Bump the angular-ecosystem group in /nav-app with 12 updates by dependabot[bot] · Pull Request #798 · mitre-attack/attack-navigator

dependabot · 2026-07-01T17:24:56Z

Bumps the angular-ecosystem group in /nav-app with 12 updates:

Package	From	To
@angular/animations	`19.2.21`	`19.2.25`
@angular/common	`19.2.21`	`19.2.25`
@angular/compiler	`19.2.21`	`19.2.25`
@angular/core	`19.2.21`	`19.2.25`
@angular/forms	`19.2.21`	`19.2.25`
@angular/platform-browser	`19.2.21`	`19.2.25`
@angular/platform-browser-dynamic	`19.2.21`	`19.2.25`
@angular/router	`19.2.21`	`19.2.25`
@angular-devkit/build-angular	`19.2.24`	`19.2.27`
@angular/cli	`19.2.24`	`19.2.27`
@angular/compiler-cli	`19.2.21`	`19.2.25`
@angular/language-service	`19.2.21`	`19.2.25`

Updates @angular/animations from 19.2.21 to 19.2.25

Release notes

Sourced from @angular/animations's releases.

19.2.25

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

19.2.24

compiler

Commit Description

prevent namespaced SVG elements from being stripped

19.2.23

common

Commit Description

add upper bounds for digitsInfo

sanitize placeholder

compiler

Commit Description

normalize tag names with custom namespaces in DomElementSchemaRegistry

sanitize dynamic href and xlink:href bindings on SVG a elements

strip namespaced SVG script elements during template compilation

core

Commit Description

reject script element as a dynamic component host

sanitize meta selectors

support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation

synchronize core sanitization schema with compiler

wrap i18n dynamic element property updates in active index states

http

Commit Description

exclude withCredentials requests from transfer cache

skip TransferCache for cookie-bearing requests by default

platform-server

Commit Description

normalize path parsing in ServerPlatformLocation

secure location and document initialization against SSRF and path hijack

service-worker

Commit Description

preserve redirect policy on reconstructed asset requests

Preserves explicit 'credentials: omit' in asset requests

Preserves HTTP cache mode in asset group requests

... (truncated)

Changelog

Sourced from @angular/animations's changelog.

19.2.25 (2026-06-02)

platform-server

Commit Type Description

e2fb854d55 fix throw on suspicious URLs and restrict protocol-relative URLs

0a8befb493 fix update domino to latest version

20.3.24 (2026-06-02)

platform-server

Commit Type Description

6ca433e56b fix throw on suspicious URLs and restrict protocol-relative URLs

8680b5152f fix update domino to latest version

21.2.15 (2026-05-28)

common

Commit Type Description

7f4ac78994 fix add upper bounds for digitsInfo

300f61feb3 fix sanitize placeholder

compiler

Commit Type Description

0b07f47bd6 fix normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)

eb1cbbf2eb fix prevent namespaced SVG elements from being stripped

cc1378d54b fix sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)

782e01594e fix strip namespaced SVG script elements during template compilation (#68925)

core

Commit Type Description

ff12fe55ac fix normalize tag names in runtime i18n attribute security context lookup (#68925)

e6fe77cc97 fix sanitize meta selectors

daaf32937f fix support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)

dada86e43d fix synchronize core sanitization schema with compiler (#68925)

http

Commit Type Description

582a417bd2 fix exclude withCredentials requests from transfer cache

5c6d6df34b fix skip TransferCache for cookie-bearing requests by default

platform-server

Commit Type Description

37e8aadf87 fix prevent SSRF bypasses via backslash URLs in HttpClient

72696e244e fix secure location and document initialization against SSRF and path hijack

... (truncated)

Commits

See full diff in compare view

Updates @angular/common from 19.2.21 to 19.2.25

Release notes

Sourced from @angular/common's releases.

19.2.25

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

19.2.24

compiler

Commit Description

prevent namespaced SVG elements from being stripped

19.2.23

common

Commit Description

add upper bounds for digitsInfo

sanitize placeholder

compiler

Commit Description

normalize tag names with custom namespaces in DomElementSchemaRegistry

sanitize dynamic href and xlink:href bindings on SVG a elements

strip namespaced SVG script elements during template compilation

core

Commit Description

reject script element as a dynamic component host

sanitize meta selectors

support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation

synchronize core sanitization schema with compiler

wrap i18n dynamic element property updates in active index states

http

Commit Description

exclude withCredentials requests from transfer cache

skip TransferCache for cookie-bearing requests by default

platform-server

Commit Description

normalize path parsing in ServerPlatformLocation

secure location and document initialization against SSRF and path hijack

service-worker

Commit Description

preserve redirect policy on reconstructed asset requests

Preserves explicit 'credentials: omit' in asset requests

Preserves HTTP cache mode in asset group requests

... (truncated)

Changelog

Sourced from @angular/common's changelog.

19.2.25 (2026-06-02)

platform-server

Commit Type Description

e2fb854d55 fix throw on suspicious URLs and restrict protocol-relative URLs

0a8befb493 fix update domino to latest version

20.3.24 (2026-06-02)

platform-server

Commit Type Description

6ca433e56b fix throw on suspicious URLs and restrict protocol-relative URLs

8680b5152f fix update domino to latest version

21.2.15 (2026-05-28)

common

Commit Type Description

7f4ac78994 fix add upper bounds for digitsInfo

300f61feb3 fix sanitize placeholder

compiler

Commit Type Description

0b07f47bd6 fix normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)

eb1cbbf2eb fix prevent namespaced SVG elements from being stripped

cc1378d54b fix sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)

782e01594e fix strip namespaced SVG script elements during template compilation (#68925)

core

Commit Type Description

ff12fe55ac fix normalize tag names in runtime i18n attribute security context lookup (#68925)

e6fe77cc97 fix sanitize meta selectors

daaf32937f fix support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)

dada86e43d fix synchronize core sanitization schema with compiler (#68925)

http

Commit Type Description

582a417bd2 fix exclude withCredentials requests from transfer cache

5c6d6df34b fix skip TransferCache for cookie-bearing requests by default

platform-server

Commit Type Description

37e8aadf87 fix prevent SSRF bypasses via backslash URLs in HttpClient

72696e244e fix secure location and document initialization against SSRF and path hijack

... (truncated)

Commits

62dd27d fix(common): add upper bounds for digitsInfo
1732672 fix(common): sanitize placeholder
e8d35f9 Revert "revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f641...
4747fe2 revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f6418d5e
08422de refactor(http): export CACHE_OPTIONS to support test suite requirements
9940ffd fix(http): exclude withCredentials requests from transfer cache
0f67f0b fix(http): skip TransferCache for cookie-bearing requests by default
See full diff in compare view

Updates @angular/compiler from 19.2.21 to 19.2.25

Release notes

Sourced from @angular/compiler's releases.

19.2.25

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

19.2.24

compiler

Commit Description

prevent namespaced SVG elements from being stripped

19.2.23

common

Commit Description

add upper bounds for digitsInfo

sanitize placeholder

compiler

Commit Description

normalize tag names with custom namespaces in DomElementSchemaRegistry

sanitize dynamic href and xlink:href bindings on SVG a elements

strip namespaced SVG script elements during template compilation

core

Commit Description

reject script element as a dynamic component host

sanitize meta selectors

support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation

synchronize core sanitization schema with compiler

wrap i18n dynamic element property updates in active index states

http

Commit Description

exclude withCredentials requests from transfer cache

skip TransferCache for cookie-bearing requests by default

platform-server

Commit Description

normalize path parsing in ServerPlatformLocation

secure location and document initialization against SSRF and path hijack

service-worker

Commit Description

preserve redirect policy on reconstructed asset requests

Preserves explicit 'credentials: omit' in asset requests

Preserves HTTP cache mode in asset group requests

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

19.2.25 (2026-06-02)

platform-server

Commit Type Description

e2fb854d55 fix throw on suspicious URLs and restrict protocol-relative URLs

0a8befb493 fix update domino to latest version

20.3.24 (2026-06-02)

platform-server

Commit Type Description

6ca433e56b fix throw on suspicious URLs and restrict protocol-relative URLs

8680b5152f fix update domino to latest version

21.2.15 (2026-05-28)

common

Commit Type Description

7f4ac78994 fix add upper bounds for digitsInfo

300f61feb3 fix sanitize placeholder

compiler

Commit Type Description

0b07f47bd6 fix normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)

eb1cbbf2eb fix prevent namespaced SVG elements from being stripped

cc1378d54b fix sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)

782e01594e fix strip namespaced SVG script elements during template compilation (#68925)

core

Commit Type Description

ff12fe55ac fix normalize tag names in runtime i18n attribute security context lookup (#68925)

e6fe77cc97 fix sanitize meta selectors

daaf32937f fix support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)

dada86e43d fix synchronize core sanitization schema with compiler (#68925)

http

Commit Type Description

582a417bd2 fix exclude withCredentials requests from transfer cache

5c6d6df34b fix skip TransferCache for cookie-bearing requests by default

platform-server

Commit Type Description

37e8aadf87 fix prevent SSRF bypasses via backslash URLs in HttpClient

72696e244e fix secure location and document initialization against SSRF and path hijack

... (truncated)

Commits

6ea6379 fix(compiler): prevent namespaced SVG <style> elements from being stripped
e8d35f9 Revert "revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f641...
4747fe2 revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f6418d5e
ce6acbf test(compiler-cli): align ngtsc sanitization expectations with modern DOM schema
dc3a544 test(core): update spec files to match 20.3.x limits and actual contexts
dfeffe6 test(compiler): remove obsolete schema_extractor import
3bfa4ee fixup! fix(core): normalize tag names in runtime i18n attribute security cont...
932e072 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
2e3d037 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a elements
fe1207e fix(compiler): strip namespaced SVG script elements during template compilation
Additional commits viewable in compare view

Updates @angular/core from 19.2.21 to 19.2.25

Release notes

Sourced from @angular/core's releases.

19.2.25

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

19.2.24

compiler

Commit Description

prevent namespaced SVG elements from being stripped

19.2.23

common

Commit Description

add upper bounds for digitsInfo

sanitize placeholder

compiler

Commit Description

normalize tag names with custom namespaces in DomElementSchemaRegistry

sanitize dynamic href and xlink:href bindings on SVG a elements

strip namespaced SVG script elements during template compilation

core

Commit Description

reject script element as a dynamic component host

sanitize meta selectors

support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation

synchronize core sanitization schema with compiler

wrap i18n dynamic element property updates in active index states

http

Commit Description

exclude withCredentials requests from transfer cache

skip TransferCache for cookie-bearing requests by default

platform-server

Commit Description

normalize path parsing in ServerPlatformLocation

secure location and document initialization against SSRF and path hijack

service-worker

Commit Description

preserve redirect policy on reconstructed asset requests

Preserves explicit 'credentials: omit' in asset requests

Preserves HTTP cache mode in asset group requests

... (truncated)

Changelog

Sourced from @angular/core's changelog.

19.2.25 (2026-06-02)

platform-server

Commit Type Description

e2fb854d55 fix throw on suspicious URLs and restrict protocol-relative URLs

0a8befb493 fix update domino to latest version

20.3.24 (2026-06-02)

platform-server

Commit Type Description

6ca433e56b fix throw on suspicious URLs and restrict protocol-relative URLs

8680b5152f fix update domino to latest version

21.2.15 (2026-05-28)

common

Commit Type Description

7f4ac78994 fix add upper bounds for digitsInfo

300f61feb3 fix sanitize placeholder

compiler

Commit Type Description

0b07f47bd6 fix normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)

eb1cbbf2eb fix prevent namespaced SVG elements from being stripped

cc1378d54b fix sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)

782e01594e fix strip namespaced SVG script elements during template compilation (#68925)

core

Commit Type Description

ff12fe55ac fix normalize tag names in runtime i18n attribute security context lookup (#68925)

e6fe77cc97 fix sanitize meta selectors

daaf32937f fix support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)

dada86e43d fix synchronize core sanitization schema with compiler (#68925)

http

Commit Type Description

582a417bd2 fix exclude withCredentials requests from transfer cache

5c6d6df34b fix skip TransferCache for cookie-bearing requests by default

platform-server

Commit Type Description

37e8aadf87 fix prevent SSRF bypasses via backslash URLs in HttpClient

72696e244e fix secure location and document initialization against SSRF and path hijack

... (truncated)

Commits

c5b6d73 refactor(core): prevent runtime error when root element is null during tag check
e8d35f9 Revert "revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f641...
4747fe2 revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f6418d5e
d31f841 fix(core): wrap i18n dynamic element property updates in active index states
e2caa08 test(core): update core packaging golden symbols to match security schema ref...
7dab3e3 test(core): update router golden symbols to match security schema refactor
ce6acbf test(compiler-cli): align ngtsc sanitization expectations with modern DOM schema
de74480 test(core): update golden symbols and host bindings sanitization spec
c6bb069 fix(core): reject script element as a dynamic component host
5e399a2 test(core): remove obsolete blockquote cite host binding tests
Additional commits viewable in compare view

Updates @angular/forms from 19.2.21 to 19.2.25

Release notes

Sourced from @angular/forms's releases.

19.2.25

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

19.2.24

compiler

Commit Description

prevent namespaced SVG elements from being stripped

19.2.23

common

Commit Description

add upper bounds for digitsInfo

sanitize placeholder

compiler

Commit Description

normalize tag names with custom namespaces in DomElementSchemaRegistry

sanitize dynamic href and xlink:href bindings on SVG a elements

strip namespaced SVG script elements during template compilation

core

Commit Description

reject script element as a dynamic component host

sanitize meta selectors

support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation

synchronize core sanitization schema with compiler

wrap i18n dynamic element property updates in active index states

http

Commit Description

exclude withCredentials requests from transfer cache

skip TransferCache for cookie-bearing requests by default

platform-server

Commit Description

normalize path parsing in ServerPlatformLocation

secure location and document initialization against SSRF and path hijack

service-worker

Commit Description

preserve redirect policy on reconstructed asset requests

Preserves explicit 'credentials: omit' in asset requests

Preserves HTTP cache mode in asset group requests

... (truncated)

Changelog

Sourced from @angular/forms's changelog.

19.2.25 (2026-06-02)

platform-server

Commit Type Description

e2fb854d55 fix throw on suspicious URLs and restrict protocol-relative URLs

0a8befb493 fix update domino to latest version

20.3.24 (2026-06-02)

platform-server

Commit Type Description

6ca433e56b fix throw on suspicious URLs and restrict protocol-relative URLs

8680b5152f fix update domino to latest version

21.2.15 (2026-05-28)

common

Commit Type Description

7f4ac78994 fix add upper bounds for digitsInfo

300f61feb3 fix sanitize placeholder

compiler

Commit Type Description

Bumps the angular-ecosystem group in /nav-app with 12 updates: | Package | From | To | | --- | --- | --- | | [@angular/animations](https://github.com/angular/angular/tree/HEAD/packages/animations) | `19.2.21` | `19.2.25` | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `19.2.21` | `19.2.25` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `19.2.21` | `19.2.25` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `19.2.21` | `19.2.25` | | [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `19.2.21` | `19.2.25` | | [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `19.2.21` | `19.2.25` | | [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) | `19.2.21` | `19.2.25` | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `19.2.21` | `19.2.25` | | [@angular-devkit/build-angular](https://github.com/angular/angular-cli) | `19.2.24` | `19.2.27` | | [@angular/cli](https://github.com/angular/angular-cli) | `19.2.24` | `19.2.27` | | [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `19.2.21` | `19.2.25` | | [@angular/language-service](https://github.com/angular/angular/tree/HEAD/packages/language-service) | `19.2.21` | `19.2.25` | Updates `@angular/animations` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/animations) Updates `@angular/common` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/common) Updates `@angular/compiler` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/compiler) Updates `@angular/core` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/core) Updates `@angular/forms` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/forms) Updates `@angular/platform-browser` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/platform-browser) Updates `@angular/platform-browser-dynamic` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/platform-browser-dynamic) Updates `@angular/router` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/router) Updates `@angular-devkit/build-angular` from 19.2.24 to 19.2.27 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v19.2.24...v19.2.27) Updates `@angular/cli` from 19.2.24 to 19.2.27 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v19.2.24...v19.2.27) Updates `@angular/compiler-cli` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/compiler-cli) Updates `@angular/language-service` from 19.2.21 to 19.2.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/language-service) --- updated-dependencies: - dependency-name: "@angular/animations" dependency-version: 19.2.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/common" dependency-version: 19.2.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/compiler" dependency-version: 19.2.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/core" dependency-version: 19.2.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/forms" dependency-version: 19.2.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/platform-browser" dependency-version: 19.2.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/platform-browser-dynamic" dependency-version: 19.2.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/router" dependency-version: 19.2.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular-devkit/build-angular" dependency-version: 19.2.27 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/cli" dependency-version: 19.2.27 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/compiler-cli" dependency-version: 19.2.25 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular-ecosystem - dependency-name: "@angular/language-service" dependency-version: 19.2.25 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular-ecosystem ... Signed-off-by: dependabot[bot] <support@github.com>

sonarqubecloud · 2026-07-01T17:25:22Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the angular-ecosystem group in /nav-app with 12 updates#798

Bump the angular-ecosystem group in /nav-app with 12 updates#798
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/nav-app/develop/angular-ecosystem-b6b73b5450

dependabot Bot commented on behalf of github Jul 1, 2026

Uh oh!

sonarqubecloud Bot commented Jul 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry
	sanitize dynamic href and xlink:href bindings on SVG a elements
	strip namespaced SVG script elements during template compilation

Commit	Description
	reject script element as a dynamic component host
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation
	synchronize core sanitization schema with compiler
	wrap i18n dynamic element property updates in active index states

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

Commit	Description
	normalize path parsing in ServerPlatformLocation
	secure location and document initialization against SSRF and path hijack

Commit	Description
	preserve redirect policy on reconstructed asset requests
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

Commit	Type	Description
e2fb854d55	fix	throw on suspicious URLs and restrict protocol-relative URLs
0a8befb493	fix	update domino to latest version

Commit	Type	Description
6ca433e56b	fix	throw on suspicious URLs and restrict protocol-relative URLs
8680b5152f	fix	update domino to latest version

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

Commit	Type	Description
0b07f47bd6	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
eb1cbbf2eb	fix	prevent namespaced SVG elements from being stripped
cc1378d54b	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
782e01594e	fix	strip namespaced SVG script elements during template compilation (#68925)

Commit	Type	Description
ff12fe55ac	fix	normalize tag names in runtime i18n attribute security context lookup (#68925)
e6fe77cc97	fix	sanitize meta selectors
daaf32937f	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
dada86e43d	fix	synchronize core sanitization schema with compiler (#68925)

Commit	Type	Description
582a417bd2	fix	exclude withCredentials requests from transfer cache
5c6d6df34b	fix	skip TransferCache for cookie-bearing requests by default

Commit	Type	Description
37e8aadf87	fix	prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e	fix	secure location and document initialization against SSRF and path hijack

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 1, 2026

19.2.25

platform-server

19.2.24

compiler

19.2.23

common

compiler

core

http

platform-server

service-worker

19.2.25 (2026-06-02)

platform-server

20.3.24 (2026-06-02)

platform-server

21.2.15 (2026-05-28)

common

compiler

core

http

platform-server

19.2.25

platform-server

19.2.24

compiler

19.2.23

common

compiler

core

http

platform-server

service-worker

19.2.25 (2026-06-02)

platform-server

20.3.24 (2026-06-02)

platform-server

21.2.15 (2026-05-28)

common

compiler

core

http

platform-server

19.2.25

platform-server

19.2.24

compiler

19.2.23

common

compiler

core

http

platform-server

service-worker

19.2.25 (2026-06-02)

platform-server

20.3.24 (2026-06-02)

platform-server

21.2.15 (2026-05-28)

common

compiler

core

http

platform-server

19.2.25

platform-server

19.2.24

compiler

19.2.23

common

compiler

core

http

platform-server

service-worker

19.2.25 (2026-06-02)

platform-server

20.3.24 (2026-06-02)