit Description
fix - c6bb0692e2 reject script element as a dynamic component host
fix - 3960b21558 sanitize meta selectors
fix - 3632fa4b69 support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation
fix - 620230dac4 synchronize core sanitization schema with compiler
fix - d31f84116c wrap i18n dynamic element property updates in active index states

http

Commit Description
fix - 9940ffd781 exclude withCredentials requests from transfer cache
fix - 0f67f0b962 skip TransferCache for cookie-bearing requests by default

platform-server

Commit Description
fix - d187e8aeda normalize path parsing in ServerPlatformLocation
fix - c75f60ef8a secure location and document initialization against SSRF and path hijack

service-worker

Commit Description
fix - 37ee9ffd9e preserve redirect policy on reconstructed asset requests
fix - 97f796203f Preserves explicit 'credentials: omit' in asset requests
fix - 5619120931 Preserves HTTP cache mode in asset group requests

... (truncated)

Changelog

Sourced from @​angular/platform-server's changelog.

19.2.25 (2026-06-02)

platform-server

Commit Type Description
e2fb854d55 fix throw on suspicious URLs and restrict protocol-relative URLs
0a8befb493 fix update domino to latest version

20.3.24 (2026-06-02)

platform-server

Commit Type Description
6ca433e56b fix throw on suspicious URLs and restrict protocol-relative URLs
8680b5152f fix update domino to latest version

21.2.15 (2026-05-28)

common

Commit Type Description
7f4ac78994 fix add upper bounds for digitsInfo
300f61feb3 fix sanitize placeholder

compiler

Commit Type Description
0b07f47bd6 fix normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
eb1cbbf2eb fix prevent namespaced SVG elements from being stripped
cc1378d54b fix sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
782e01594e fix strip namespaced SVG script elements during template compilation (#68925)

core

Commit Type Description
ff12fe55ac fix normalize tag names in runtime i18n attribute security context lookup (#68925)
e6fe77cc97 fix sanitize meta selectors
daaf32937f fix support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
dada86e43d fix synchronize core sanitization schema with compiler (#68925)

http

Commit Type Description
582a417bd2 fix exclude withCredentials requests from transfer cache
5c6d6df34b fix skip TransferCache for cookie-bearing requests by default

platform-server

Commit Type Description
37e8aadf87 fix prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e fix secure location and document initialization against SSRF and path hijack

... (truncated)

Commits
  • e2fb854 fix(platform-server): throw on suspicious URLs and restrict protocol-relative...
  • a0193fa refactor(platform-server): extract parseUrl regex and add comments for URL pa...
  • c75f60e fix(platform-server): secure location and document initialization against SSR...
  • e8d35f9 Revert "revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f641...
  • 4747fe2 revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f6418d5e
  • d187e8a fix(platform-server): normalize path parsing in ServerPlatformLocation
  • 8569db8 fix(platform-server): add allowedHosts option to renderModule and `render...
  • 837a710 fix(platform-server): ensure origin has a trailing slash when parsing url (#6...
  • f3a5bfb fix(platform-server): prevent SSRF bypasses via protocol-relative and backsla...
  • 70d0639 fix(core): introduce BootstrapContext for improved server bootstrapping (#6...
  • Additional commits viewable in compare view

Updates @nguniversal/express-engine from 8.2.6 to 16.2.0

Release notes

Sourced from @​nguniversal/express-engine's releases.

v16.2.0

16.2.0 (2023-08-11)

@​nguniversal/common

Commit Description
fix - 2b0f8c2b build: update critters

v16.2.0-rc.0

16.2.0-rc.0 (2023-08-04)

Commit Description
refactor - 2b0f8c2b build: update critters

v16.1.3

16.1.3 (2023-08-09)

@​nguniversal/common

Commit Description
fix - d4be69b8 check for server context when doing hybrid rendering

v16.1.2

16.1.2 (2023-08-04)

Commit Description
refactor - 0c0fd61 build: update critters

v16.1.1

16.1.1 (2023-06-28)

build: update dependency critters to v0.0.19

v16.1.0

16.1.0 (2023-06-13)

Commit Description
refactor - ccc2f52f deprecate transfer http cache

Deprecations

v16.1.0-rc.0

16.1.0-rc.0 (2023-06-07)

... (truncated)

Changelog

Sourced from @​nguniversal/express-engine's changelog.

16.2.0 (2023-08-11)

Commit Type Description
2b0f8c2b refactor build: update critters

16.1.3 (2023-08-09)

@​nguniversal/common

Commit Type Description
d4be69b8 fix check for server context when doing hybrid rendering

16.1.2 (2023-08-04)

Commit Type Description
0c0fd610 refactor build: update critters

16.1.1 (2023-06-28)

16.1.0 (2023-06-13)

Deprecations

Commit Type Description

... (truncated)

Commits
  • dccbf02 release: cut the v16.2.0 release
  • 82b9e69 build: update angular
  • c0b0418 fix(@​nguniversal/common): check for server context when doing hybrid rendering
  • aa8ca19 refactor: update changelog link for Critters version bump
  • 53f7a3d release: cut the v16.2.0-rc.0 release
  • 877bf34 docs: release notes for the v16.1.2 release
  • 2b0f8c2 build: update critters
  • 0dcb01f build: lock file maintenance
  • 4e47c6c build: update dependency typescript to v5.1.6
  • 0c7d7ee build: update dependency @​typescript-eslint/parser to v6
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​nguniversal/express-engine since your current version.


Updates express from 4.17.1 to 4.22.2

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

New Contributors

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@4.22.0...v4.22.1

4.22.0

Important: Security

What's Changed

@dependabot
Bump the npm_and_yarn group across 1 directory with 23 updates
18acd29 
Bumps the npm_and_yarn group with 11 updates in the /my-first-app directory:

| Package | From | To |
| --- | --- | --- |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `8.2.14` | `20.3.25` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `8.2.14` | `20.3.25` |
| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `8.2.14` | `20.3.25` |
| [@angular/platform-server](https://github.com/angular/angular/tree/HEAD/packages/platform-server) | `8.2.14` | `19.2.25` |
| [@nguniversal/express-engine](https://github.com/angular/universal) | `8.2.6` | `16.2.0` |
| [express](https://github.com/expressjs/express) | `4.17.1` | `4.22.2` |
| [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.7` |
| [ws](https://github.com/websockets/ws) | `6.2.1` | `6.2.4` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.14.8` | `1.16.0` |
| [ip](https://github.com/indutny/node-ip) | `1.1.5` | `removed` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |



Updates `@angular/common` from 8.2.14 to 20.3.25
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/common)

Updates `@angular/compiler` from 8.2.14 to 20.3.25
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler)

Updates `@angular/core` from 8.2.14 to 20.3.25
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/core)

Updates `@angular/platform-server` from 8.2.14 to 19.2.25
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/platform-server)

Updates `@nguniversal/express-engine` from 8.2.6 to 16.2.0
- [Release notes](https://github.com/angular/universal/releases)
- [Changelog](https://github.com/angular/universal/blob/main/CHANGELOG.md)
- [Commits](angular/universal@v8.2.6...16.2.0)

Updates `express` from 4.17.1 to 4.22.2
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md)
- [Commits](expressjs/express@4.17.1...v4.22.2)

Updates `body-parser` from 1.19.0 to 1.20.5
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.5/HISTORY.md)
- [Commits](expressjs/body-parser@1.19.0...1.20.5)

Updates `cookie` from 0.4.0 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.4.0...v0.7.2)

Updates `send` from 0.17.1 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.17.1...0.19.2)

Updates `serve-static` from 1.14.1 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.14.1...v1.16.3)

Updates `cipher-base` from 1.0.4 to 1.0.7
- [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md)
- [Commits](browserify/cipher-base@v1.0.4...v1.0.7)

Updates `elliptic` from 6.5.4 to 6.6.1
- [Commits](indutny/elliptic@v6.5.4...v6.6.1)

Updates `ws` from 6.2.1 to 6.2.4
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@6.2.1...6.2.4)

Updates `follow-redirects` from 1.14.8 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.14.8...v1.16.0)

Removes `ip`

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `on-headers` from 1.0.2 to 1.1.0
- [Release notes](https://github.com/jshttp/on-headers/releases)
- [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md)
- [Commits](jshttp/on-headers@v1.0.2...v1.1.0)

Updates `path-to-regexp` from 0.1.7 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.7...v.0.1.13)

Updates `pbkdf2` from 3.0.17 to 3.1.6
- [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md)
- [Commits](browserify/pbkdf2@v3.0.17...v3.1.6)

Updates `postcss` from 7.0.17 to 8.5.12
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@7.0.17...8.5.12)

Updates `sha.js` from 2.4.11 to 2.4.12
- [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md)
- [Commits](browserify/sha.js@v2.4.11...v2.4.12)

Updates `webpack-dev-middleware` from 3.7.2 to 7.4.5
- [Release notes](https://github.com/webpack/webpack-dev-middleware/releases)
- [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-middleware@v3.7.2...v7.4.5)

Updates `webpack-dev-server` from 3.9.0 to 5.2.5
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v3.9.0...v5.2.5)

---
updated-dependencies:
- dependency-name: "@angular/common"
  dependency-version: 20.3.25
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@angular/compiler"
  dependency-version: 20.3.25
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@angular/core"
  dependency-version: 20.3.25
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@angular/platform-server"
  dependency-version: 19.2.25
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@nguniversal/express-engine"
  dependency-version: 16.2.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 4.22.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 0.7.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cipher-base
  dependency-version: 1.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: elliptic
  dependency-version: 6.6.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 6.2.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: on-headers
  dependency-version: 1.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: pbkdf2
  dependency-version: 3.1.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sha.js
  dependency-version: 2.4.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-middleware
  dependency-version: 7.4.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version: 5.2.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 2, 2026
This was referenced Jul 2, 2026
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants