mirror of
https://github.com/zitadel/zitadel.git
synced 2026-08-19 01:14:48 -05:00
561da54ff71741e95ef185cb96800e4f8a8686da
4502
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  zitadel-knowledge-bot[bot]andzitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>
|
561da54ff7 |
docs: update knowledge gap from thread 1517531035175354430 (#12352)
Automatically generated PR targeting 1 files. **Thread ID:** 1517531035175354430 **Action:** UPDATE **AI Summary:** > Documentation does not explain what happens when users bookmark the login page or access ZITADEL without an OIDC flow, particularly regarding redirect behavior and the purpose of organization Default Redirect URI settings. Co-authored-by: zitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com> |
||
 Max Peintner
|
3a18cef281 |
fix: prevent double triggering of verification emails (#11995)
# Which Problems Are Solved This fixes a critical bug where initial verification emails (or invite codes) were occasionally sent twice, invalidating the first code and confusing users. Previously, the initial verification email was triggered via a `send=true` URL parameter executing inside a frontend useEffect exactly when the `/verify` page mounted. This was fragile and prone to race conditions caused by component remounts or partial hydration. # How the Problems Are Solved - Removed `send=true` from URL state and ripped out the doSend effect in `VerifyForm.tsx`. - Shifted execution strictly to the Next.js server. The email is now automatically dispatched via await `initialSendVerification(...)` during the POST requests (acting over `sendLoginname`, `register`, `password`, `passkeys`, and `idp`). - The login flow is now idempotent and robust against unintended frontend re-renders. - Refactored `checkEmailVerification()` to be async and updated the associated unit-test coverage (all tests passing). |
||
 
|
14874d6546 |
fix(login): Prevent IDP auto-creation failure when name fields are missing (#11070)
# Which Problems Are Solved
When using IDP auto-creation, the addHuman() call would fail if the IDP
didn't provide required profile fields (givenName or familyName),
resulting in a poor user experience.
# How the Problems Are Solved
Added validation before auto-creation to check if required profile
fields are present. If givenName or familyName is missing, users are now
redirected to the complete-registration page where they can manually
provide the missing information.
- Added profile field validation in CASE 4 (auto-creation) of
processIDPCallback
- Redirect to /idp/{provider}/complete-registration when required fields
are missing
- Pre-fill any available user data in the registration form
---------
Co-authored-by: David Skewis <david@zitadel.com>
Co-authored-by: Florian Forster <florian@zitadel.com>
|
||
 Federico Coppede
|
f96080a4c1 | docs: update applications image (#12331) | ||
|
zitadel-knowledge-bot[bot]zitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>fcoppede |
9ccafca12b |
docs: update knowledge gap from thread 1512031509387673610 (#12328)
Automatically generated PR targeting 1 files. **Thread ID:** 1512031509387673610 **Action:** UPDATE **AI Summary:** > The documentation lacks clear explanation of how the 'Use new login UI' checkbox and 'Custom base URL for the new Login UI' field work together, including step-by-step configuration and troubleshooting guidance. --------- Co-authored-by: zitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com> Co-authored-by: fcoppede <fcoppede@gmail.com> |
||
 
|
2397247925 |
fix(login): improve contrast of IDP processing message (#12309)
# Which Problems Are Solved This improves the contrast of the “Processing authentication...” message shown while Login V2 processes the IDP authentication flow. The previous style used text-gray-600 without a dark-mode variant. This color is hard-coded in the component and is not affected by the branding colors, so users may see low contrast depending on the active theme/background. This PR updates the message text to use a higher-contrast light/dark color pair. --------- Co-authored-by: Max Peintner <max@caos.ch> Co-authored-by: Max Peintner <peintnerm@gmail.com> |
||
|
zitadel-knowledge-bot[bot]andzitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>
|
64b1a7d42b |
docs: update knowledge gap from thread manual-1782237446658 (#12323)
Automatically generated PR targeting 1 files. **Thread ID:** manual-1782237446658 **Action:** UPDATE **AI Summary:** > Need to add a note on this page to encourage users with active subscriptions to link their github and Discord account because that will help github issues get higher priority and discord threads as well Co-authored-by: zitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com> |
||
 Wim Van Laer
|
2399513643 |
Merge commit from fork
* fix: added client and scope validation for token exchange Verify that the token exchange is not cross client Only yield scopes which were already on the initial token * comments * added test |
||
 Livio Spring
|
76fd6d859d |
Merge commit from fork
* fix: ensure external user's email is verified before auto-linking * fix linking |
||
|
Max Peintner
|
239620f112 |
fix(login): center text for generic IDP buttons without icons (#12211)
Closes #12182 # Which Problems Are Solved Generic IDP buttons (OIDC, SAML, LDAP, JWT) used pl-20 to approximate icon offset alignment, but since they have no icon, the text appeared misaligned compared to branded IDPs (Google, Microsoft, Apple). # How the Problems Are Solved Replaced the left-padding hack with centered text so generic IDP names display cleanly within the button. before: <img width="392" height="290" alt="Screenshot 2026-05-28 at 12 03 21" src="https://github.com/user-attachments/assets/64c4e8eb-caec-4742-b61c-e3b0c5093dd7" /> after: <img width="392" height="289" alt="Screenshot 2026-05-28 at 12 07 27" src="https://github.com/user-attachments/assets/d1faf1f4-0aab-475f-8801-15b461e15da4" /> |
||
|
Max Peintner
|
f691851d32 | Merge commit from fork | ||
 SilvanandLivio Spring
|
10087e7389 |
fix: connection handling in setup after migration steps 40, 64 and 70 (#12293)
# Which Problems Are Solved During the setup step we saw rare cases which caused setup to fail after executing steps 40, 64 and 70. # How the Problems Are Solved Close currently open database connections so that they fetch the correct type mapping for the `eventstore.command2` database type. # Additional Changes Ensure correct order of setup steps 64 and 70. # Additional Context None --------- Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com> |
||
|
Livio Spring
|
dbb0da71af |
fix: remove unnecessary entry from default denylist (#12294)
# Which Problems Are Solved The updated default denylist added an entry for IPv4-mapped IPv6 addresses to prevent IPv6 encapsulation bypasses. This is not necessary since the IP already gets resolved into v4 and now blocks them all. # How the Problems Are Solved Removed the entry. # Additional Changes None # Additional Context None |
||
 Gayathri Vijayan
|
0973b074b4 |
Merge commit from fork
* fix: client_id verification during code exchange and refresh token flows * add clientID check for device token flow * Trigger Build |
||
 Tim Möhlmann
|
e94d4c3986 |
feat(crypto): FIPS 140-3 compliant build and runtime checks (#12233)
# Which Problems Are Solved Enable FIPS 140-3 compliant build. # How the Problems Are Solved - Add runtime config validation, if the FIPS flag is enabled fail the application when a non-compliant hasher is used, or throw a warning when a legacy verifier is used - Add a build matrix for FIPS certified build: - Go binary is built with `GOFIPS140=certified` - Login container uses a separate base: [ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e) from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS stack) - Non-FIPS images where already pushed to both Github Container Registry and Google Artifact Repository (GAR). Fips images are only pushed to the GAR. - Tag versions are suffixed `-fips`. So on release the following images will be additionally available: ``` europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips ``` # Other changes - Bumb Go toolchain. At least v1.25.10 is required for a GOFIPS140=certified setting. # Additional Context - Closes https://github.com/zitadel/zitadel/issues/4335 - Build [test run](https://github.com/zitadel/zitadel/actions/runs/27253916052) pushing FIPS and non-FIPS images |
||
|
Max Peintner
|
fdafb95a63 |
fix(login): load custom font from branding settings and allow in CSP (#12279)
Closes #11200 # Which Problems Are Solved Custom fonts uploaded via the branding/label policy were not supported. # How the Problems Are Solved - The login now correctly applies the branding settings, based on the organization context - Use the absolute `fontUrl` from the branding API directly in the `@font-face` `src`, matching how logo and icon assets are already loaded via absolute URLs. - Add the Zitadel service URL to the `font-src` CSP directive so the browser permits loading the cross-origin font. # Additional Changes - Updated CSP tests to reflect the new `font-src` behavior. |
||
 Marco A.andLivio Spring
|
8e82ec1cb9 |
Merge commit from fork
* Add DenyLists parsing * Remove unneeded returned error * Plug global denylist into Command * app creation: apply denylist to backchannel logout URI * Inject denylist to backchannel logout worker * webhook config: validate against blocked URLs * Add notificationsWebhook denylist target * command: Add SMTP endpoint validation against blocklist * command: Add SMS endpoint validation against blocklist * Validate webhook endpoint against denylist on channel notification * Remove unused tests * handle deprecated denylists * remove unintended denylist entry in deprecated list * use single http client * fix tests * update comments * fixes * cleanup * address comments * fix merge --------- Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com> |
||
|
Livio Spring
|
d184e976fc |
Merge commit from fork
* feat(jwt idp): manage and validate audience * translations * fix tests * address comments * update migration version * fix merge |
||
|
Livio Spring
|
fad02c6d9f | Merge commit from fork | ||
 Silvanandabhishek kumar gupta
|
6082e59d47 |
fix(eventstore): allow overwriting resource owner of events (#12261)
# Which Problems Are Solved - The eventstore did not support intentionally overwriting the resource owner when creating events for aggregates that may be reused across owners. - Resource owner handling was implicit and could not be controlled per command/event type. - We needed a safe way to distinguish between: - keeping the existing aggregate owner, and - explicitly setting a new owner for specific create-like events. # How the Problems Are Solved - Introduced a new eventstore command type with an explicit enforce_owner flag. - Updated eventstore.commands_to_events and eventstore.push so owner assignment is now explicit: - if enforce_owner is true, the command owner is written - if enforce_owner is false, the existing aggregate owner is retained when present - Added EnforceResourceOwnerCommand and wiring so command types can opt in to enforced owner behavior. - Wired the new behavior through the v3 eventstore push path, including compatibility fallback for older command type mapping. - Added migration/setup changes to register and use the new command type and SQL functions. - Added and updated tests for owner overwrite and aggregate ID reuse scenarios. # Additional Changes - Added small migration/setup robustness improvements related to eventstore setup ordering and helper reuse. - Added focused test coverage for enforced owner behavior and sequencing. - Events that currently allow owner changes (implement EnforceResourceOwner) are: - AddedEvent (action) - GroupAddedEvent - StartedEvent (idp intent) - ProjectAddedEvent - HumanAddedEvent - HumanRegisteredEvent - MachineAddedEvent - CreatedEvent (schema user) # Additional Context - Follow-up for eventstore owner-handling correctness in create flows and aggregate ID reuse cases. - No additional issue link was attached for this change. --------- Co-authored-by: abhishek kumar gupta <abhishek818t@gmail.com> |
||
|
Max Peintner
|
4459a1380c |
fix(login): accept IDP sessions on passkey registration (#12275)
# Which Problems Are Solved The local `isSessionValid` in `passkeys.ts` only checked `password` and `webAuthN` factors, so sessions authenticated via an external IDP (`intent` factor) were treated as invalid. This caused a "You have to authenticate" error when redirecting to `/passkey/set` after IDP login. # How the Problems Are Solved Added `session.factors.intent.verifiedAt` to the validity check, consistent with the canonical `isSessionValid` in `session.ts`. |
||
 Evan
|
cf4554b82c |
fix(idp): apply PKCE when building OAuth and OIDC providers (#12247)
# Which Problems Are Solved
- IDP intent authorization redirects used by Login v2 ignored the
configured `UsePKCE` setting for Generic OAuth providers
- This caused providers such as X/Twitter OAuth2 to receive
authorization requests without `code_challenge` and
`code_challenge_method`
- OIDC provider construction had the same gap, even though PKCE is
already part of the provider configuration model
- Existing IDP intent redirect tests expected non-PKCE OAuth URLs and
failed once PKCE was applied correctly
# How the Problems Are Solved
- Updated `OAuthIDPWriteModel.ToProvider` in
internal/command/idp_model.go to pass `rp.WithPKCE(nil)` when `UsePKCE`
is enabled
- Updated `OIDCIDPWriteModel.ToProvider` to apply the same PKCE
relying-party option for OIDC providers
# Additional Changes
- Added focused provider-construction tests covering:
- OAuth provider redirects include code_challenge
- OIDC provider redirects include code_challenge
- both providers use code_challenge_method=S256
- both persist the generated codeVerifier for token exchange
- Updated `TestCommands_AuthFromProvider` in
internal/command/idp_intent_test.go so OAuth redirect assertions verify
PKCE structurally instead of hard-coding the generated challenge value
# Additional Context
- Reproduced with X/Twitter OAuth2 where the generated authorization URL
was missing PKCE parameters despite `usePkce: true`
- Verified both the focused PKCE tests and the full unit test suite run
successfully with the fix
- Closes #12036
- Closes/supersedes #12054:
- Tests are included
- No slice re-allocation on `opts` append
# Result
### Before
`authUrl` in `StartIdentityProviderIntent` response is missing
`code_challenge` and `code_challenge_method` for Generic OAuth IDP with
PKCE enabled:
```json
{
"details": {
"sequence": "1",
"changeDate": "2026-06-07T18:48:16.921317Z",
"resourceOwner": "376298239768395779"
},
"authUrl": "https://x.com/i/oauth2/authorize?client_id=<REDACTED>&prompt=select_account&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fidps%2Fcallback&response_type=code&scope=tweet.read+users.email+users.read+offline.access&state=376417136207200259"
}
```
### After
`code_challenge` and `code_challenge_method` are correctly included into
`authUrl`:
```json
{
"details": {
"sequence": "1",
"changeDate": "2026-06-07T18:49:39.488941Z",
"resourceOwner": "376298239768395779"
},
"authUrl": "https://x.com/i/oauth2/authorize?client_id=<REDACTED>&code_challenge=8G4vN8QNgSsbvGSHKwYPEc2qUYU2BK5L0fsr992duTA&code_challenge_method=S256&prompt=select_account&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fidps%2Fcallback&response_type=code&scope=tweet.read+users.email+users.read+offline.access&state=376417274736672771"
}
```
|
||
 Maximilian
|
c5463b51ff |
docs: Update security.md (#12267)
We introduce a common vulnerabiltiy policy and a from for reporting vulnerabilties. |
||
 MaximilianandCopilot Autofix powered by AI
|
385c5ae54b |
docs: Update restrict console guide (#12262)
<!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved The projects setting texts and sceenshot where outdated. # How the Problems Are Solved Update the text and screenshot. # Additional Changes * Rewording * Lockout warning component --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Max Peintner
|
b27fdfc28c |
chore: update dependencies (#12242)
# Which Problems Are Solved Fixes multiple high-severity Dependabot alerts for transitive dependencies (axios, protobufjs, systeminformation, tmp, fast-uri, @babel/plugin-transform-modules-systemjs). # How the Problems Are Solved **Direct dependency updates:** - `@opentelemetry/*` 0.217 → 0.218 in login (new otlp-transformer dropped protobufjs as direct dep) - `posthog-js` 1.374 → 1.380 in console (dropped the OpenTelemetry/protobufjs chain entirely) **pnpm overrides** for remaining transitive deps that can't be updated via their parents (all pulled by the gRPC stack, Cypress, karma, nx, or ajv): - `axios` → ≥1.17.0 (prototype pollution, proxy bypass) - `protobufjs` → ≥7.5.7 / ≥8.0.2 (code injection, prototype pollution, DoS) - `systeminformation` → ≥5.31.6 (command injection) - `tmp` → ≥0.2.6 (path traversal) - `fast-uri` → ≥3.1.2 (path traversal, host confusion) **Benchmark:** refreshed `package-lock.json` to resolve @babel and fast-uri alerts. |
||
|
Marco A.
|
ed09b3df7f | Merge commit from fork | ||
|
|
25e263394e |
chore: update passwap v0.12.1 and align hash validation defaults/errors (#12179)
# Which Problems Are Solved - Upgrading to `zitadel/passwap` v0.12.1 introduced new encoded-hash validation paths that still had review feedback open. - Secret hasher defaults were internally inconsistent (`Hasher.Cost: 4` vs `Limits.Bcrypt.MinCost: 10`), which could reject hashes created by the configured hasher. - New validation error IDs/messages and test coverage needed to be aligned with project conventions and expected behavior branches. # How the Problems Are Solved - Kept the dependency upgrade to `zitadel/passwap` v0.12.1 and completed the validation integration. - Updated `ValidateEncodedHash` error handling in `internal/crypto/passwap.go` to: - use unique random-style error IDs, - return `Errors.Hash.NotSupported` for no-verifier cases, - keep invalid-hash branches mapped to invalid argument errors. - Expanded `TestHasher_ValidateEncodedHash` in `internal/crypto/passwap_test.go` to cover and assert: - bounds error branch, - no-verifier branch, - generic invalid-hash branch, - expected ZITADEL error IDs/messages. - Restored lost inline verifier-context comments for argon2 and md5plain verifier entries. # Additional Changes - Added the missing explanatory `Limits` comment for `SecretHasher` in `cmd/defaults.yaml`. - Corrected `SecretHasher.Limits.Bcrypt.MinCost` from `10` to `4` to match the configured default bcrypt cost and avoid configuration footguns. # Additional Context - Follow-up for PR review feedback in https://github.com/zitadel/zitadel/pull/12179#pullrequestreview-4313121965 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com> |
||
|
|
f85a2373c5 |
chore(test): streamline integration tests for instance management (#12243)
- Removed redundant relational instance handling in integration tests for adding and removing custom domains. - Simplified test cases by consolidating instance creation and context management. - Enhanced clarity and maintainability of test logic by reducing complexity in test structures. # Which Problems Are Solved `backed/v3` tests are flaky, but the code is not productive. Development is paused for the moment. Disabling flaky tests helps us to maintain the product easier. # How the Problems Are Solved - Removed redundant relational instance handling in integration tests for adding and removing custom domains. - Simplified test cases by consolidating instance creation and context management. - Enhanced clarity and maintainability of test logic by reducing complexity in test structures.newly introduced terms). # Additional Context - related to https://github.com/zitadel/zitadel/pull/12241 --------- Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Tim Möhlmann
|
7019a03ec4 |
chore(test): disable event_testing in backend/v3 (#12241)
# Which Problems Are Solved `backed/v3` tests are flaky, but the code is not productive. Development is paused for the moment. Disabling flaky tests helps us to maintain the product easier. # How the Problems Are Solved - Removed 'events_testing' from the integration test command in both `CONTRIBUTING.md` and `apps/api/project.json` to streamline the testing process. - Adjusted the command to ensure it only includes relevant integration tests, improving clarity and focus for contributors. |
||
|
cdc6c43d09 |
fix: update dependencies (#12216)
# Which Problems Are Solved Fixes open vulnerabilities # How the Problems Are Solved Updated npm/js dependencies across console, new login v2, and docs Based on https://github.com/zitadel/zitadel/pull/12164 --------- Co-authored-by: conblem <mail@conblem.me> Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com> |
||
|
|
fc6e2a0f05 |
fix(login): retry logic for session creation after registration on NotFound (#12189)
After user registration, the backend projections may not be up to date
yet when the Login UI immediately tries to create a session. This
results in a `QUERY-Dfbg2` ("User could not be found") error even though
the user was created successfully.
This adds retry logic with backoff (500ms/1s/2s, up to 3 attempts)
around `createSessionAndUpdateCookie` in the registration flow. Only
`NotFound` errors are retried — other errors are thrown immediately.
Closes #12173
---------
Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
||
 Florian ForsterandClaude Opus 4.7
|
f4f43f5248 |
docs: fix broken GitHub code-reference blocks after fumadocs migration (#12213)
# Which Problems Are Solved Pages in `apps/docs` that embed source from GitHub via the Docusaurus convention ```` ```js reference https://github.com/zitadel/actions/blob/main/examples/org_metadata_claim.js ``` ```` stopped working after the migration from Docusaurus to fumadocs. The old `docusaurus-theme-github-codeblock` plugin used to fetch the file and render it; fumadocs has no support for that meta, so the page rendered the raw URL as plain code-block text. Visible at `/docs/apis/actions/code-examples` and 16 other pages. # How the Problems Are Solved - Converted every ```` ```<lang> reference\n<URL>\n``` ```` block (46 total across 17 `.mdx` files) to the native fumadocs JSX form: `<GithubCodeBlock url="<URL>" />`. The existing `<details>`/`<summary>` collapsibles around blocks are kept — they're an authoring choice, not part of the rendering bug. - Updated `apps/docs/components/github-code-block.tsx` to render via `DynamicCodeBlock` from `fumadocs-ui/components/dynamic-codeblock` (proper shiki highlighting) instead of raw `CodeBlock` + `Pre` (which produced unhighlighted output). Also fixed language detection so a URL hash like `#L10-L20` no longer pollutes the language token. - Registered `GithubCodeBlock` globally in `apps/docs/mdx-components.tsx`, matching how every other shared component (`APIPage`, `Callout`, `Tab/Tabs`, `Step/Steps`, `Admonition`, `TerminologyUpdate`) is exposed. MDX files no longer need a local `import`. # Additional Changes - Normalized the two MDX files that were already using the JSX form (`examples/secure-api/python-django.mdx`, `examples/secure-api/java-spring.mdx`): removed their now-redundant local `import { GithubCodeBlock }` and rewrote 9 long-form `<GithubCodeBlock url="..."></GithubCodeBlock>` tags to self-closing for consistency. # Additional Context Verified locally with `pnpm --filter @zitadel/docs dev`: - `/docs/apis/actions/code-examples` — 20 shiki-highlighted code blocks rendered inside the `<details>` collapsibles (was 0). - `/docs/apis/openidoauth/claims` — line-range hashes (`#L9-L11`) honored. - `/docs/examples/login/flutter` — mixed languages (xml/dart/html) detected and highlighted. - `/docs/guides/integrate/external-audit-log` — edge case of fenced reference indented inside a numbered list also converted and rendered. Greps: - `^[ \t]*\`\`\`[a-zA-Z0-9]+ reference` in `apps/docs/content/**/*.mdx` → 0 matches. - `<GithubCodeBlock url="` in `apps/docs/content/**/*.mdx` → 55 matches. - `from '@/components/github-code-block'` in `apps/docs/content/**/*.mdx` → 0 matches. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Marco A.
|
c73e58489b |
chore(deps): Update go-ntlmssp (#12193)
# Which Problems Are Solved Dependabot signalling that go-ntlmssp requires an update # How the Problems Are Solved `go get -u` |
||
 |
349451b028 |
chore(deps): bump the console group across 1 directory with 31 updates (#12183)
Bumps the console group with 31 updates in the /console directory: | Package | From | To | | --- | --- | --- | | [@angular/animations](https://github.com/angular/angular/tree/HEAD/packages/animations) | `21.2.10` | `21.2.13` | | [@angular/cdk](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.10` | `21.2.13` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.10` | `21.2.13` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.10` | `21.2.13` | | [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `21.2.10` | `21.2.13` | | [@angular/material](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/material-moment-adapter](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `21.2.10` | `21.2.13` | | [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) | `21.2.10` | `21.2.13` | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `21.2.10` | `21.2.13` | | [@angular/service-worker](https://github.com/angular/angular/tree/HEAD/packages/service-worker) | `21.2.10` | `21.2.13` | | [@tanstack/angular-query-experimental](https://github.com/TanStack/query/tree/HEAD/packages/angular-query-experimental) | `5.100.5` | `5.100.11` | | [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) | `1.12.42` | `1.13.2` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.372.3` | `1.374.2` | | [zone.js](https://github.com/angular/angular/tree/HEAD/packages/zone.js) | `0.16.1` | `0.16.2` | | [@angular-eslint/eslint-plugin](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin) | `21.3.1` | `21.4.0` | | [@angular-eslint/eslint-plugin-template](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin-template) | `21.3.1` | `21.4.0` | | [@angular-eslint/template-parser](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/template-parser) | `21.3.1` | `21.4.0` | | [@angular/build](https://github.com/angular/angular-cli) | `21.2.8` | `21.2.11` | | [@angular/cli](https://github.com/angular/angular-cli) | `21.2.8` | `21.2.11` | | [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `21.2.10` | `21.2.13` | | [@angular/language-service](https://github.com/angular/angular/tree/HEAD/packages/language-service) | `21.2.10` | `21.2.13` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.4` | `4.3.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.9.1` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.59.1` | `8.59.4` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.59.1` | `8.59.4` | | [eslint](https://github.com/eslint/eslint) | `10.2.1` | `10.4.0` | | [globals](https://github.com/sindresorhus/globals) | `17.5.0` | `17.6.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.15` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.4` | `4.3.0` | Updates `@angular/animations` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/animations's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/animations's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/animations">compare view</a></li> </ul> </details> <br /> Updates `@angular/cdk` from 21.2.8 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/components/releases">@angular/cdk's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <p>No user facing changes in this release</p> <h2>21.2.10</h2> <h3>aria</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><img src="https://img.shields.io/badge/48973661e-fix-green" alt="fix - 48973661e" /></a></td> <td><strong>menu:</strong> do not set default aria-label (<a href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>material</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/51271c6194a9b55ee847c566a8960c9be5ec7cce"><img src="https://img.shields.io/badge/51271c619-fix-green" alt="fix - 51271c619" /></a></td> <td><strong>stepper:</strong> allow stepper to be labelled (<a href="https://redirect.github.com/angular/components/issues/33137">#33137</a>)</td> </tr> </tbody> </table> <h3>cdk</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/3a3852d45a4bbcfb23b46ca00e0eba1d70081ba3"><img src="https://img.shields.io/badge/3a3852d45-fix-green" alt="fix - 3a3852d45" /></a></td> <td><strong>tree:</strong> enter/space key on child node should not toggle parent node expansion (<a href="https://redirect.github.com/angular/components/issues/33125">#33125</a>)</td> </tr> </tbody> </table> <h3>aria</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/bf14cc9d9fd349974cba853d4747b6859b3aae5b"><img src="https://img.shields.io/badge/bf14cc9d9-fix-green" alt="fix - bf14cc9d9" /></a></td> <td><strong>menu:</strong> use computed for menu item patterns, with trigger on visible (<a href="https://redirect.github.com/angular/components/issues/33118">#33118</a>)</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/components/blob/main/CHANGELOG.md">@angular/cdk's changelog</a>.</em></p> <blockquote> <h1>21.2.11 "crystal ball" (2026-05-13)</h1> <p>No user facing changes in this release</p> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.8 "plastic-wallaby" (2026-05-06)</h1> <h2>Breaking Changes</h2> <h3>aria</h3> <ul> <li> <p>The legacy combobox and autocomplete implementations have been removed. Use the new standalone combobox instead.</p> <ul> <li>feat(aria/combobox): promote simple-combobox to stable un-prefixed combobox</li> </ul> <ul> <li>Relocates public, private, and example directories to clean <code>combobox</code> entry points.</li> <li>Renames internal layout symbols, selectors, and uppercase tokens (<code>SIMPLE_COMBOBOX_POPUP</code> -> <code>COMBOBOX_POPUP</code>).</li> <li>Establishes full documentation extraction parity with the <code>json_api</code> Bazel rule target.</li> <li>Standardizes the accompanying toolbar component showcase into the clean <code>aria-toolbar</code> path.</li> <li>Re-routes dev-app navigation links and migrates public API golden records.</li> </ul> </li> <li> <p><code>SimpleCombobox</code> has been promoted to <code>Combobox</code>. All <code>simple-combobox</code> prefixed symbols, selectors, and tokens have been renamed to use the <code>combobox</code> prefix.</p> <ul> <li>refactor(aria/combobox): relocate and restructure autocomplete and toolbar examples Relocate the autocomplete examples to <code>src/components-examples/aria/autocomplete</code> and toolbar examples to <code>src/components-examples/aria/toolbar</code>.</li> </ul> <ul> <li>Restore naming continuity with the historical codebase by stripping redundant prefixes from example filenames and component selectors.</li> <li>Sync dev-app preview routing layout paths and strict Bazel target dependency links.</li> </ul> </li> </ul> <h3>cdk</h3> <ul> <li> <ul> <li><code>CDK_DESCRIBEDBY_HOST_ATTRIBUTE</code> has been removed.</li> <li><code>CDK_DESCRIBEDBY_ID_PREFIX</code> has been removed.</li> <li>The <code>injector</code> parameter of the <code>ConfigurableFocusTrap</code> and <code>FocusTrap</code> constructors is now required.</li> <li>The boolean parameter of <code>ConfigurableFocusTrapFactory.create</code> has been replaced with a config object.</li> <li><code>MESSAGES_CONTAINER_ID</code> has been removed.</li> </ul> </li> <li> <ul> <li>The <code>event</code> parameter of <code>DropListRef.drop</code> is now required.</li> </ul> </li> <li> <ul> <li><code>ContextMenuTracker</code> has been renamed to <code>MenuTracker</code>.</li> </ul> </li> </ul> <h3>material</h3> <ul> <li> <ul> <li><code>MatListOption.checkboxPosition</code> has been removed. use <code>togglePosition</code> instead.</li> <li><code>MatListOptionCheckboxPosition</code> has been renamed to <code>MatListOptionTogglePosition</code>.</li> </ul> </li> <li> <ul> <li><code>ArrowViewState</code> has been removed.</li> <li><code>ArrowViewStateTransition</code> has been removed.</li> </ul> </li> </ul> <h3>google-maps</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/b8201edeef62258c3d1e1ebeaf8ee14766918c22">b8201edee</a></td> <td>fix</td> <td>deprecate heatmap layer (<a href="https://redirect.github.com/angular/components/pull/33208">#33208</a>)</td> </tr> </tbody> </table> <h3>material</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/add8f16c01ad683b9e2ab9e1bf5ad3a984dd9921">add8f16c0</a></td> <td>fix</td> <td><strong>list:</strong> breaking changes for v22</td> </tr> <tr> <td><a href="https://github.com/angular/components/commit/9d73c98b57d46454d51344bbd59055bc06dabc6b">9d73c98b5</a></td> <td>fix</td> <td><strong>menu:</strong> missing panelClass getter (<a href="https://redirect.github.com/angular/components/pull/33191">#33191</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/components/commit/75718e4fbebce2a7f8aa30550a12d58a5a6f9b93">75718e4fb</a></td> <td>fix</td> <td><strong>sort:</strong> breaking changes for v22</td> </tr> </tbody> </table> <h3>cdk</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/components/commit/1238d1573e706cbf0a2cabcc97e59d28a9499ecb"><code>1238d15</code></a> release: cut the v21.2.11 release</li> <li><a href="https://github.com/angular/components/commit/583da8a564dcb667cb8928e79d286eadee0a5013"><code>583da8a</code></a> release: cut the v21.2.10 release</li> <li><a href="https://github.com/angular/components/commit/babfbb7430547d5f4558174aec1a07ce6c67a26f"><code>babfbb7</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33205">#33205</a>)</li> <li><a href="https://github.com/angular/components/commit/e08fdf2a6a120078b512043bf5804bc3c7f9716a"><code>e08fdf2</code></a> build: fix failing test (<a href="https://redirect.github.com/angular/components/issues/33212">#33212</a>)</li> <li><a href="https://github.com/angular/components/commit/09e89fa188f157c0892019a461459cd9a252a673"><code>09e89fa</code></a> build: lock file maintenance (<a href="https://redirect.github.com/angular/components/issues/33201">#33201</a>)</li> <li><a href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><code>4897366</code></a> fix(aria/menu): do not set default aria-label (<a href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</li> <li><a href="https://github.com/angular/components/commit/a6c5b72562b9d46ea3c10a2ecb668e013b46a103"><code>a6c5b72</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33181">#33181</a>)</li> <li><a href="https://github.com/angular/components/commit/b7c34e306539716a1222468907ad4af5fb6b1aee"><code>b7c34e3</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33160">#33160</a>)</li> <li><a href="https://github.com/angular/components/commit/58e29cf1aa8265d6041350c716c5fbfa9e25b738"><code>58e29cf</code></a> build: update dependency bazel_lib to v3.3.1 (<a href="https://redirect.github.com/angular/components/issues/33177">#33177</a>)</li> <li><a href="https://github.com/angular/components/commit/e2f16ac34e93e69b1ef960ba70c517de799d05cc"><code>e2f16ac</code></a> build: update pnpm to v10.33.2 (<a href="https://redirect.github.com/angular/components/issues/33165">#33165</a>)</li> <li>Additional commits viewable in <a href="https://github.com/angular/components/compare/v21.2.8...v21.2.11">compare view</a></li> </ul> </details> <br /> Updates `@angular/common` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/common's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/common's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/30cf85f71c52683016200ecf6d68b4418084ee6e"><code>30cf85f</code></a> refactor(common): update deprecation message</li> <li><a href="https://github.com/angular/angular/commit/42d57c35781fb65fc4d44df59b6a85287664216a"><code>42d57c3</code></a> refactor(common): fix viewport tests</li> <li><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><code>10ad3c0</code></a> fix(common): prevent focus from scrollToAnchor</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/common">compare view</a></li> </ul> </details> <br /> Updates `@angular/compiler` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/compiler's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/compiler's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/baf92da96ed73a0f4748edf05d3c0702cab219da"><code>baf92da</code></a> test: remove invalid css that was causing issues with the postcss parser</li> <li><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a> fix(core): disallow event attribute bindings in host bindings unconditionally</li> <li><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><code>4f5d8a2</code></a> fix(compiler): let declaration span not including end character</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/compiler">compare view</a></li> </ul> </details> <br /> Updates `@angular/core` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/core's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/core's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a> fix(core): disallow event attribute bindings in host bindings unconditionally</li> <li><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><code>9e38ed7</code></a> fix(core): sanitizer typings</li> <li><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><code>3430251</code></a> fix(core): i18n flags leaking on errors</li> <li><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><code>c37f6ca</code></a> fix(core): visit ng-let expression value in signal migration schematics</li> <li><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><code>fe13bb6</code></a> fix(core): allow explicit read generic with signal input transforms</li> <li><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><code>7a05a9a</code></a> fix(core): validate security-sensitive attributes in i18n bindings</li> <li><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><code>1aeebbe</code></a> fix(core): respect ngSkipHydration on components with projectable nodes in LC...</li> <li><a href="https://github.com/angular/angular/commit/4900e453e1a2e9351ad2672a804d876ff5a62968"><code>4900e45</code></a> build: update cross-repo angular dependencies</li> <li><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><code>a40e2ce</code></a> fix(core): fix ordering of view queries metadata in JIT mode</li> <li><a href="https://github.com/angular/angular/commit/9bcbf376413632590ef1fb1cebe68d049d9bd45b"><code>9bcbf37</code></a> refactor(core): fix bundling symbol test</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/core">compare view</a></li> </ul> </details> <br /> Updates `@angular/forms` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/forms's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/forms's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https:... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marco A. <marco@zitadel.com> |
||
 Liam NevilleandMax Peintner
|
404c23834a |
fix(login): redirect to email verification when forced MFA has no visible factors (#12060)
# Which Problems Are Solved When MFA is enforced with only Email OTP as a second factor, new users hit a dead end on the MFA setup screen. The `ChooseSecondFactorToSetup` component hides Email OTP when `emailVerified` is `false`, and if email verification was skipped earlier in the flow (e.g. `EMAIL_VERIFICATION` env not set to `"true"`), no MFA options are visible and the user cannot proceed. # How the Problems Are Solved In the MFA setup server component (`mfa/set/page.tsx`), before rendering, detect when forced MFA has no visible second factors because all configured factors require verification the user hasn't completed. When Email OTP is configured but the user's email is unverified, redirect to `/verify` with `send=true` so a verification code is sent immediately. After the user verifies their email, the existing flow in `verify.ts` calls `checkMFAFactors` which redirects back to `/mfa/set` — where Email OTP is now visible since `emailVerified` is `true`. The redirect pattern follows the existing precedent in `authenticator/set/page.tsx`. # Additional Changes None # Additional Context - Closes #11536 --------- Co-authored-by: Max Peintner <max@caos.ch> |
||
|
Federico Coppede
|
b4f2da2171 |
docs: Add Gateway API routing to Kubernetes deployment guide (#12168)
## Description This PR updates the Kubernetes deployment documentation to address user feedback regarding our routing instructions. A user noted that standard `Ingress` is becoming outdated and requested configuration examples for the modern Gateway API. To support both existing and modern clusters, I have updated the guide to provide two clear pathways for exposing ZITADEL. ## Changes Included * **Prerequisites updated:** Mentioned Gateway API controllers alongside standard Ingress controllers. * **Refactored Stage 2 (Production):** Split the routing configuration into "Option A: Standard Ingress" and "Option B: Gateway API". * **Added YAML example:** Provided a sample `HTTPRoute` resource to route traffic to the `zitadel` and `zitadel-login` backend services. * **Terminology updates:** Broadened terms like "Ingress" to "Routing" or "Routing controller" where applicable. |
||
|
Federico Coppede
|
ecfe72b509 |
docs: update vue repo url (#12160)
fix broken vue repo url |
||
|
Max PeintnerandRamon
|
96b3f3dd35 |
fix(login): apply custom request headers from environment variable in proxy (#12144)
Closes #12125 # Which Problems Are Solved The proxy middleware (proxy.ts) did not apply `CUSTOM_REQUEST_HEADERS` to rewritten requests (/.well-known/*, /oauth/*, /oidc/*, etc.). When `ZITADEL_API_URL` points to an internal service name, the Host header on proxied requests remained the internal name instead of the configured public domain, causing Errors.Instance.NotFound. # How the Problems Are Solved The other two outgoing request paths — the connectRPC transport and the security-settings fetch — already applied these headers. This adds the same applyCustomHeaders() call to the proxy path. Co-authored-by: Ramon <mail@conblem.me> |
||
|
Federico Coppede
|
1b8b0ac410 |
docs: move customer portal docs to knowledge base (#12147)
Moved the Customer Portal Documentation to the knowledge base (help.zitadel.com) |
||
|
Livio Spring
|
08007da70e | Merge commit from fork | ||
|
|
64737bfedf |
chore: deps update (#12114)
<!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved Outdated depdencies # How the Problems Are Solved This PR mostly just updates our NPM depdencies to the newest feature releases. The UUID package was update to version 14, the changelog only includes changes to the supported node version. # Additional Changes Replace tsx for some scripts in the docs. --------- Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com> Co-authored-by: Max Peintner <max@caos.ch> |
||
|
942c959d09 |
fix(login): resolve localized legal links in signup (#11913)
# Which Problems Are Solved
- Login V2 signup does not resolve the `{{.Lang}}` placeholder in ToS,
Privacy Policy, and help links.
- Clicking those links on the registration page can open URL-encoded
placeholders like `%7B%7B.Lang%7D%7D` instead of the active
language-specific page.
# How the Problems Are Solved
- Adds a small login utility to resolve `{{.Lang}}` placeholders against
the active Login V2 locale.
- Updates the signup legal acceptance component to use the resolved
links before rendering them.
- Applies the same resolution to the optional help link shown alongside
the legal acceptance text.
# Additional Changes
- Adds unit tests for the link placeholder resolver.
- Adds a component test covering localized ToS, Privacy Policy, and help
links on the signup page.
# Additional Context
- Closes #11907
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Max Peintner <peintnerm@gmail.com>
|
||
|
|
b1c8781516 |
fix(login): lru-cache compatibility, improve session error handling (#12099)
# Which Problems Are Solved - Logo and heading overlap on login pages due to a -mb-4 negative margin on the logo container - The /login route returns a 500 when `listSessions` fails (e.g. stale session cookies), because loadSessions has no error handling. - The proxy logs `"fetch() returned undefined"` because `fetchIframeOrigins` returns undefined, which lru-cache's forceFetch treats as a fetch failure. # How the Problems Are Solved - Remove `-mb-4` from the logo container in DynamicTheme. - Wrap `loadSessions` in a try/catch — failures fall through as empty sessions instead of crashing. - Return `null` instead of `undefined` from `fetchIframeOrigins` so lru-cache caches it normally. --------- Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com> Co-authored-by: conblem <mail@conblem.me> |
||
|
|
13f8ba4215 |
fix(console): delete role assignment in admin profile #10376 (#11867)
# Which Problems Are Solved Currently it's not possible to delete role assignments in the user profile. <img width="1026" height="516" alt="CleanShot 2026-03-18 at 10 50 01" src="https://github.com/user-attachments/assets/7b8eb316-852b-4c16-9f4b-4c041215e410" /> # How the Problems Are Solved Switched the removal of role assignments to the newer [Delete Authorization call](https://zitadel.com/docs/reference/api/authorization/zitadel.authorization.v2.AuthorizationService.DeleteAuthorization). # Additional Changes Correctly pass the role assignment id based on the context of the call. # Additional Context - Closes: #10376 --------- Co-authored-by: Max Peintner <max@caos.ch> Co-authored-by: Max Peintner <peintnerm@gmail.com> |
||
|
RamonandMax Peintner
|
2c8d63bb71 |
feat(console): improve client details dialog ux #11834 (#11836)
# Which Problems Are Solved The console provided conflicting warnings when creating a pkce based project. # How the Problems Are Solved <img width="1026" height="432" alt="grafik" src="https://github.com/user-attachments/assets/d6609d2d-1438-42bd-9bc4-2e896c3e47d9" /> Removed the `keep your client secret at a safe place...` warning when a auth-method without a client secret is used. Changed the dialog title to `Client Details` instead of `Client Secret` # Additional Changes - Improves type safety for data passed to the `AppSecretDialogComponent`. - Updates the `AppSecretDialogComponent` to use modern Angular features, improving readability and maintainability. # Additional Context - Closes #11834 --------- Co-authored-by: Max Peintner <max@caos.ch> |
||
|
Ramon
|
83919d82b4 |
fix(console): display actions v1 with correct permissions #12001 (#12068)
# Which Problems Are Solved - Users needed broader IAM read permissions to access the Actions V1 page in the console. # How the Problems Are Solved - Updates the console route configuration for `/actions` to require `org.action.read`. # Additional Context - Closes #12001 |
||
|
Florian Forster
|
24d0f34f39 |
perf: optimize docs static generation cost (#12108)
## Summary - Switch the docs catch-all route to full static generation and prebuild both latest and versioned docs paths. - Prebuild OG images for all docs pages, make sitemap and LLM export static, and remove nondeterministic sitemap timestamps. - Reduce build-time overhead by memoizing docs sidebar trees and skipping processed markdown generation for versioned docs. ## Testing - `pnpm nx run @zitadel/docs:build` - `pnpm nx run @zitadel/docs:lint` - `pnpm nx run @zitadel/docs:check-types` - Verified the prerender manifest contains 8,816 prerendered routes, 3,293 versioned docs routes, 4,406 OG routes, and zero revalidating docs routes. |
||
|
Federico Coppede
|
f96a9c54ac |
docs: clarify exp and iat claim precedence for private key JWTs (#12110)
This PR updates the "Private Key JWT Auth for Service Accounts" documentation to explicitly clarify the relationship between the exp (expiration) and iat (issued at) claims. Previously, the documentation didn't make it clear what happens if a developer sets an exp claim far into the future. This update clarifies that while the exp value is strictly enforced, the iat claim takes precedence if the exp is set to more than 1 hour in the future (i.e., ZITADEL will reject the JWT once the iat is older than 1 hour, regardless of the exp time). **Changes included:** Updated the description of the exp claim in the JWT payload section to highlight the 1-hour iat limit enforcement. |
||
|
Florian ForsterandClaude Opus 4.7
|
314b1b50dd |
docs: eliminate runtime ISR writes via full SSG (#12103)
# Which Problems Are Solved The Vercel `docs` project generated ~64M ISR writes over 30 days (99.5% of ISR writes across all projects, ~\$258/month). Root causes in the Next.js 16 docs app: - `apps/docs/app/[[...slug]]/page.tsx` had `dynamicParams = true` + `revalidate = 3600`. Bot traffic hitting unknown URLs (`/docs/wp-admin`, `/docs/.env`, fuzzed paths) got rendered via \`notFound()\`, and the 404 response was cached as an ISR entry — 1 write per unique bad URL. Known pages were also rewritten hourly for no reason since content only changes on deploy. - `apps/docs/app/og/docs/[...slug]/route.tsx` had `revalidate = false` + empty `generateStaticParams()` + implicit `dynamicParams = true`. Every unique OG URL (including bot probes) was cached forever — writes accumulated permanently. # How the Problems Are Solved Switch the docs routes to pure SSG (content is static and only changes on deploy, so ISR provides no value): - `app/[[...slug]]/page.tsx`: `dynamicParams = false`, `revalidate = false`, `dynamic = 'force-static'`. Unknown URLs now return a static 404 at the CDN — no function invocation, no ISR write. All 390 pages from `source.generateParams()` are still pre-rendered. - `app/og/docs/[...slug]/route.tsx`: `generateStaticParams()` now returns all 390 pages via the existing `getPageImage(page).segments` helper, so every OG image is pre-built as a static asset. `dynamicParams = false` + `dynamic = 'force-static'` locks it down. - `app/llms-full.txt/route.ts`: added `dynamic = 'force-static'` as a safety net (already `revalidate = false`, single URL). The tradeoff is longer CI builds (~40s–2min for 390 OG image generations, paid on every preview deploy) in exchange for eliminating ~\$258/month in ISR writes plus associated function invocations and CPU time. # Additional Changes None. # Additional Context - No changes to `next.config.mjs`, `vercel.json`, or redirects. - Existing `apps/docs/redirects.json` (3,261 entries) covers legacy URLs so `dynamicParams = false` won't 404 moved pages linked from elsewhere. - Versioned routes: `content/versions.json` and `v*/` folders don't exist yet. When versioning is activated, `generateStaticParams()` in both files must also include `versionSource.generateParams()` — otherwise versioned URLs will 404 under `dynamicParams = false`. ## Test plan - [ ] CI build succeeds (expect modest build-time increase for OG pre-generation) - [ ] Inspect `apps/docs/.next/prerender-manifest.json` — all 390 doc routes + 390 OG routes listed with `initialRevalidateSeconds: false` - [ ] Local smoke: `/docs` → 200, `/docs/wp-admin` → 404 (static, no function), `/docs/og/docs/guides/start/image.png` → PNG, `/docs/og/docs/bogus/image.png` → 404 - [ ] Post-deploy: Vercel **ISR Writes** metric drops to near-zero within 24h - [ ] Post-deploy: Vercel **Function Invocations** for `/og/docs/*` drop to zero - [ ] Verify no legitimate docs pages 404 (cross-check logs against `apps/docs/app/sitemap.ts`) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Livio Spring
|
cc74a36b65 |
chore(deps): update go dependencies (#12094)
This PR updates all (possible) go dependencies and requires a backport to v4.x |