[dependabot]

Bumps @angular/common, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic, @angular/platform-server, @angular/router, @angular/ssr and @angular-devkit/build-angular. These dependencies needed to be updated together.
Updates @angular/common from 17.3.10 to 22.2.4

Release notes

Sourced from @​angular/common's releases.

22.2.4

compiler

Commit	Description
	avoid treating attributes with object prototype names as being translated
	default to Eager change detection for pre-v22 libraries in JIT
	report errors for malformed template literal interpolations
	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Description
	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Description
	avoid mutating shared ICU case queue during i18n hydration
	avoid reloading a resource when params is unchanged
	catch view effect errors in targeted change detection mode
	check every i18n attribute translation for ICUs
	guard against integer overflow in i18n
	improve the warning for bindings on elements inside ICU expressions
	keep prototype-named keys in getTransferState
	avoid reading linked signal debug names in production
	guard i18n insertion assertion with ngDevMode

forms

Commit	Description
	annotate field context helpers with this: void
	don't crash when formControlName has no matching control
	reject unsupported updateOn in SignalFormControl
	match multi-select identities in a single pass

http

Commit	Description
	account for multiple cache control headers

language-service

Commit	Description
	resolve symbols for inputs with restricted access

migrations

Commit	Description
	migrate static string and array ngClass bindings to class

router

Commit	Description
	don't intercept downloads with the Navigation API
	drop null query params in createUrlTreeFromSnapshot
	escape colons in parenthesized primary child segments
	properly handle redirects during traversal navigations with Navigation API

... (truncated)

Commits

• 8c4e267 build(docs-infra): move framework API doc generation targets under //adev
• b9761c8 test(http): add XSRF specs for backslash and whitespace URLs
• 2251098 fix(http): account for multiple cache control headers
• 6f2fb3d docs: update the initializer fn entries.
• dcb29a9 docs: fix @​param names that don't match their parameters
• fafec77 fix(common): harden param encoding against prototype pollution
• ad2f291 fix(common): let NgOptimizedImage pass a [srcset] binding through when srcset...
• 6dee7fe fix(http): forward reportProgress of httpResource as `reportDownloadProgr...
• 270abc9 docs(docs-infra): throw on absolute links in @​see tags
• b9de99d fix(common): remove abort listener on the abort path too in httpResource
• Additional commits viewable in compare view

Updates @angular/forms from 17.3.10 to 22.2.4

Release notes

Sourced from @​angular/forms's releases.

22.2.4

compiler

Commit	Description
	avoid treating attributes with object prototype names as being translated
	default to Eager change detection for pre-v22 libraries in JIT
	report errors for malformed template literal interpolations
	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Description
	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Description
	avoid mutating shared ICU case queue during i18n hydration
	avoid reloading a resource when params is unchanged
	catch view effect errors in targeted change detection mode
	check every i18n attribute translation for ICUs
	guard against integer overflow in i18n
	improve the warning for bindings on elements inside ICU expressions
	keep prototype-named keys in getTransferState
	avoid reading linked signal debug names in production
	guard i18n insertion assertion with ngDevMode

forms

Commit	Description
	annotate field context helpers with this: void
	don't crash when formControlName has no matching control
	reject unsupported updateOn in SignalFormControl
	match multi-select identities in a single pass

http

Commit	Description
	account for multiple cache control headers

language-service

Commit	Description
	resolve symbols for inputs with restricted access

migrations

Commit	Description
	migrate static string and array ngClass bindings to class

router

Commit	Description
	don't intercept downloads with the Navigation API
	drop null query params in createUrlTreeFromSnapshot
	escape colons in parenthesized primary child segments
	properly handle redirects during traversal navigations with Navigation API

... (truncated)

Commits

• 1226631 fix(forms): reject unsupported updateOn in SignalFormControl
• 8c4e267 build(docs-infra): move framework API doc generation targets under //adev
• be309d5 refactor(forms): correct the InputValidityMonitor doc comment
• 61fe5ca test(forms): add missing assertions to two signal forms specs
• a02ad16 perf(forms): match multi-select identities in a single pass
• 1c7a906 docs(forms): update stale statements in the signal forms API docs
• 6a41c99 test(forms): assert this: void on destructured field context helpers
• 1586cc7 fix(forms): annotate field context helpers with this: void
• 41b1897 fix(forms): don't crash when formControlName has no matching control
• cc515b8 perf(forms): use addEventListener to avoid unconditional CD scheduling on blur
• Additional commits viewable in compare view

Updates @angular/platform-browser from 17.3.10 to 22.2.4

Release notes

Sourced from @​angular/platform-browser's releases.

22.2.4

compiler

Commit	Description
	avoid treating attributes with object prototype names as being translated
	default to Eager change detection for pre-v22 libraries in JIT
	report errors for malformed template literal interpolations
	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Description
	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Description
	avoid mutating shared ICU case queue during i18n hydration
	avoid reloading a resource when params is unchanged
	catch view effect errors in targeted change detection mode
	check every i18n attribute translation for ICUs
	guard against integer overflow in i18n
	improve the warning for bindings on elements inside ICU expressions
	keep prototype-named keys in getTransferState
	avoid reading linked signal debug names in production
	guard i18n insertion assertion with ngDevMode

forms

Commit	Description
	annotate field context helpers with this: void
	don't crash when formControlName has no matching control
	reject unsupported updateOn in SignalFormControl
	match multi-select identities in a single pass

http

Commit	Description
	account for multiple cache control headers

language-service

Commit	Description
	resolve symbols for inputs with restricted access

migrations

Commit	Description
	migrate static string and array ngClass bindings to class

router

Commit	Description
	don't intercept downloads with the Navigation API
	drop null query params in createUrlTreeFromSnapshot
	escape colons in parenthesized primary child segments
	properly handle redirects during traversal navigations with Navigation API

... (truncated)

Commits

• 8c4e267 build(docs-infra): move framework API doc generation targets under //adev
• 1663b5e docs(platform-browser): link the styling guide from the namespacing APIs (#70...
• 6298b30 refactor(platform-browser): type async animation renderer
• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• ab0cfda refactor(platform-browser): type shadow DOM renderer fields
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• 83f7695 fix(core): throw coded RuntimeErrors instead of crashing when hydration/rende...
• 6f9a6be fix(platform-browser): disallow event handler attributes in Meta
• d35c17d refactor: correct typos in comments, docs, and error messages
• 1cb3d60 fix(platform-browser): throw a descriptive error when insertBefore reference ...
• Additional commits viewable in compare view

Updates @angular/platform-browser-dynamic from 17.3.10 to 20.0.7

Release notes

Sourced from @​angular/platform-browser-dynamic's releases.

19.2.25

platform-server

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

19.2.24

compiler

Commit	Description
	prevent namespaced SVG elements from being stripped

19.2.23

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry
	sanitize dynamic href and xlink:href bindings on SVG a elements
	strip namespaced SVG script elements during template compilation

core

Commit	Description
	reject script element as a dynamic component host
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation
	synchronize core sanitization schema with compiler
	wrap i18n dynamic element property updates in active index states

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	normalize path parsing in ServerPlatformLocation
	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Description
	preserve redirect policy on reconstructed asset requests
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

... (truncated)

Changelog

Sourced from @​angular/platform-browser-dynamic's changelog.

20.0.7 (2025-07-09)

compiler-cli

Commit	Type	Description
2c18043240	fix	use proper name for diagnostic type (#62479)

20.0.6 (2025-07-01)

20.0.5 (2025-06-25)

compiler-cli

Commit	Type	Description
de0d525ad7	fix	add suggestion when pipe is missing (#62146)
3eb5a79a83	fix	handle initializer APIs wrapped in type casts (#62203)

core

Commit	Type	Description
a2e6f317a7	fix	allow to set a resource in an error state (#62253)
4c00238a69	fix	avoid injecting ErrorHandler from a destroyed injector (#61886)
369f03ad7f	fix	unable to retrieve defer blocks in tests when component injects ViewContainerRef (#62156)

router

Commit	Type	Description
65c59dd796	fix	handle scrollRestoration error in restricted environments (#62186)

upgrade

Commit	Type	Description
144c429230	fix	Make zoneless work with hybrid apps (#61660)

20.0.4 (2025-06-18)

core

Commit	Type	Description
e343cdfb86	fix	Fixes template outlet hydration (#62012)
67f657e4a3	fix	inject APP_ID before injector is destroyed (#61885)
ae212b51ee	fix	Wrap ErrorEvent with no error property (#62081)

migrations

Commit	Type	Description
82bf9848a1	fix	more robust trailing comma removal in unused imports migration (#62118)

... (truncated)

Commits

• 31e3eb2 build: migrate to use web test runner rules (#62294)
• f201df9 build: migrate to using new jasmine_test (#62106)
• 8564cf4 build: replace all ng_package with new rule from rules_angular (#61862)
• 4fa2762 build: rework benchmarks and examples in modules/ to new optimization rule
• 968bbe9 build: migrate platform-browser and platform-browser-dynamic package to use r...
• 88c70eb refactor(platform-browser): replace platform-browser-dynamic with `platfor...
• 30e0812 fix(core): update min Node.js support to 20.19, 22.12, and 24.0 (#61500)
• 3433021 build: move private testing helpers outside platform-browser/testing (#61476)
• bc2cab7 refactor(platform-browser): Deprecate the platform-browser-dynamic package ...
• 1b4b44e refactor: add explicit types for exports relying on inferred call return type...
• Additional commits viewable in compare view

Updates @angular/platform-server from 17.3.10 to 22.2.4

Release notes

Sourced from @​angular/platform-server's releases.

22.2.4

compiler

Commit	Description
	avoid treating attributes with object prototype names as being translated
	default to Eager change detection for pre-v22 libraries in JIT
	report errors for malformed template literal interpolations
	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Description
	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Description
	avoid mutating shared ICU case queue during i18n hydration
	avoid reloading a resource when params is unchanged
	catch view effect errors in targeted change detection mode
	check every i18n attribute translation for ICUs
	guard against integer overflow in i18n
	improve the warning for bindings on elements inside ICU expressions
	keep prototype-named keys in getTransferState
	avoid reading linked signal debug names in production
	guard i18n insertion assertion with ngDevMode

forms

Commit	Description
	annotate field context helpers with this: void
	don't crash when formControlName has no matching control
	reject unsupported updateOn in SignalFormControl
	match multi-select identities in a single pass

http

Commit	Description
	account for multiple cache control headers

language-service

Commit	Description
	resolve symbols for inputs with restricted access

migrations

Commit	Description
	migrate static string and array ngClass bindings to class

router

Commit	Description
	don't intercept downloads with the Navigation API
	drop null query params in createUrlTreeFromSnapshot
	escape colons in parenthesized primary child segments
	properly handle redirects during traversal navigations with Navigation API

... (truncated)

Commits

• 8c4e267 build(docs-infra): move framework API doc generation targets under //adev
• 0206e52 refactor(core): move @​defer hydrate trigger registration inside binding check
• 5706791 fix(core): avoid mutating shared ICU case queue during i18n hydration
• eca5fa4 fix(core): don't crash initEventReplay when two apps share an APP_ID
• 928dcfd fix(platform-server): reject protocol-relative paths in resolveUrl
• d33f2d0 refactor(core): show the enclosing component in the NG0502 hydration error
• 5e621df fix(platform-server): preserve Unicode whitespace in ServerXhr URLs
• 1c91efc fix(core): wait for app stability before cleaning up dehydrated views
• bc3a6cd fix(platform-server): avoid sourcemap corruption during domino path substitution
• d470afa refactor(platform-server): ensure error boundaries work with ssr/hydration (#...
• Additional commits viewable in compare view

Updates @angular/router from 17.3.10 to 22.2.4

Release notes

Sourced from @​angular/router's releases.

22.2.4

compiler

Commit	Description
	avoid treating attributes with object prototype names as being translated
	default to Eager change detection for pre-v22 libraries in JIT
	report errors for malformed template literal interpolations
	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Description
	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Description
	avoid mutating shared ICU case queue during i18n hydration
	avoid reloading a resource when params is unchanged
	catch view effect errors in targeted change detection mode
	check every i18n attribute translation for ICUs
	guard against integer overflow in i18n
	improve the warning for bindings on elements inside ICU expressions
	keep prototype-named keys in getTransferState
	avoid reading linked signal debug names in production
	guard i18n insertion assertion with ngDevMode

forms

Commit	Description
	annotate field context helpers with this: void
	don't crash when formControlName has no matching control
	reject unsupported updateOn in SignalFormControl
	match multi-select identities in a single pass

http

Commit	Description
	account for multiple cache control headers

language-service

Commit	Description
	resolve symbols for inputs with restricted access

migrations

Commit	Description
	migrate static string and array ngClass bindings to class

router

Commit	Description
	don't intercept downloads with the Navigation API
	drop null query params in createUrlTreeFromSnapshot
	escape colons in parenthesized primary child segments
	properly handle redirects during traversal navigations with Navigation API

... (truncated)

Commits

• ea8cdc4 fix(router): skip split when piercing empty path outlets
• 8c4e267 build(docs-infra): move framework API doc generation targets under //adev
• d1da1a7 fix(router): drop null query params in createUrlTreeFromSnapshot
• 6ccbb0f fix(router): don't intercept downloads with the Navigation API
• 63bb1ed refactor(router): make setupAndRunResources consistently asynchronous
• 2f0e2ac fix(router): respect guard order when a guard throws a RedirectCommand
• 702ba3a fix(router): remove previous classes when routerLinkActive changes
• 12b553b fix(router): escape colons in parenthesized...

  Description has been truncated

  Samples Checklist

  ✅ All good!

  Note
  Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[defangdevs]

@dependabot rebase

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: cd8495c6-eb9c-4d4b-8ee8-846156613f3b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}