build(deps): Bump the zeppelin-web-angular-security-updates group across 1 directory with 20 updates

[dependabot]

Bumps the zeppelin-web-angular-security-updates group with 20 updates in the /zeppelin-web-angular directory:

Package	From	To
@angular/common	21.2.15	21.2.20
@angular/compiler	21.2.15	21.2.19
@angular/core	21.2.15	21.2.20
@angular/router	21.2.15	21.2.24
undici	6.26.0	6.29.0
brace-expansion	1.1.15	1.1.21
@hono/node-server	1.19.14	1.19.17
@vitest/mocker	4.1.8	5.0.3
baseline-browser-mapping	2.10.32	2.11.27
browserslist	4.28.2	4.29.3
fast-uri	3.1.2	3.1.8
hono	4.12.23	4.13.12
immutable	5.1.6	5.1.9
ip-address	10.2.0	10.7.3
js-yaml	4.1.1	4.3.2
shell-quote	1.8.3	1.9.0
piscina	5.1.4	5.2.0
postcss	8.5.12	8.5.23
tar	7.5.15	7.5.22
webpack-dev-server	5.2.3	5.2.6

Updates @angular/common from 21.2.15 to 21.2.20

Release notes

Sourced from @​angular/common's releases.

21.2.20

core

Commit	Description
	sanitize host bindings on concrete hosts

http

Commit	Description
	match header values exactly when deleting
	preserve immutability of materialized clones
	run root interceptors in the terminal request chain

21.2.19

compiler

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

http

Commit	Description
	distinguish repeated transfer cache params
	enable xsrf for root-provided HttpClient

platform-server

Commit	Description
	update domino to latest version

21.2.18

compiler-cli

Commit	Description
	update babel dependencies to latest v7

core

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

http

Commit	Description
	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

21.2.17

common

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

21.2.20 (2026-08-12)

core

Commit	Type	Description
6afe6fa781	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
fec5977df4	fix	match header values exactly when deleting
e33d69a71c	fix	preserve immutability of materialized clones
caf616670f	fix	run root interceptors in the terminal request chain

21.2.19 (2026-07-29)

compiler

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

platform-server

Commit	Type	Description
f34a93c946	fix	update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit	Type	Description
8d22cc953b	fix	update babel dependencies to latest v7

core

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

http

Commit	Type	Description
91df739b80	fix	prevent caching of responses with Set-Cookie headers

service-worker

| Commit | Type | Description |

... (truncated)

Commits

• caf6166 fix(http): run root interceptors in the terminal request chain
• fec5977 fix(http): match header values exactly when deleting
• e33d69a fix(http): preserve immutability of materialized clones
• 948a8d6 fix(http): distinguish repeated transfer cache params
• 9949dcc fix(http): enable xsrf for root-provided HttpClient
• 91df739 fix(http): prevent caching of responses with Set-Cookie headers
• 86a56dc fix(common): Limits date format string length
• bcb1b7e fix(http): preserve empty referrer option in HttpRequest
• a810a31 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
• bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
• Additional commits viewable in compare view

Updates @angular/compiler from 21.2.15 to 21.2.19

Release notes

Sourced from @​angular/compiler's releases.

21.2.19

compiler

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

http

Commit	Description
	distinguish repeated transfer cache params
	enable xsrf for root-provided HttpClient

platform-server

Commit	Description
	update domino to latest version

21.2.18

compiler-cli

Commit	Description
	update babel dependencies to latest v7

core

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

http

Commit	Description
	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

21.2.17

common

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	sanitize two-way properties

core

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.19 (2026-07-29)

compiler

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

platform-server

Commit	Type	Description
f34a93c946	fix	update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit	Type	Description
8d22cc953b	fix	update babel dependencies to latest v7

core

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

http

Commit	Type	Description
91df739b80	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

21.2.17 (2026-06-10)

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Type	Description
86a56dc279	fix	Limits date format string length

... (truncated)

Commits

• 7b884f5 fix(compiler): restrict possible event handler check to property names longer...
• e2660c3 fix(compiler): disallow i18n event attributes
• dc9c996 fix(compiler): sanitize two-way properties
• ae1c8a1 fix(compiler): move projection attributes into constants
• See full diff in compare view

Updates @angular/core from 21.2.15 to 21.2.20

Release notes

Sourced from @​angular/core's releases.

21.2.20

core

Commit	Description
	sanitize host bindings on concrete hosts

http

Commit	Description
	match header values exactly when deleting
	preserve immutability of materialized clones
	run root interceptors in the terminal request chain

21.2.19

compiler

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

http

Commit	Description
	distinguish repeated transfer cache params
	enable xsrf for root-provided HttpClient

platform-server

Commit	Description
	update domino to latest version

21.2.18

compiler-cli

Commit	Description
	update babel dependencies to latest v7

core

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

http

Commit	Description
	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

21.2.17

common

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

21.2.20 (2026-08-12)

core

Commit	Type	Description
6afe6fa781	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
fec5977df4	fix	match header values exactly when deleting
e33d69a71c	fix	preserve immutability of materialized clones
caf616670f	fix	run root interceptors in the terminal request chain

21.2.19 (2026-07-29)

compiler

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

platform-server

Commit	Type	Description
f34a93c946	fix	update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit	Type	Description
8d22cc953b	fix	update babel dependencies to latest v7

core

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

http

Commit	Type	Description
91df739b80	fix	prevent caching of responses with Set-Cookie headers

service-worker

| Commit | Type | Description |

... (truncated)

Commits

• 6afe6fa fix(core): sanitize host bindings on concrete hosts
• 7b884f5 fix(compiler): restrict possible event handler check to property names longer...
• e2660c3 fix(compiler): disallow i18n event attributes
• 5a693ba fix(core): reject dynamic script host elements
• 6bcce11 fix(core): avoid caching missing locale data
• 88832c8 fix(core): validate lowercase SVG animation attribute names (#69269)
• 3551074 fix(platform-server): harden platform location origin validation during SSR
• bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
• d846326 fix(common): skip transfer cache for uncacheable HTTP traffic
• e245d40 fix(http): skip transfer cache for fetch credentialed requests
• Additional commits viewable in compare view

Updates @angular/router from 21.2.15 to 21.2.24

Release notes

Sourced from @​angular/router's releases.

21.2.24

router

Commit	Description
	avoid dense elements allocation for numeric URL keys

21.2.23

platform-server

Commit	Description
	update domino to latest version

21.2.22

platform-server

Commit	Description
	avoid stripping unicode whitespace during url resolution
	update domino to latest version

21.2.21

platform-browser

Commit	Description
	disallow event handler attributes in Meta

21.2.20

core

Commit	Description
	sanitize host bindings on concrete hosts

http

Commit	Description
	match header values exactly when deleting
	preserve immutability of materialized clones
	run root interceptors in the terminal request chain

21.2.19

compiler

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

http

Commit	Description
	distinguish repeated transfer cache params
	enable xsrf for root-provided HttpClient

platform-server

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/router's changelog.

21.2.24 (2026-09-23)

router

Commit	Type	Description
03872a80bc	fix	avoid dense elements allocation for numeric URL keys

21.2.23 (2026-09-09)

platform-server

Commit	Type	Description
fc2e8fbc0b	fix	update domino to latest version

21.2.22 (2026-08-26)

platform-server

Commit	Type	Description
5aa6d97deb	fix	avoid stripping unicode whitespace during url resolution
73d8bbd27c	fix	update domino to latest version

21.2.21 (2026-08-19)

platform-browser

Commit	Type	Description
c19a36c2fb	fix	disallow event handler attributes in Meta

21.2.20 (2026-08-12)

core

Commit	Type	Description
6afe6fa781	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
fec5977df4	fix	match header values exactly when deleting
e33d69a71c	fix	preserve immutability of materialized clones
caf616670f	fix	run root interceptors in the terminal request chain

... (truncated)

Commits

• 03872a8 fix(router): avoid dense elements allocation for numeric URL keys
• See full diff in compare view

Updates undici from 6.26.0 to 6.29.0

Release notes

Sourced from undici's releases.

v6.29.0

What's Changed

• [v6.x] fix(retry): settle exposed body on terminal failure by @​mcollina in nodejs/undici#5778
• Backport upgrade diagnostics lifecycle fixes to v6.x by @​BridgeAR in nodejs/undici#5833
• test: synchronize the issue-3356 body timeout by @​BridgeAR in nodejs/undici#5834

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

⚠️ Security fixes

High severity

• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

• perf: reduce EventSourceStream parser allocations (#5032) by @​mcollina in nodejs/undici#5647
• [v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @​mcollina in nodejs/undici#5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

v6.28.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

... (truncated)

Commits

• e1d0501 Bumped v6.29.0 (#5888)
• 57ac4de test: synchronize the issue-3356 body timeout (#5834)
• 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
• 2a91fc8 fix(retry): settle exposed body on terminal failure (#5778)
• ffc8aa0 Bumped v6.28.1 (#5773)
• 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
• ce31bc8 fix(retry): validate resumed response framing
• 2af0faf fix(websocket): reject unrequested subprotocols
• 07c60d9 fix(websocket): destroy inflater after decompression limit
• bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.15 to 1.1.21

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits

• 71941da 1.19.17
• 0208500 ci: add stage option for publishing (#386)
• cbdf713 1.19.16
• 86e96c2 ci: add an action for trusted publisher (#385)
• 99c1a1a ci: run on v1.x branch pushes
• 84cb2ee Merge commit from fork
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.

Updates @vitest/mocker from 4.1.8 to 5.0.3

Release notes

Sourced from @​vitest/mocker's releases.

v5.0.3

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in vitest-dev/vitest#11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in vitest-dev/vitest#11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in vitest-dev/vitest#11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in vitest-dev/vitest#11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in vitest-dev/vitest#11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in vitest-dev/vitest#11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in vitest-dev/vitest#11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in vitest-dev/vitest#11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in vitest-dev/vitest#11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in vitest-dev/vitest#11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in vitest-dev/vitest#11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in vitest-dev/vitest#11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in vitest-dev/vitest#11295 (d1c3e)
• reporter:
  ...

  Description has been truncated