dependabot[bot] opened a new pull request, #5280: URL: https://github.com/apache/zeppelin/pull/5280
Bumps the zeppelin-web-angular-security-updates group with 8 updates in the /zeppelin-web-angular directory: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.15` | `21.2.17` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.15` | `21.2.17` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.15` | `21.2.17` | | [rollup](https://github.com/rollup/rollup) | `0.25.8` | `4.60.4` | | [hono](https://github.com/honojs/hono) | `4.12.23` | `4.12.28` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.0` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.8.4` | | [tar](https://github.com/isaacs/node-tar) | `7.5.15` | `7.5.19` | Updates `@angular/common` from 21.2.15 to 21.2.17 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases";>@angular/common's releases</a>.</em></p> <blockquote> <h2>21.2.17</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/86a56dc279e71159d09a073a3cb138f49131995b";><img src="https://img.shields.io/badge/86a56dc279-fix-green"; alt="fix - 86a56dc279" /></a></td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d846326b071e0a4ab090e068d934b182926c6b15";><img src="https://img.shields.io/badge/d846326b07-fix-green"; alt="fix - d846326b07" /></a></td> <td>skip transfer cache for uncacheable HTTP traffic</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/bc55749698ce3917160cd8e9f7108f3c5d1c0b32";><img src="https://img.shields.io/badge/bc55749698-fix-green"; alt="fix - bc55749698" /></a></td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/dc9c99636d3471ed5a3c5cda54b95f604cd2b9a4";><img src="https://img.shields.io/badge/dc9c99636d-fix-green"; alt="fix - dc9c99636d" /></a></td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/152306113760e13196653699b42046d9f4129a37";><img src="https://img.shields.io/badge/1523061137-fix-green"; alt="fix - 1523061137" /></a></td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/88832c84f8a3cd88d80adcde539a6f91a1f30b74";><img src="https://img.shields.io/badge/88832c84f8-fix-green"; alt="fix - 88832c84f8" /></a></td> <td>validate lowercase SVG animation attribute names (<a href="https://github.com/angular/angular/tree/HEAD/packages/common/issues/69269";>#69269</a>)</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/bcb1b7ea2575b140f7bf202ad4f779e402cd6094";><img src="https://img.shields.io/badge/bcb1b7ea25-fix-green"; alt="fix - bcb1b7ea25" /></a></td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a810a319d10a8254307eb8f0598e7a888ce09ec0";><img src="https://img.shields.io/badge/a810a319d1-fix-green"; alt="fix - a810a319d1" /></a></td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e245d40c4d05665ab4814c594b8e0849b6e88a2d";><img src="https://img.shields.io/badge/e245d40c4d-fix-green"; alt="fix - e245d40c4d" /></a></td> <td>skip transfer cache for fetch credentialed requests</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/35510746b7d6b5c3de41de04c0586fc286c9e748";><img src="https://img.shields.io/badge/35510746b7-fix-green"; alt="fix - 35510746b7" /></a></td> <td>harden platform location origin validation during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/13fb0afe93b45e3c2383969f70d3ee1f0146ecfb";><img src="https://img.shields.io/badge/13fb0afe93-refactor-yellow"; alt="refactor - 13fb0afe93" /></a></td> <td>deprecate ServerXhr (<a href="https://github.com/angular/angular/tree/HEAD/packages/common/issues/69255";>#69255</a>)</td> </tr> </tbody> </table> <h3>service-worker</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b9d29381bb4442164b19d9b7e0baa147a7b25629";><img src="https://img.shields.io/badge/b9d29381bb-fix-green"; alt="fix - b9d29381bb" /></a></td> <td>Strips sensitive headers on cross-origin redirects</td> </tr> </tbody> </table> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead.</li> </ul> <h2>21.2.16</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f6d8e642b0b215d2f9dbf1060abd24348c6cbf66";><img src="https://img.shields.io/badge/f6d8e642b0-fix-green"; alt="fix - f6d8e642b0" /></a></td> <td>only strip a literal /index.html suffix from URLs</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ae1c8a1f7a7f1d4832da3b22e3763864fa5ff098";><img src="https://img.shields.io/badge/ae1c8a1f7a-fix-green"; alt="fix - ae1c8a1f7a" /></a></td> <td>move projection attributes into constants</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/3fd6897a67fd6acdc01fcde0452a98c3e0f81e21";><img src="https://img.shields.io/badge/3fd6897a67-fix-green"; alt="fix - 3fd6897a67" /></a></td> <td>harden inherit definition feature against polluted prototypes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7e38336dc73e14d98cc6465f54e1b7d6271facb2";><img src="https://img.shields.io/badge/7e38336dc7-fix-green"; alt="fix - 7e38336dc7" /></a></td> <td>use Object.create(null) for LOCALE_DATA as a hardening measure</td> </tr> </tbody> </table> <h3>platform-server</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md";>@angular/common's changelog</a>.</em></p> <blockquote> <h1>21.2.17 (2026-06-10)</h1> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead.</li> </ul> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/86a56dc279e71159d09a073a3cb138f49131995b";>86a56dc279</a></td> <td>fix</td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d846326b071e0a4ab090e068d934b182926c6b15";>d846326b07</a></td> <td>fix</td> <td>skip transfer cache for uncacheable HTTP traffic</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/bc55749698ce3917160cd8e9f7108f3c5d1c0b32";>bc55749698</a></td> <td>fix</td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/dc9c99636d3471ed5a3c5cda54b95f604cd2b9a4";>dc9c99636d</a></td> <td>fix</td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/152306113760e13196653699b42046d9f4129a37";>1523061137</a></td> <td>fix</td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/88832c84f8a3cd88d80adcde539a6f91a1f30b74";>88832c84f8</a></td> <td>fix</td> <td>validate lowercase SVG animation attribute names (<a href="https://redirect.github.com/angular/angular/pull/69269";>#69269</a>)</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/bcb1b7ea2575b140f7bf202ad4f779e402cd6094";>bcb1b7ea25</a></td> <td>fix</td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a810a319d10a8254307eb8f0598e7a888ce09ec0";>a810a319d1</a></td> <td>fix</td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e245d40c4d05665ab4814c594b8e0849b6e88a2d";>e245d40c4d</a></td> <td>fix</td> <td>skip transfer cache for fetch credentialed requests</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/35510746b7d6b5c3de41de04c0586fc286c9e748";>35510746b7</a></td> <td>fix</td> <td>harden platform location origin validation during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/13fb0afe93b45e3c2383969f70d3ee1f0146ecfb";>13fb0afe93</a></td> <td>refactor</td> <td>deprecate ServerXhr (<a href="https://redirect.github.com/angular/angular/pull/69255";>#69255</a>)</td> </tr> </tbody> </table> <h3>service-worker</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b9d29381bb4442164b19d9b7e0baa147a7b25629";>b9d29381bb</a></td> <td>fix</td> <td>Strips sensitive headers on cross-origin redirects</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.25 (2026-06-10)</h1> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead.</li> </ul> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/9f443bc24c79dca998c9434d1e235dc19dc29bba";>9f443bc24c</a></td> <td>fix</td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/566ad05f20732c38855353c3e73771ef9a34dadc";>566ad05f20</a></td> <td>fix</td> <td>skip transfer cache for uncacheable HTTP traffic</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1a62130a6bb313e4441f005e480768a360c71be5";>1a62130a6b</a></td> <td>fix</td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/86a56dc279e71159d09a073a3cb138f49131995b";><code>86a56dc</code></a> fix(common): Limits date format string length</li> <li><a href="https://github.com/angular/angular/commit/bcb1b7ea2575b140f7bf202ad4f779e402cd6094";><code>bcb1b7e</code></a> fix(http): preserve empty referrer option in HttpRequest</li> <li><a href="https://github.com/angular/angular/commit/a810a319d10a8254307eb8f0598e7a888ce09ec0";><code>a810a31</code></a> fix(http): Rejects non-HTTP(S) URLs in JSONP requests</li> <li><a href="https://github.com/angular/angular/commit/bc55749698ce3917160cd8e9f7108f3c5d1c0b32";><code>bc55749</code></a> fix(common): use cryptographically secure SHA-256 for transfer cache key gene...</li> <li><a href="https://github.com/angular/angular/commit/d846326b071e0a4ab090e068d934b182926c6b15";><code>d846326</code></a> fix(common): skip transfer cache for uncacheable HTTP traffic</li> <li><a href="https://github.com/angular/angular/commit/e245d40c4d05665ab4814c594b8e0849b6e88a2d";><code>e245d40</code></a> fix(http): skip transfer cache for fetch credentialed requests</li> <li><a href="https://github.com/angular/angular/commit/f6d8e642b0b215d2f9dbf1060abd24348c6cbf66";><code>f6d8e64</code></a> fix(common): only strip a literal /index.html suffix from URLs</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.17/packages/common";>compare view</a></li> </ul> </details> <br /> Updates `@angular/compiler` from 21.2.15 to 21.2.17 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases";>@angular/compiler's releases</a>.</em></p> <blockquote> <h2>21.2.17</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/86a56dc279e71159d09a073a3cb138f49131995b";><img src="https://img.shields.io/badge/86a56dc279-fix-green"; alt="fix - 86a56dc279" /></a></td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d846326b071e0a4ab090e068d934b182926c6b15";><img src="https://img.shields.io/badge/d846326b07-fix-green"; alt="fix - d846326b07" /></a></td> <td>skip transfer cache for uncacheable HTTP traffic</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/bc55749698ce3917160cd8e9f7108f3c5d1c0b32";><img src="https://img.shields.io/badge/bc55749698-fix-green"; alt="fix - bc55749698" /></a></td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/dc9c99636d3471ed5a3c5cda54b95f604cd2b9a4";><img src="https://img.shields.io/badge/dc9c99636d-fix-green"; alt="fix - dc9c99636d" /></a></td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/152306113760e13196653699b42046d9f4129a37";><img src="https://img.shields.io/badge/1523061137-fix-green"; alt="fix - 1523061137" /></a></td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/88832c84f8a3cd88d80adcde539a6f91a1f30b74";><img src="https://img.shields.io/badge/88832c84f8-fix-green"; alt="fix - 88832c84f8" /></a></td> <td>validate lowercase SVG animation attribute names (<a href="https://github.com/angular/angular/tree/HEAD/packages/compiler/issues/69269";>#69269</a>)</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/bcb1b7ea2575b140f7bf202ad4f779e402cd6094";><img src="https://img.shields.io/badge/bcb1b7ea25-fix-green"; alt="fix - bcb1b7ea25" /></a></td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a810a319d10a8254307eb8f0598e7a888ce09ec0";><img src="https://img.shields.io/badge/a810a319d1-fix-green"; alt="fix - a810a319d1" /></a></td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e245d40c4d05665ab4814c594b8e0849b6e88a2d";><img src="https://img.shields.io/badge/e245d40c4d-fix-green"; alt="fix - e245d40c4d" /></a></td> <td>skip transfer cache for fetch credentialed requests</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/35510746b7d6b5c3de41de04c0586fc286c9e748";><img src="https://img.shields.io/badge/35510746b7-fix-green"; alt="fix - 35510746b7" /></a></td> <td>harden platform location origin validation during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/13fb0afe93b45e3c2383969f70d3ee1f0146ecfb";><img src="https://img.shields.io/badge/13fb0afe93-refactor-yellow"; alt="refactor - 13fb0afe93" /></a></td> <td>deprecate ServerXhr (<a href="https://github.com/angular/angular/tree/HEAD/packages/compiler/issues/69255";>#69255</a>)</td> </tr> </tbody> </table> <h3>service-worker</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b9d29381bb4442164b19d9b7e0baa147a7b25629";><img src="https://img.shields.io/badge/b9d29381bb-fix-green"; alt="fix - b9d29381bb" /></a></td> <td>Strips sensitive headers on cross-origin redirects</td> </tr> </tbody> </table> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead.</li> </ul> <h2>21.2.16</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f6d8e642b0b215d2f9dbf1060abd24348c6cbf66";><img src="https://img.shields.io/badge/f6d8e642b0-fix-green"; alt="fix - f6d8e642b0" /></a></td> <td>only strip a literal /index.html suffix from URLs</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ae1c8a1f7a7f1d4832da3b22e3763864fa5ff098";><img src="https://img.shields.io/badge/ae1c8a1f7a-fix-green"; alt="fix - ae1c8a1f7a" /></a></td> <td>move projection attributes into constants</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/3fd6897a67fd6acdc01fcde0452a98c3e0f81e21";><img src="https://img.shields.io/badge/3fd6897a67-fix-green"; alt="fix - 3fd6897a67" /></a></td> <td>harden inherit definition feature against polluted prototypes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7e38336dc73e14d98cc6465f54e1b7d6271facb2";><img src="https://img.shields.io/badge/7e38336dc7-fix-green"; alt="fix - 7e38336dc7" /></a></td> <td>use Object.create(null) for LOCALE_DATA as a hardening measure</td> </tr> </tbody> </table> <h3>platform-server</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md";>@angular/compiler's changelog</a>.</em></p> <blockquote> <h1>21.2.17 (2026-06-10)</h1> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead.</li> </ul> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/86a56dc279e71159d09a073a3cb138f49131995b";>86a56dc279</a></td> <td>fix</td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d846326b071e0a4ab090e068d934b182926c6b15";>d846326b07</a></td> <td>fix</td> <td>skip transfer cache for uncacheable HTTP traffic</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/bc55749698ce3917160cd8e9f7108f3c5d1c0b32";>bc55749698</a></td> <td>fix</td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/dc9c99636d3471ed5a3c5cda54b95f604cd2b9a4";>dc9c99636d</a></td> <td>fix</td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/152306113760e13196653699b42046d9f4129a37";>1523061137</a></td> <td>fix</td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/88832c84f8a3cd88d80adcde539a6f91a1f30b74";>88832c84f8</a></td> <td>fix</td> <td>validate lowercase SVG animation attribute names (<a href="https://redirect.github.com/angular/angular/pull/69269";>#69269</a>)</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/bcb1b7ea2575b140f7bf202ad4f779e402cd6094";>bcb1b7ea25</a></td> <td>fix</td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a810a319d10a8254307eb8f0598e7a888ce09ec0";>a810a319d1</a></td> <td>fix</td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e245d40c4d05665ab4814c594b8e0849b6e88a2d";>e245d40c4d</a></td> <td>fix</td> <td>skip transfer cache for fetch credentialed requests</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/35510746b7d6b5c3de41de04c0586fc286c9e748";>35510746b7</a></td> <td>fix</td> <td>harden platform location origin validation during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/13fb0afe93b45e3c2383969f70d3ee1f0146ecfb";>13fb0afe93</a></td> <td>refactor</td> <td>deprecate ServerXhr (<a href="https://redirect.github.com/angular/angular/pull/69255";>#69255</a>)</td> </tr> </tbody> </table> <h3>service-worker</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b9d29381bb4442164b19d9b7e0baa147a7b25629";>b9d29381bb</a></td> <td>fix</td> <td>Strips sensitive headers on cross-origin redirects</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.25 (2026-06-10)</h1> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead.</li> </ul> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/9f443bc24c79dca998c9434d1e235dc19dc29bba";>9f443bc24c</a></td> <td>fix</td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/566ad05f20732c38855353c3e73771ef9a34dadc";>566ad05f20</a></td> <td>fix</td> <td>skip transfer cache for uncacheable HTTP traffic</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1a62130a6bb313e4441f005e480768a360c71be5";>1a62130a6b</a></td> <td>fix</td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/dc9c99636d3471ed5a3c5cda54b95f604cd2b9a4";><code>dc9c996</code></a> fix(compiler): sanitize two-way properties</li> <li><a href="https://github.com/angular/angular/commit/ae1c8a1f7a7f1d4832da3b22e3763864fa5ff098";><code>ae1c8a1</code></a> fix(compiler): move projection attributes into constants</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.17/packages/compiler";>compare view</a></li> </ul> </details> <br /> Updates `@angular/core` from 21.2.15 to 21.2.17 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases";>@angular/core's releases</a>.</em></p> <blockquote> <h2>21.2.17</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/86a56dc279e71159d09a073a3cb138f49131995b";><img src="https://img.shields.io/badge/86a56dc279-fix-green"; alt="fix - 86a56dc279" /></a></td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d846326b071e0a4ab090e068d934b182926c6b15";><img src="https://img.shields.io/badge/d846326b07-fix-green"; alt="fix - d846326b07" /></a></td> <td>skip transfer cache for uncacheable HTTP traffic</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/bc55749698ce3917160cd8e9f7108f3c5d1c0b32";><img src="https://img.shields.io/badge/bc55749698-fix-green"; alt="fix - bc55749698" /></a></td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/dc9c99636d3471ed5a3c5cda54b95f604cd2b9a4";><img src="https://img.shields.io/badge/dc9c99636d-fix-green"; alt="fix - dc9c99636d" /></a></td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/152306113760e13196653699b42046d9f4129a37";><img src="https://img.shields.io/badge/1523061137-fix-green"; alt="fix - 1523061137" /></a></td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/88832c84f8a3cd88d80adcde539a6f91a1f30b74";><img src="https://img.shields.io/badge/88832c84f8-fix-green"; alt="fix - 88832c84f8" /></a></td> <td>validate lowercase SVG animation attribute names (<a href="https://github.com/angular/angular/tree/HEAD/packages/core/issues/69269";>#69269</a>)</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/bcb1b7ea2575b140f7bf202ad4f779e402cd6094";><img src="https://img.shields.io/badge/bcb1b7ea25-fix-green"; alt="fix - bcb1b7ea25" /></a></td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a810a319d10a8254307eb8f0598e7a888ce09ec0";><img src="https://img.shields.io/badge/a810a319d1-fix-green"; alt="fix - a810a319d1" /></a></td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e245d40c4d05665ab4814c594b8e0849b6e88a2d";><img src="https://img.shields.io/badge/e245d40c4d-fix-green"; alt="fix - e245d40c4d" /></a></td> <td>skip transfer cache for fetch credentialed requests</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/35510746b7d6b5c3de41de04c0586fc286c9e748";><img src="https://img.shields.io/badge/35510746b7-fix-green"; alt="fix - 35510746b7" /></a></td> <td>harden platform location origin validation during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/13fb0afe93b45e3c2383969f70d3ee1f0146ecfb";><img src="https://img.shields.io/badge/13fb0afe93-refactor-yellow"; alt="refactor - 13fb0afe93" /></a></td> <td>deprecate ServerXhr (<a href="https://github.com/angular/angular/tree/HEAD/packages/core/issues/69255";>#69255</a>)</td> </tr> </tbody> </table> <h3>service-worker</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b9d29381bb4442164b19d9b7e0baa147a7b25629";><img src="https://img.shields.io/badge/b9d29381bb-fix-green"; alt="fix - b9d29381bb" /></a></td> <td>Strips sensitive headers on cross-origin redirects</td> </tr> </tbody> </table> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead.</li> </ul> <h2>21.2.16</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f6d8e642b0b215d2f9dbf1060abd24348c6cbf66";><img src="https://img.shields.io/badge/f6d8e642b0-fix-green"; alt="fix - f6d8e642b0" /></a></td> <td>only strip a literal /index.html suffix from URLs</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ae1c8a1f7a7f1d4832da3b22e3763864fa5ff098";><img src="https://img.shields.io/badge/ae1c8a1f7a-fix-green"; alt="fix - ae1c8a1f7a" /></a></td> <td>move projection attributes into constants</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/3fd6897a67fd6acdc01fcde0452a98c3e0f81e21";><img src="https://img.shields.io/badge/3fd6897a67-fix-green"; alt="fix - 3fd6897a67" /></a></td> <td>harden inherit definition feature against polluted prototypes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7e38336dc73e14d98cc6465f54e1b7d6271facb2";><img src="https://img.shields.io/badge/7e38336dc7-fix-green"; alt="fix - 7e38336dc7" /></a></td> <td>use Object.create(null) for LOCALE_DATA as a hardening measure</td> </tr> </tbody> </table> <h3>platform-server</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md";>@angular/core's changelog</a>.</em></p> <blockquote> <h1>21.2.17 (2026-06-10)</h1> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead.</li> </ul> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/86a56dc279e71159d09a073a3cb138f49131995b";>86a56dc279</a></td> <td>fix</td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/d846326b071e0a4ab090e068d934b182926c6b15";>d846326b07</a></td> <td>fix</td> <td>skip transfer cache for uncacheable HTTP traffic</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/bc55749698ce3917160cd8e9f7108f3c5d1c0b32";>bc55749698</a></td> <td>fix</td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/dc9c99636d3471ed5a3c5cda54b95f604cd2b9a4";>dc9c99636d</a></td> <td>fix</td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/152306113760e13196653699b42046d9f4129a37";>1523061137</a></td> <td>fix</td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/88832c84f8a3cd88d80adcde539a6f91a1f30b74";>88832c84f8</a></td> <td>fix</td> <td>validate lowercase SVG animation attribute names (<a href="https://redirect.github.com/angular/angular/pull/69269";>#69269</a>)</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/bcb1b7ea2575b140f7bf202ad4f779e402cd6094";>bcb1b7ea25</a></td> <td>fix</td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a810a319d10a8254307eb8f0598e7a888ce09ec0";>a810a319d1</a></td> <td>fix</td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e245d40c4d05665ab4814c594b8e0849b6e88a2d";>e245d40c4d</a></td> <td>fix</td> <td>skip transfer cache for fetch credentialed requests</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/35510746b7d6b5c3de41de04c0586fc286c9e748";>35510746b7</a></td> <td>fix</td> <td>harden platform location origin validation during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/13fb0afe93b45e3c2383969f70d3ee1f0146ecfb";>13fb0afe93</a></td> <td>refactor</td> <td>deprecate ServerXhr (<a href="https://redirect.github.com/angular/angular/pull/69255";>#69255</a>)</td> </tr> </tbody> </table> <h3>service-worker</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/b9d29381bb4442164b19d9b7e0baa147a7b25629";>b9d29381bb</a></td> <td>fix</td> <td>Strips sensitive headers on cross-origin redirects</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.25 (2026-06-10)</h1> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead.</li> </ul> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/9f443bc24c79dca998c9434d1e235dc19dc29bba";>9f443bc24c</a></td> <td>fix</td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/566ad05f20732c38855353c3e73771ef9a34dadc";>566ad05f20</a></td> <td>fix</td> <td>skip transfer cache for uncacheable HTTP traffic</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1a62130a6bb313e4441f005e480768a360c71be5";>1a62130a6b</a></td> <td>fix</td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/88832c84f8a3cd88d80adcde539a6f91a1f30b74";><code>88832c8</code></a> fix(core): validate lowercase SVG animation attribute names (<a href="https://github.com/angular/angular/tree/HEAD/packages/core/issues/69269";>#69269</a>)</li> <li><a href="https://github.com/angular/angular/commit/35510746b7d6b5c3de41de04c0586fc286c9e748";><code>3551074</code></a> fix(platform-server): harden platform location origin validation during SSR</li> <li><a href="https://github.com/angular/angular/commit/bc55749698ce3917160cd8e9f7108f3c5d1c0b32";><code>bc55749</code></a> fix(common): use cryptographically secure SHA-256 for transfer cache key gene...</li> <li><a href="https://github.com/angular/angular/commit/d846326b071e0a4ab090e068d934b182926c6b15";><code>d846326</code></a> fix(common): skip transfer cache for uncacheable HTTP traffic</li> <li><a href="https://github.com/angular/angular/commit/e245d40c4d05665ab4814c594b8e0849b6e88a2d";><code>e245d40</code></a> fix(http): skip transfer cache for fetch credentialed requests</li> <li><a href="https://github.com/angular/angular/commit/152306113760e13196653699b42046d9f4129a37";><code>1523061</code></a> fix(core): harden TransferState restoration against DOM clobbering</li> <li><a href="https://github.com/angular/angular/commit/736c4ab7e6d9168dedd4cc08b4802ec0af40edee";><code>736c4ab</code></a> refactor(core): fix broken unit test.</li> <li><a href="https://github.com/angular/angular/commit/3fd6897a67fd6acdc01fcde0452a98c3e0f81e21";><code>3fd6897</code></a> fix(core): harden inherit definition feature against polluted prototypes</li> <li><a href="https://github.com/angular/angular/commit/7e38336dc73e14d98cc6465f54e1b7d6271facb2";><code>7e38336</code></a> fix(core): use Object.create(null) for LOCALE_DATA as a hardening measure</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.17/packages/core";>compare view</a></li> </ul> </details> <br /> Updates `vite` from 7.3.2 to 7.3.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases";>vite's releases</a>.</em></p> <blockquote> <h2>v7.3.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md";>CHANGELOG.md</a> for details.</p> <h2>v7.3.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md";>CHANGELOG.md</a> for details.</p> <h2>v7.3.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.3/packages/vite/CHANGELOG.md";>CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md";>vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.5...v7.3.6";>7.3.6</a> (2026-06-25)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>allow esbuild 0.28 (<a href="https://redirect.github.com/vitejs/vite/issues/22743";>#22743</a>) (<a href="https://github.com/vitejs/vite/commit/a24931e7934e80eff5895b89d9e612ad3ad3e1f4";>a24931e</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.3...v7.3.5";>7.3.5</a> (2026-06-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22572";>#22572</a>, reject windows alternate paths (<a href="https://redirect.github.com/vitejs/vite/issues/22574";>#22574</a>) (<a href="https://github.com/vitejs/vite/commit/8c1855607b7c9884c4565d897ee98899a008a2d0";>8c18556</a>)</li> <li><strong>deps:</strong> backport <a href="https://redirect.github.com/vitejs/vite/issues/22571";>#22571</a>, reject UNC paths for launch-editor-middleware (<a href="https://redirect.github.com/vitejs/vite/issues/22573";>#22573</a>) (<a href="https://github.com/vitejs/vite/commit/f20d64bef6e0ef1e4fa7a9783281c7bba0ce5292";>f20d64b</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li>skip v7.3.4 release (<a href="https://github.com/vitejs/vite/commit/8a6a0c9fc734dbfe293ac33a4954506ee50430e1";>8a6a0c9</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.3...v7.3.4";>7.3.4</a> (2026-06-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22572";>#22572</a>, reject windows alternate paths (<a href="https://redirect.github.com/vitejs/vite/issues/22574";>#22574</a>) (<a href="https://github.com/vitejs/vite/commit/8c1855607b7c9884c4565d897ee98899a008a2d0";>8c18556</a>)</li> <li><strong>deps:</strong> backport <a href="https://redirect.github.com/vitejs/vite/issues/22571";>#22571</a>, reject UNC paths for launch-editor-middleware (<a href="https://redirect.github.com/vitejs/vite/issues/22573";>#22573</a>) (<a href="https://github.com/vitejs/vite/commit/f20d64bef6e0ef1e4fa7a9783281c7bba0ce5292";>f20d64b</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.2...v7.3.3";>7.3.3</a> (2026-05-07)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>avoid destructure lowering for newer safari (<a href="https://redirect.github.com/vitejs/vite/issues/22346";>#22346</a>) (<a href="https://github.com/vitejs/vite/commit/5ab51c0f76f0896175e02ad797c1f5fe116d02f4";>5ab51c0</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/0a7b53ba230c6e68f502a89864534c607d393ab7";><code>0a7b53b</code></a> release: v7.3.6</li> <li><a href="https://github.com/vitejs/vite/commit/a24931e7934e80eff5895b89d9e612ad3ad3e1f4";><code>a24931e</code></a> feat: allow esbuild 0.28 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22743";>#22743</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/077945cb60df372a52cf999b6e532ba70fac7423";><code>077945c</code></a> release: v7.3.5</li> <li><a href="https://github.com/vitejs/vite/commit/8a6a0c9fc734dbfe293ac33a4954506ee50430e1";><code>8a6a0c9</code></a> chore: skip v7.3.4 release</li> <li><a href="https://github.com/vitejs/vite/commit/8c1855607b7c9884c4565d897ee98899a008a2d0";><code>8c18556</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572";>#22572</a>, reject windows alternate paths (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22574";>#22574</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/f20d64bef6e0ef1e4fa7a9783281c7bba0ce5292";><code>f20d64b</code></a> fix(deps): backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571";>#22571</a>, reject UNC paths for launch-editor-middleware (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/2";>#2</a>...</li> <li><a href="https://github.com/vitejs/vite/commit/ca31424cccb075c88131132b929a63527d0e2b69";><code>ca31424</code></a> release: v7.3.3</li> <li><a href="https://github.com/vitejs/vite/commit/5ab51c0f76f0896175e02ad797c1f5fe116d02f4";><code>5ab51c0</code></a> fix: avoid destructure lowering for newer safari (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22346";>#22346</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite/commits/v7.3.6/packages/vite";>compare view</a></li> </ul> </details> <br /> Updates `rollup` from 0.25.8 to 4.60.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/releases";>rollup's releases</a>.</em></p> <blockquote> <h2>v4.60.4</h2> <h2>4.60.4</h2> <p><em>2026-05-14</em></p> <h3>Bug Fixes</h3> <ul> <li>Improve stability of chunk hashes (<a href="https://redirect.github.com/rollup/rollup/issues/6362";>#6362</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6362";>#6362</a>: fix: stabilize chunk assignment across parallel file reads (<a href="https://github.com/sonukapoor";><code>@sonukapoor</code></a>, <a href="https://github.com/Sonu";><code>@Sonu</code></a> Kapoor, <a href="https://github.com/TrickyPi";><code>@TrickyPi</code></a>, <a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6370";>#6370</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6371";>#6371</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6372";>#6372</a>: chore(deps): update react monorepo to v19 (major) (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6373";>#6373</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6375";>#6375</a>: Resolve vulnerabilities (<a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> </ul> <h2>v4.60.2</h2> <h2>4.60.2</h2> <p><em>2026-04-18</em></p> <h3>Bug Fixes</h3> <ul> <li>Resolve a variable rendering bug when generating different formats from the same build (<a href="https://redirect.github.com/rollup/rollup/issues/6350";>#6350</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6327";>#6327</a>: docs: fix various typos in source and documentation (<a href="https://github.com/Abhi3975";><code>@Abhi3975</code></a>, <a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6331";>#6331</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6332";>#6332</a>: chore(deps): update codecov/codecov-action action to v6 (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6333";>#6333</a>: chore(deps): update dependency eslint-plugin-unicorn to v64 (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6334";>#6334</a>: fix(deps): update rust crate swc_compiler_base to v51 (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6335";>#6335</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6346";>#6346</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6347";>#6347</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6348";>#6348</a>: fix(deps): update swc monorepo (major) (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6349";>#6349</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6350";>#6350</a>: fix: reset variable render names between outputs in the same generate (<a href="https://github.com/barry3406";><code>@barry3406</code></a>, <a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6351";>#6351</a>: chore(deps): update minor/patch updates (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6352";>#6352</a>: chore(deps): update cross-platform-actions/action action to v1 (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6353";>#6353</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6354";>#6354</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6355";>#6355</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6356";>#6356</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate";><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6358";>#6358</a>: chore: remove cross-env from devDeps (<a href="https://github.com/K-tecchan";><code>@K-tecchan</code></a>)</li> </ul> <h2>v4.60.1</h2> <h2>4.60.1</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/blob/master/CHANGELOG-0.md";>rollup's changelog</a>.</em></p> <blockquote> <h1>rollup changelog</h1> <h2>0.68.2</h2> <p><em>2018-12-23</em></p> <h3>Bug Fixes</h3> <ul> <li>Do not assume hoisted variables to have been initialized (<a href="https://redirect.github.com/rollup/rollup/issues/2607";>#2607</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/2607";>#2607</a>: Fix an issues where hoisted variables were assumed to have been initialized (<a href="https://github.com/lye";><code>@lye</code></a>)</li> </ul> <h2>0.68.1</h2> <p><em>2018-12-19</em></p> <h3>Bug Fixes</h3> <ul> <li>Fix an issue with UMD wrappers where a variable is used without being defined (<a href="https://redirect.github.com/rollup/rollup/issues/2600";>#2600</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/2600";>#2600</a>: Fix UMD and IIFE wrapper issues and add comprehensive functional wrapper tests (<a href="https://github.com/lukastaegert";><code>@lukastaegert</code></a>)</li> </ul> <h2>0.68.0</h2> <p><em>2018-12-16</em></p> <h3>Breaking Changes</h3> <ul> <li><code>optimizeChunks</code> is renamed to <code>experimentalOptimizeChunks</code> to reflect this feature is not production-ready yet ( <a href="https://redirect.github.com/rollup/rollup/issues/2575";>#2575</a>)</li> </ul> <h3>Features</h3> <ul> <li>Plugins can iterate all module ids via <code>this.moduleIds</code> (<a href="https://redirect.github.com/rollup/rollup/issues/2565";>#2565</a>)</li> <li>Plugins can get graph information about a module via <code>this.getModuleInfo(id)</code> (<a href="https://redirect.github.com/rollup/rollup/issues/2565";>#2565</a>)</li> <li>Plugins and JS API users get more information about the generated chunks: <code>dynamicImports</code>, <code>facadeModuleId</code>, <code>isDynamicEntry</code>, <code>name</code> (<a href="https://redirect.github.com/rollup/rollup/issues/2575";>#2575</a>)</li> <li>Tree-shaken dynamic imports will no longer create chunks or influence chunking in any way (<a href="https://redirect.github.com/rollup/rollup/issues/2575";>#2575</a>)</li> <li>Dynamic imports will no longer follow the <code>entryFileNames</code> but the <code>chunkFileNames</code> property reflecting those are solely internally used (<a href="https://redirect.github.com/rollup/rollup/issues/2575";>#2575</a>)</li> <li>If there are chunk naming conflicts, entry chunks will always take precedence (<a href="https://redirect.github.com/rollup/rollup/issues/2575";>#2575</a>)</li> <li>If an entry facade is created, only the facade chunk is marked as <code>isEntry</code> (<a href="https://redirect.github.com/rollup/rollup/issues/2575";>#2575</a>)</li> <li>Dynamic chunks will only be marked as <code>isEntry</code> if they are actually entry chunks as well; thus there is now a 1-to-1 correspondence between modules listed in <code>input</code> and chunks marked as <code>isEntry</code> (<a href="https://redirect.github.com/rollup/rollup/issues/2575";>#2575</a>)</li> <li>Chunks no longer contain imports for variables that are tree-shaken in the chunk but used in other chunks (<a href="https://redirect.github.com/rollup/rollup/issues/2584";>#2584</a>)</li> <li>Chunks will always import re-exported variables directly from the chunk where they are originally exported from ( <a href="https://redirect.github.com/rollup/rollup/issues/2584";>#2584</a>)</li> <li>Null characters will be pruned from chunk ids to allow for virtually created chunks and make <code>rollup-plugin-multi-entry</code> compatible with code-splitting and thus the upcoming 1.0 version (<a href="https://redirect.github.com/rollup/rollup/issues/2590";>#2590</a>)</li> <li>Simplify the UMD wrapper code as much as possible, especially if there are no exports (<a href="https://redirect.github.com/rollup/rollup/issues/2594";>#2594</a>)</li> <li>The UMD wrapper will now work in strict mode by checking for <code>self</code> before <code>this</code> when determining the global variable (<a href="https://redirect.github.com/rollup/rollup/issues/2594";>#2594</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rollup/rollup/commit/d311a84b0bb4d4a6f50d19ffd2c29cca28660c88";><code>d311a84</code></a> 4.60.4</li> <li><a href="https://github.com/rollup/rollup/commit/6aa324854482e273b711972955d2d1b3bb445bcc";><code>6aa3248</code></a> fix: stabilize chunk assignment across parallel file reads (<a href="https://redirect.github.com/rollup/rollup/issues/6362";>#6362</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/82a0fe76b1372a2cf509fc4067d69f25569b83f5";><code>82a0fe7</code></a> Resolve vulnerabilities (<a href="https://redirect.github.com/rollup/rollup/issues/6375";>#6375</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/71f5ebc893d7ff76b5571d63b04ea2ed4a4ddd9d";><code>71f5ebc</code></a> chore(deps): update dependency lru-cache to v11 (<a href="https://redirect.github.com/rollup/rollup/issues/6371";>#6371</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/af91d778cdf564dd1ae1bfd6e92604ec031824a7";><code>af91d77</code></a> chore(deps): lock file maintenance (<a href="https://redirect.github.com/rollup/rollup/issues/6373";>#6373</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/65e7b94ddda9f02334fa8f12ff6bf699c1f07833";><code>65e7b94</code></a> chore(deps): update react monorepo to v19 (major) (<a href="https://redirect.github.com/rollup/rollup/issues/6372";>#6372</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/642587f3d9c5b4aa482a5027672f0fa8ea76da12";><code>642587f</code></a> fix(deps): update minor/patch updates (<a href="https://redirect.github.com/rollup/rollup/issues/6370";>#6370</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/b47bdabeccbb7aa1b1d4117f2f4a781a9f6de297";><code>b47bdab</code></a> 4.60.3</li> <li><a href="https://github.com/rollup/rollup/commit/15c5f33083c8c6b1b2cbae548124fffbba2553bb";><code>15c5f33</code></a> Add again some unneeded dev dependencies, to make some builds succeed</li> <li><a href="https://github.com/rollup/rollup/commit/12195dcebbd21f0f2d91e26720cd053526edbfe3";><code>12195dc</code></a> fix: do not rename nested "exports" bindings that do not conflict (<a href="https://redirect.github.com/rollup/rollup/issues/6360";>#6360</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rollup/rollup/compare/v0.25.8...v4.60.4";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for rollup since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Updates `hono` from 4.12.23 to 4.12.28 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases";>hono's releases</a>.</em></p> <blockquote> <h2>v4.12.28</h2> <h2>What's Changed</h2> <ul> <li>fix(serve-static): treat empty string content as found by <a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5062";>honojs/hono#5062</a></li> <li>docs(MIGRATION): fix req.raw.headers reference (property, not method) by <a href="https://github.com/EduardF1";><code>@EduardF1</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5047";>honojs/hono#5047</a></li> <li>chore: don't publish <code>*.tsbuildinfo</code> by <a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5066";>honojs/hono#5066</a></li> <li>fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by <a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5067";>honojs/hono#5067</a></li> <li>fix: avoid circular dependency between body.ts and request.ts by <a href="https://github.com/usualoma";><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5071";>honojs/hono#5071</a></li> <li>fix(bun): report the requested subprotocol on WSContext.protocol by <a href="https://github.com/greymoth-jp";><code>@greymoth-jp</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5059";>honojs/hono#5059</a></li> <li>chore: bump <code>devDependencies</code> by <a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5085";>honojs/hono#5085</a></li> <li>fix(aws-lambda): detect V2 events by request context, not rawPath alone by <a href="https://github.com/VihaanAgarwal";><code>@VihaanAgarwal</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5033";>honojs/hono#5033</a></li> <li>docs(context-storage): fix JSDoc by <a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5086";>honojs/hono#5086</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EduardF1";><code>@EduardF1</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/5047";>honojs/hono#5047</a></li> <li><a href="https://github.com/greymoth-jp";><code>@greymoth-jp</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/5059";>honojs/hono#5059</a></li> <li><a href="https://github.com/VihaanAgarwal";><code>@VihaanAgarwal</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/5033";>honojs/hono#5033</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.27...v4.12.28";>https://github.com/honojs/hono/compare/v4.12.27...v4.12.28</a></p> <h2>v4.12.27</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3>hono/jsx does not isolate context per request</h3> <p>Affects: <code>hono/jsx</code>, <code>hono/jsx-renderer</code>. During SSR, context was stored process-wide instead of per request, so <code>useContext()</code>/<code>useRequestContext()</code> read after an <code>await</code> in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj</p> <h3>Server-Side XSS via JSX escaping bypass in cx()</h3> <p>Affects: <code>hono/css</code>. <code>cx()</code> marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX <code>class</code> attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59</p> <h3>API Gateway v1 adapter can drop a repeated request header value</h3> <p>Affects: <code>hono/aws-lambda</code>. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. <code>203.0.113.1</code> dropped when <code>203.0.113.10</code> is present) — affecting logic such as <code>X-Forwarded-For</code>-based IP restriction. GHSA-xgm2-5f3f-mvvc</p> <hr /> <p>Users of <code>hono/jsx</code>/<code>hono/jsx-renderer</code>, <code>hono/css</code> (<code>cx()</code>), or the <code>hono/aws-lambda</code> API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.</p> <h2>v4.12.26</h2> <h2>What's Changed</h2> <ul> <li>fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by <a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5013";>honojs/hono#5013</a></li> <li>ci: publish to npm from CI with OIDC trusted publishing by <a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5028";>honojs/hono#5028</a></li> <li>chore: remove unused devcontainer and gitpod configs by <a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5029";>honojs/hono#5029</a></li> <li>chore: replace arg and glob with Bun native APIs in build script by <a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5030";>honojs/hono#5030</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.26";>https://github.com/honojs/hono/compare/v4.12.25...v4.12.26</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/626b185d0e80fa1c2a3cc1a8945afd0df6aaf3ec";><code>626b185</code></a> 4.12.28</li> <li><a href="https://github.com/honojs/hono/commit/d6b1d32a697ef9ba9f5036753fe9bde1121c0ff9";><code>d6b1d32</code></a> docs(context-storage): fix JSDoc (<a href="https://redirect.github.com/honojs/hono/issues/5086";>#5086</a>)</li> <li><a href="https://github.com/honojs/hono/commit/45b081b9b90244a03444f9781d7777cbe620e6b4";><code>45b081b</code></a> fix(aws-lambda): detect V2 events by request context, not rawPath alone (<a href="https://redirect.github.com/honojs/hono/issues/5033";>#5033</a>)</li> <li><a href="https://github.com/honojs/hono/commit/a05813c0586cd8ee7873dab8158c08a5f772a9ed";><code>a05813c</code></a> chore: bump <code>devDependencies</code> (<a href="https://redirect.github.com/honojs/hono/issues/5085";>#5085</a>)</li> <li><a href="https://github.com/honojs/hono/commit/872997d2836dad3849817b6270d857d92f3dee85";><code>872997d</code></a> fix(bun): report the requested subprotocol on WSContext.protocol (<a href="https://redirect.github.com/honojs/hono/issues/5059";>#5059</a>)</li> <li><a href="https://github.com/honojs/hono/commit/82b321b5b0e7a57cdaab45f2f90671ec0737795b";><code>82b321b</code></a> fix: avoid circular dependency between body.ts and request.ts (<a href="https://redirect.github.com/honojs/hono/issues/5071";>#5071</a>)</li> <li><a href="https://github.com/honojs/hono/commit/b20d4225c9aa9e615717ca74e437852cc9fd5b94";><code>b20d422</code></a> fix(utils/body,validator): normalize Content-Type media type for case-insensi...</li> <li><a href="https://github.com/honojs/hono/commit/9728702911073aec5a63a3ba2840b7240e5d3205";><code>9728702</code></a> chore: don't publish <code>*.tsbuildinfo</code> (<a href="https://redirect.github.com/honojs/hono/issues/5066";>#5066</a>)</li> <li><a href="https://github.com/honojs/hono/commit/ed8795e5cc49e83649c1ebbf4b72154a87abba19";><code>ed8795e</code></a> docs(MIGRATION): fix req.raw.headers reference (property, not method) (<a href="https://redirect.github.com/honojs/hono/issues/5047";>#5047</a>)</li> <li><a href="https://github.com/honojs/hono/commit/03a9416a13a681028011e23841ba89d1dd6c9a62";><code>03a9416</code></a> fix(serve-static): treat empty string content as found (<a href="https://redirect.github.com/honojs/hono/issues/5062";>#5062</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.28";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for hono since your current version.</p> </details> <br /> Updates `http-proxy-middleware` from 2.0.9 to 2.0.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/chimurai/http-proxy-middleware/releases";>http-proxy-middleware's releases</a>.</em></p> <blockquote> <h2>v2.0.10-beta.0</h2> <h2>What's Changed</h2> <ul> <li>fix: harden proxy-table matching to prevent routing bypass by <a href="https://github.com/G-Rath";><code>@G-Rath</code></a> in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1268";>chimurai/... _Description has been truncated_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
