Skip to content

chore(deps): update npm packages - #643

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages

Conversation

@renovate

@renovate renovate Bot commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@angular/build 22.2.3 → 22.2.4 age adoption passing confidence
@angular/cdk 22.2.2 → 22.2.4 age adoption passing confidence
@angular/common (source) 22.2.2 → 22.2.3 age adoption passing confidence
@angular/compiler (source) 22.2.2 → 22.2.3 age adoption passing confidence
@angular/core (source) 22.2.2 → 22.2.3 age adoption passing confidence
@angular/forms (source) 22.2.2 → 22.2.3 age adoption passing confidence
@angular/platform-browser (source) 22.2.2 → 22.2.3 age adoption passing confidence
@angular/router (source) 22.2.2 → 22.2.3 age adoption passing confidence
core-js (source) 3.50.0 → 3.51.0 age adoption passing confidence
postcss (source) 8.5.30 → 8.5.31 age adoption passing confidence
postcss-nested 9.0.0 → 9.0.1 age adoption passing confidence
sass 1.105.2 → 1.106.1 age adoption passing confidence

Release Notes

angular/angular-cli (@​angular/build)

v22.2.4

Compare Source

@​angular/cli
Commit Type Description
63e45bcfe fix keep schematic positional arguments in index order
6053771cb fix only load autocompletion in interactive shells
@​schematics/angular
Commit Type Description
eec8dc049 fix apply viewEncapsulation to generated application components
3a549925e fix correct error and warning messages in environments schematic
fe119a7c7 fix show routing module suffixes in findModule error
36d988001 fix skip webWorkerTsConfig for unit-test builder test targets
460167cd3 fix use the generated class name when declaring in an NgModule
@​angular/build
Commit Type Description
c235a9554 fix add integrity metadata for all initial chunks beyond the module preload limit
80c7480b4 fix align lazy route entry names with workspace root for SSR modulepreload
b94627706 fix attach location to Sass errors and guard stack parsing
0dc103735 fix correct typos and spacing in error and warning messages
3e464c3f5 fix invalidate Vite module cache for removed dev server output files
7d9ba6280 fix match proxy glob patterns against URL pathname only
3aa7e93cc fix name the provider packages in the unit-test browsers error
e78cf0ae9 fix preserve diagnostic locations at offset 0 and guard empty files
b3baa20c6 fix support quotes in styles and polyfills paths
648aff9eb fix use component file path in inline stylesheet diagnostic locations
a9bec13b5 fix use distinct chunk naming for web worker bundles
a05723948 fix watch only explicitly added paths in chokidar watcher
35702a598 perf avoid reading external component stylesheets twice
@​angular/ssr
Commit Type Description
3beb2551c fix resolve query parameter placeholders in redirect targets (#​34321)
ff3f3727a fix resolve route parameters in redirect targets (#​34321)
d365b0008 fix use only the first value of the X-Forwarded-Prefix header
angular/components (@​angular/cdk)

v22.2.4

Compare Source

aria
Commit Type Description
14d931161 fix combobox: error when popup is destroyed before first change detection (#​33974)
material
Commit Type Description
3f2b67450 fix datepicker: increse specificity of period button styles (#​33970)
feb80c272 fix datepicker: update parse error with signal forms when value stays null (#​33951)

v22.2.3

Compare Source

cdk
Commit Type Description
a307978dc fix a11y: treat inert elements as non-focusable (#​33846)
material
Commit Type Description
e0c2d4df7 fix chips: implement touch-target pattern/styles on chip component (#​33614)
angular/angular (@​angular/common)

v22.2.3

Compare Source

common
Commit Type Description
fafec77b5d fix harden param encoding against prototype pollution
compiler
Commit Type Description
54f3de517c fix check @boundary blocks in the control flow content projection diagnostic
5e50658fd2 fix compare the operand in ReadTemporaryExpr.isEquivalent
b6f9cc5d70 fix do not scope comments placed inside of a selector
35a02f8097 fix harden JIT against prototype pollution
08075e8aa0 fix support dots in class binding names
c7a72c2bf2 fix support popover property bindings
compiler-cli
Commit Type Description
fa21d083fe fix inline tcb when depending on local directive
core
Commit Type Description
b5208f9fc3 fix avoid deleting idle bucket created during another bucket's drain
90af679c3b fix do not swallow compilation errors in computeStandaloneComponentScope
eca5fa4665 fix don't crash initEventReplay when two apps share an APP_ID
e59a2303df fix error when destroying embedded view with animations
a23941fe75 fix keep activeConsumer and currentInjector constant using Store helper
913ae7421f fix skip nested tick from onMicrotaskEmpty while a tick is running
forms
Commit Type Description
cc515b8b23 perf use addEventListener to avoid unconditional CD scheduling on blur
migrations
Commit Type Description
d04f214d04 fix normalize .d.ts paths in output migration field IDs
router
Commit Type Description
f9a4f751f0 fix check abort signal state on subscribe
zloirock/core-js (core-js)

v3.51.0

Compare Source

postcss/postcss (postcss)

v8.5.31

Compare Source

postcss/postcss-nested (postcss-nested)

v9.0.1

Compare Source

  • Fixed declarations after nested rules inside at-rules (by @​wahidrizka).
sass/dart-sass (sass)

v1.106.1

Compare Source

  • Fix a bug where an attribute selector with an empty value (such as
    [class=""]) would crash when serializing.

  • Don't crash when serializing a number with an empty unit. This is only
    possible through the JavaScript and Dart APIs or the embedded protocol.

Embedded Dart Sass
  • More robustly convert invalid value errors into PARAMS errors.

v1.106.0

Compare Source

  • Don't normalize CSS escapes in statement contexts that can contain
    interpolation. For example, @f\6Fo is now emitted as written rather than
    normalized to @foo.

  • Fix a bug where quotes would be removed from attribute selector values that
    contained backslashes.

  • Fix invalid source spans that could cause crashes when encountering a syntax
    error in selectors or media queries that also contain escape sequences.

  • Fix a bug where the indented syntax parser would crash when parsing a file
    where the first statement was indented and appeared after the first line.

  • Fix a bug that could cause crashes when encountering errors or warnings in
    interpolations that contain patterns like // */.

  • Potentially breaking compatibility fix: CSS escape codes whose values are
    0, for Unicode surrogates, or greater than the maximum allowed code point are
    now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression
    contexts. Previously, in some cases these were instead normalized to the
    normalized form of the original escape sequence, which violates the principle
    that all escape sequences for identical values should be normalized the same
    way. In other cases, these would simply throw errors.

    As a special case, \0 on its own will continue to be normalized to \0 to
    support historical CSS hacks.

  • Potentially breaking bug fix: Throw an error for mixins and functions that
    have rest parameters which are the same as normal parameters. Previously, the
    positional parameters wouldn't be accessible and calling such a mixin or
    function with a named argument would crash the compiler.

  • Potentially breaking bug fix: Fix various cases where using a CSS escape
    code at the beginning of an identifier would change parsing behavior versus
    using the character directly.

  • Potentially breaking bug fix: When a number's unit is ambiguous with a
    numeric exponent, the unit is now serialized as an escape code rather than a
    literal e to avoid being interpreted as an exponent by CSS.

  • Potentially breaking bug fix: Don't parse a CSS escape code for U+45 LATIN
    CAPITAL LETTER E or U+65 LATIN LOWERCASE LETTER E as an exponent in
    @keyframes percentage selectors.

  • Potentially breaking bug fix: Properly normalize underscores written as
    CSS escape codes in variable, mixin, and function names.


Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • "before 10am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) October 25, 2026 16:34
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​angular/​build@​22.2.3 ⏵ 22.2.48410078 +198100
Updatednpm/​postcss@​8.5.30 ⏵ 8.5.31100 +110082 +195100
Updatednpm/​postcss-nested@​9.0.0 ⏵ 9.0.110010096 +188100
Updatednpm/​core-js@​3.50.0 ⏵ 3.51.094 +110099 +189100
Updatednpm/​sass@​1.105.2 ⏵ 1.106.110010010097 +1100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants