build(deps): bump the all-frontend-dependencies group across 1 directory with 28 updates

[dependabot]

Bumps the all-frontend-dependencies group with 27 updates in the / directory:

Package	From	To
@angular-devkit/core	21.2.5	21.2.7
@angular-devkit/schematics	21.2.5	21.2.7
@angular/cdk	21.2.4	21.2.7
@angular/common	21.2.6	21.2.9
@angular/compiler	21.2.6	21.2.9
@angular/core	21.2.6	21.2.9
@angular/forms	21.2.6	21.2.9
@angular/material	21.2.4	21.2.7
@angular/platform-browser	21.2.6	21.2.9
@angular/platform-browser-dynamic	21.2.6	21.2.9
@angular/platform-server	21.2.6	21.2.9
@angular/router	21.2.6	21.2.9
@angular/ssr	21.2.5	21.2.7
@angular/build	21.2.5	21.2.7
@angular/cli	21.2.5	21.2.7
@angular/compiler-cli	21.2.6	21.2.9
@angular/language-service	21.2.6	21.2.9
@angular/localize	21.2.6	21.2.9
@types/node	24.12.0	24.12.2
@vitest/browser-playwright	4.1.2	4.1.4
@vitest/eslint-plugin	1.6.13	1.6.16
eslint	10.1.0	10.2.1
jsdom	29.0.1	29.0.2
ng-packagr	21.2.2	21.2.3
playwright	1.58.2	1.59.1
prettier	3.8.1	3.8.3
typescript-eslint	8.57.2	8.58.2

Updates @angular-devkit/core from 21.2.5 to 21.2.7

Release notes

Sourced from @​angular-devkit/core's releases.

21.2.7

@​angular/cli

Commit	Description
	handle missing package manager during analytics initialization

@​angular/build

Commit	Description
	preserve coverage ignore comments in development
	show clear error when styleUrl points to a TypeScript file

21.2.6

@​angular/cli

Commit	Description
	fix sourceRoot resolution for MCP projects tool

@​angular/build

Commit	Description
	ensure transitive SCSS partial errors are tracked in watch mode
	ensure Vitest mock patching is executed only once
	preserve error stack traces during prerendering
	scope CHROME_BIN executable path to individual playwright instances

Changelog

Sourced from @​angular-devkit/core's changelog.

21.2.7 (2026-04-08)

@​angular/cli

Commit	Type	Description
971041aa1	fix	handle missing package manager during analytics initialization

@​angular/build

Commit	Type	Description
365cce81d	fix	preserve coverage ignore comments in development
9f74660c3	fix	show clear error when styleUrl points to a TypeScript file

20.3.23 (2026-04-08)

@​angular/build

Commit	Type	Description
ccab02ba0	fix	update vite to 7.3.2

19.2.24 (2026-04-08)

@​angular/build

Commit	Type	Description
f4595d599	fix	update vite to 6.4.2

22.0.0-next.4 (2026-04-01)

@​angular/cli

Commit	Type	Description
87d99e98b	feat	support custom port in MCP devserver start tool

... (truncated)

Commits

• 22a108e release: cut the v21.2.7 release
• 9f74660 fix(@​angular/build): show clear error when styleUrl points to a TypeScript file
• 625c5cb build: update cross-repo angular dependencies
• 44783cc build: lock file maintenance
• e15b22d docs: add spam policy and saved reply
• dcb36fd build: update dependency vite to v7.3.2
• d1605c6 test(@​angular/build): verify coverage ignore comments are preserved during co...
• 365cce8 fix(@​angular/build): preserve coverage ignore comments in development
• 7a27774 build: update github/codeql-action action to v4.35.1
• 971041a fix(@​angular/cli): handle missing package manager during analytics initializa...
• Additional commits viewable in compare view

Updates @angular-devkit/schematics from 21.2.5 to 21.2.7

Release notes

Sourced from @​angular-devkit/schematics's releases.

21.2.7

@​angular/cli

Commit	Description
	handle missing package manager during analytics initialization

@​angular/build

Commit	Description
	preserve coverage ignore comments in development
	show clear error when styleUrl points to a TypeScript file

21.2.6

@​angular/cli

Commit	Description
	fix sourceRoot resolution for MCP projects tool

@​angular/build

Commit	Description
	ensure transitive SCSS partial errors are tracked in watch mode
	ensure Vitest mock patching is executed only once
	preserve error stack traces during prerendering
	scope CHROME_BIN executable path to individual playwright instances

Changelog

Sourced from @​angular-devkit/schematics's changelog.

21.2.7 (2026-04-08)

@​angular/cli

Commit	Type	Description
971041aa1	fix	handle missing package manager during analytics initialization

@​angular/build

Commit	Type	Description
365cce81d	fix	preserve coverage ignore comments in development
9f74660c3	fix	show clear error when styleUrl points to a TypeScript file

20.3.23 (2026-04-08)

@​angular/build

Commit	Type	Description
ccab02ba0	fix	update vite to 7.3.2

19.2.24 (2026-04-08)

@​angular/build

Commit	Type	Description
f4595d599	fix	update vite to 6.4.2

22.0.0-next.4 (2026-04-01)

@​angular/cli

Commit	Type	Description
87d99e98b	feat	support custom port in MCP devserver start tool

... (truncated)

Commits

• 22a108e release: cut the v21.2.7 release
• 9f74660 fix(@​angular/build): show clear error when styleUrl points to a TypeScript file
• 625c5cb build: update cross-repo angular dependencies
• 44783cc build: lock file maintenance
• e15b22d docs: add spam policy and saved reply
• dcb36fd build: update dependency vite to v7.3.2
• d1605c6 test(@​angular/build): verify coverage ignore comments are preserved during co...
• 365cce8 fix(@​angular/build): preserve coverage ignore comments in development
• 7a27774 build: update github/codeql-action action to v4.35.1
• 971041a fix(@​angular/cli): handle missing package manager during analytics initializa...
• Additional commits viewable in compare view

Updates @angular/cdk from 21.2.4 to 21.2.7

Release notes

Sourced from @​angular/cdk's releases.

21.2.7

material

Commit	Description
	sort: deprecate MatSortHeaderIntl and hide from docs (#33089)

21.2.6

material

Commit	Description
	select: wrong transform origin when opening upwards inside another overlay (#33032)

21.2.5

material

Commit	Description
	sidenav: not resetting margin if transition does not start (#33001)
	slider: not picking up static direction (#33006)
	tooltip: allow hover detection logic to be customized (#33018)

cdk

Commit	Description
	stepper: linear updates not reflected in the DOM (#33007)

Changelog

Sourced from @​angular/cdk's changelog.

21.2.7 "carbon-jetski" (2026-04-16)

material

Commit	Type	Description
5954c4594c	fix	sort: deprecate MatSortHeaderIntl and hide from docs (#33089)

22.0.0-next.4 "paper cup" (2026-04-08)

Breaking Changes

multiple

• • A bunch of constructors that with rest arguments have been removed. If you were extending Material/CDK components, you may have to update your super calls accordingly.

material

Commit	Type	Description
07c2d002de	fix	core: address sass compiler warnings (#33040)
ab21f78b12	fix	select: wrong transform origin when opening upwards inside another overlay (#33032)

multiple

Commit	Type	Description
ce4c2c0a11	fix	remove empty constructors (#33048)

21.2.6 "steel bottle" (2026-04-08)

material

Commit	Type	Description
5b4bbe9c4f	fix	select: wrong transform origin when opening upwards inside another overlay (#33032)

22.0.0-next.3 "rubber-wombat" (2026-04-01)

Breaking Changes

multiple

• Renames the values input/model to value in Combobox, Listbox, Tree, Menu, Toolbar, and Select. Users must update their templates to use the value property instead of values.

  • refactor(multiple): update api goldens

material

Commit	Type	Description
ac3911071	fix	sidenav: not resetting margin if transition does not start (#33001)
a7d556180	fix	slider: not picking up static direction (#33006)
236762fbc	fix	tooltip: allow hover detection logic to be customized (#33018)

cdk

Commit	Type	Description

... (truncated)

Commits

• 2a6cff6 release: cut the v21.2.7 release
• 5954c45 fix(material/sort): deprecate MatSortHeaderIntl and hide from docs (#33089)
• a236a40 release: cut the v21.2.6 release
• 6b955a7 build: update cross-repo angular dependencies (#33043)
• 2909c3a build: lock file maintenance (#33038)
• 5b4bbe9 fix(material/select): wrong transform origin when opening upwards inside anot...
• 2c877d2 Set generic on some InjectionToken. (#32753)
• 97be64a build: update cross-repo angular dependencies (#33030)
• 424b282 build: update dependency aspect_rules_ts to v3.8.8 (#33025)
• e433a66 docs(material/dialog): clarify that default options replace rather than merge...
• Additional commits viewable in compare view

Updates @angular/common from 21.2.6 to 21.2.9

Release notes

Sourced from @​angular/common's releases.

21.2.9

core

Commit	Description
	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Description
	add CSP nonce support to JsonpClientBackend
	Don't on Passthru outside of reactive context

platform-server

Commit	Description
	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Description
	normalize multiple leading slashes in URL parser

21.2.8

compiler

Commit	Description
	handle nested brackets in host object bindings

compiler-cli

Commit	Description
	error for type parameter declarations

core

Commit	Description
	handle missing serialized container hydration data
	remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit	Description
	get quick info at local var location to align with TS semantics and support type narrowing

21.2.7

compiler

Commit	Description
	register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit	Description
	prevent recursive scope checks for invalid NgModule imports

core

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

21.2.9 (2026-04-15)

core

Commit	Type	Description
f603d4714f	fix	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Type	Description
540536c386	fix	add CSP nonce support to JsonpClientBackend
63a857b874	fix	Don't on Passthru outside of reactive context

platform-server

Commit	Type	Description
e0b5078cf2	fix	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Type	Description
684e9fd53d	fix	normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

• The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
• • TypeScript versions older than 6.0 are no longer supported.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

• This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

• The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit	Type	Description
2ce0e98f79	fix	handle nested brackets in host object bindings

compiler-cli

Commit	Type	Description
7f9450219f	feat	Adds warning for prefetch without main defer trigger
ab061a7610	fix	error for type parameter declarations
9218140348	fix	resolve TCB mapping failure for safe property reads with as any

core

Commit	Type	Description
a0aa8304cd	feat	bootstrap via ApplicationRef with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
77f1ca08e4	fix	handle missing serialized container hydration data

... (truncated)

Commits

• 540536c fix(http): add CSP nonce support to JsonpClientBackend
• 8102331 test(http): disable XSRF and mock location in HttpClient tests to avoid Domin...
• 13f050d test: construct local Date objects to fix timezone flakiness
• d0cf299 test: remove unsupported timezone from formatDate tests
• See full diff in compare view

Updates @angular/compiler from 21.2.6 to 21.2.9

Release notes

Sourced from @​angular/compiler's releases.

21.2.9

core

Commit	Description
	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Description
	add CSP nonce support to JsonpClientBackend
	Don't on Passthru outside of reactive context

platform-server

Commit	Description
	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Description
	normalize multiple leading slashes in URL parser

21.2.8

compiler

Commit	Description
	handle nested brackets in host object bindings

compiler-cli

Commit	Description
	error for type parameter declarations

core

Commit	Description
	handle missing serialized container hydration data
	remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit	Description
	get quick info at local var location to align with TS semantics and support type narrowing

21.2.7

compiler

Commit	Description
	register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit	Description
	prevent recursive scope checks for invalid NgModule imports

core

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.9 (2026-04-15)

core

Commit	Type	Description
f603d4714f	fix	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Type	Description
540536c386	fix	add CSP nonce support to JsonpClientBackend
63a857b874	fix	Don't on Passthru outside of reactive context

platform-server

Commit	Type	Description
e0b5078cf2	fix	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Type	Description
684e9fd53d	fix	normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

• The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
• • TypeScript versions older than 6.0 are no longer supported.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

• This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

• The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit	Type	Description
2ce0e98f79	fix	handle nested brackets in host object bindings

compiler-cli

Commit	Type	Description
7f9450219f	feat	Adds warning for prefetch without main defer trigger
ab061a7610	fix	error for type parameter declarations
9218140348	fix	resolve TCB mapping failure for safe property reads with as any

core

Commit	Type	Description
a0aa8304cd	feat	bootstrap via ApplicationRef with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
77f1ca08e4	fix	handle missing serialized container hydration data

... (truncated)

Commits

• a4f3120 refactor(compiler): require a reference in DirectiveMeta
• de533fe refactor(compiler-cli): move ClassPropertyMapping into compiler
• ea1e34c refactor(compiler): move matchSource into base metadata
• e40d378 fix(compiler): handle nested brackets in host object bindings
• d04ddd7 fix(core): prevent binding unsafe attributes on SVG animation elements (#67797)
• fea25d1 fix(compiler): register SVG animation attributes in URL security context (#67...
• See full diff in compare view

Updates @angular/core from 21.2.6 to 21.2.9

Release notes

Sourced from @​angular/core's releases.

21.2.9

core

Commit	Description
	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Description
	add CSP nonce support to JsonpClientBackend
	Don't on Passthru outside of reactive context

platform-server

Commit	Description
	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Description
	normalize multiple leading slashes in URL parser

21.2.8

compiler

Commit	Description
	handle nested brackets in host object bindings

compiler-cli

Commit	Description
	error for type parameter declarations

core

Commit	Description
	handle missing serialized container hydration data
	remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit	Description
	get quick info at local var location to align with TS semantics and support type narrowing

21.2.7

compiler

Commit	Description
	register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit	Description
	prevent recursive scope checks for invalid NgModule imports

core

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

21.2.9 (2026-04-15)

core

Commit	Type	Description
f603d4714f	fix	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Type	Description
540536c386	fix	add CSP nonce support to JsonpClientBackend
63a857b874	fix	Don't on Passthru outside of reactive context

platform-server

Commit	Type	Description
e0b5078cf2	fix	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Type	Description
684e9fd53d	fix	normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

• The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
• • TypeScript versions older than 6.0 are no longer supported.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

• This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

• The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit	Type	Description
2ce0e98f79	fix	handle nested brackets in host object bindings

compiler-cli

Commit	Type	Description
7f9450219f	feat	Adds warning for prefetch without main defer trigger
ab061a7610	fix	error for type parameter declarations
9218140348	fix	resolve TCB mapping failure for safe property reads with as any

core

Commit	Type	Description
a0aa8304cd	feat	bootstrap via ApplicationRef with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
77f1ca08e4	fix	handle missing serialized container hydration data

... (truncated)

Commits

• 17cae6a docs: fix bootstraping link
• f603d47 fix(core): escape forward slashes in transfer state to prevent crawler indexing
• 05d9b97 build: update cross-repo angular dependencies
• d4c8a9a refactor(compiler-cli): decouple SymbolBuilder from BoundTarget and minimize ...
• 057cc6d fix(core): remove obsolete iOS cursor pointer hack in event delegation
• c9f8f3a test(core): add missing import of ChangeDetectionStrategy in query_spec
• 910dcb6 refactor(compiler-cli): decouple TemplateSymbolBuilder from ts.TypeChecker
• 82192de fix(core): handle missing serialized container hydration data
• 2ae0912 refactor(core): address review comments on NG0750 error message
• e583f4c refactor(core): Add more detail to NG0750 error message
• Additional commits viewable in compare view

Updates @angular/forms from 21.2.6 to 21.2.9

Release notes

Sourced from @​angular/forms's releases.

21.2.9

core

Commit	Description
	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Description
	add CSP nonce support to JsonpClientBackend