Bump the zeppelin-web-angular-security-updates group across 1 directory with 11 updates by dependabot[bot] · Pull Request #5438 · apache/zeppelin

dependabot · 2026-08-25T16:01:34Z

Bumps the zeppelin-web-angular-security-updates group with 11 updates in the /zeppelin-web-angular directory:

Package	From	To
@angular/common	`21.2.15`	`21.2.20`
@angular/compiler	`21.2.15`	`21.2.19`
@angular/core	`21.2.15`	`21.2.20`
rollup	`0.25.8`	`4.60.4`
hono	`4.12.23`	`4.13.8`
http-proxy-middleware	`2.0.9`	`2.0.10`
launch-editor	`2.14.0`	`2.14.1`
shell-quote	`1.8.3`	`1.9.0`
piscina	`5.1.4`	`5.2.0`
tar	`7.5.15`	`7.5.22`
webpack-dev-server	`5.2.3`	`5.2.6`

Updates @angular/common from 21.2.15 to 21.2.20

Release notes

Sourced from @angular/common's releases.

21.2.20

core

Commit Description

sanitize host bindings on concrete hosts

http

Commit Description

match header values exactly when deleting

preserve immutability of materialized clones

run root interceptors in the terminal request chain

21.2.19

compiler

Commit Description

disallow i18n event attributes

restrict possible event handler check to property names longer than 2 characters

http

Commit Description

distinguish repeated transfer cache params

enable xsrf for root-provided HttpClient

platform-server

Commit Description

update domino to latest version

21.2.18

compiler-cli

Commit Description

update babel dependencies to latest v7

core

Commit Description

avoid caching missing locale data

reject dynamic script host elements

http

Commit Description

prevent caching of responses with Set-Cookie headers

service-worker

Commit Description

preserve referrer in asset requests

preserve referrer policy in asset requests

21.2.17

common

... (truncated)

Changelog

Sourced from @angular/common's changelog.

21.2.20 (2026-08-12)

core

Commit Type Description

6afe6fa781 fix sanitize host bindings on concrete hosts

http

Commit Type Description

fec5977df4 fix match header values exactly when deleting

e33d69a71c fix preserve immutability of materialized clones

caf616670f fix run root interceptors in the terminal request chain

21.2.19 (2026-07-29)

compiler

Commit Type Description

e2660c3dee fix disallow i18n event attributes

7b884f585a fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description

948a8d6831 fix distinguish repeated transfer cache params

9949dccce1 fix enable xsrf for root-provided HttpClient

platform-server

Commit Type Description

f34a93c946 fix update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit Type Description

8d22cc953b fix update babel dependencies to latest v7

core

Commit Type Description

6bcce117fb fix avoid caching missing locale data

5a693bafcd fix reject dynamic script host elements

http

Commit Type Description

91df739b80 fix prevent caching of responses with Set-Cookie headers

service-worker

| Commit | Type | Description |

... (truncated)

Commits

caf6166 fix(http): run root interceptors in the terminal request chain
fec5977 fix(http): match header values exactly when deleting
e33d69a fix(http): preserve immutability of materialized clones
948a8d6 fix(http): distinguish repeated transfer cache params
9949dcc fix(http): enable xsrf for root-provided HttpClient
91df739 fix(http): prevent caching of responses with Set-Cookie headers
86a56dc fix(common): Limits date format string length
bcb1b7e fix(http): preserve empty referrer option in HttpRequest
a810a31 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
Additional commits viewable in compare view

Updates @angular/compiler from 21.2.15 to 21.2.19

Release notes

Sourced from @angular/compiler's releases.

21.2.19

compiler

Commit Description

disallow i18n event attributes

restrict possible event handler check to property names longer than 2 characters

http

Commit Description

distinguish repeated transfer cache params

enable xsrf for root-provided HttpClient

platform-server

Commit Description

update domino to latest version

21.2.18

compiler-cli

Commit Description

update babel dependencies to latest v7

core

Commit Description

avoid caching missing locale data

reject dynamic script host elements

http

Commit Description

prevent caching of responses with Set-Cookie headers

service-worker

Commit Description

preserve referrer in asset requests

preserve referrer policy in asset requests

21.2.17

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

21.2.19 (2026-07-29)

compiler

Commit Type Description

e2660c3dee fix disallow i18n event attributes

7b884f585a fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description

948a8d6831 fix distinguish repeated transfer cache params

9949dccce1 fix enable xsrf for root-provided HttpClient

platform-server

Commit Type Description

f34a93c946 fix update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit Type Description

8d22cc953b fix update babel dependencies to latest v7

core

Commit Type Description

6bcce117fb fix avoid caching missing locale data

5a693bafcd fix reject dynamic script host elements

http

Commit Type Description

91df739b80 fix prevent caching of responses with Set-Cookie headers

service-worker

Commit Type Description

1804f73bec fix preserve referrer in asset requests

e86c31bf26 fix preserve referrer policy in asset requests

21.2.17 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

86a56dc279 fix Limits date format string length

... (truncated)

Commits

7b884f5 fix(compiler): restrict possible event handler check to property names longer...
e2660c3 fix(compiler): disallow i18n event attributes
dc9c996 fix(compiler): sanitize two-way properties
ae1c8a1 fix(compiler): move projection attributes into constants
See full diff in compare view

Updates @angular/core from 21.2.15 to 21.2.20

Release notes

Sourced from @angular/core's releases.

21.2.20

core

Commit Description

sanitize host bindings on concrete hosts

http

Commit Description

match header values exactly when deleting

preserve immutability of materialized clones

run root interceptors in the terminal request chain

21.2.19

compiler

Commit Description

disallow i18n event attributes

restrict possible event handler check to property names longer than 2 characters

http

Commit Description

distinguish repeated transfer cache params

enable xsrf for root-provided HttpClient

platform-server

Commit Description

update domino to latest version

21.2.18

compiler-cli

Commit Description

update babel dependencies to latest v7

core

Commit Description

avoid caching missing locale data

reject dynamic script host elements

http

Commit Description

prevent caching of responses with Set-Cookie headers

service-worker

Commit Description

preserve referrer in asset requests

preserve referrer policy in asset requests

21.2.17

common

... (truncated)

Changelog

Sourced from @angular/core's changelog.

21.2.20 (2026-08-12)

core

Commit Type Description

6afe6fa781 fix sanitize host bindings on concrete hosts

http

Commit Type Description

fec5977df4 fix match header values exactly when deleting

e33d69a71c fix preserve immutability of materialized clones

caf616670f fix run root interceptors in the terminal request chain

21.2.19 (2026-07-29)

compiler

Commit Type Description

e2660c3dee fix disallow i18n event attributes

7b884f585a fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description

948a8d6831 fix distinguish repeated transfer cache params

9949dccce1 fix enable xsrf for root-provided HttpClient

platform-server

Commit Type Description

f34a93c946 fix update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit Type Description

8d22cc953b fix update babel dependencies to latest v7

core

Commit Type Description

6bcce117fb fix avoid caching missing locale data

5a693bafcd fix reject dynamic script host elements

http

Commit Type Description

91df739b80 fix prevent caching of responses with Set-Cookie headers

service-worker

| Commit | Type | Description |

... (truncated)

Commits

6afe6fa fix(core): sanitize host bindings on concrete hosts
7b884f5 fix(compiler): restrict possible event handler check to property names longer...
e2660c3 fix(compiler): disallow i18n event attributes
5a693ba fix(core): reject dynamic script host elements
6bcce11 fix(core): avoid caching missing locale data
88832c8 fix(core): validate lowercase SVG animation attribute names (#69269)
3551074 fix(platform-server): harden platform location origin validation during SSR
bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
d846326 fix(common): skip transfer cache for uncacheable HTTP traffic
e245d40 fix(http): skip transfer cache for fetch credentialed requests
Additional commits viewable in compare view

Updates rollup from 0.25.8 to 4.60.4

Release notes

Sourced from rollup's releases.

v4.60.4

4.60.4

2026-05-14

Bug Fixes

Improve stability of chunk hashes (#6362)

Pull Requests

#6362: fix: stabilize chunk assignment across parallel file reads (@sonukapoor, @Sonu Kapoor, @TrickyPi, @lukastaegert)

#6370: fix(deps): update minor/patch updates (@renovate[bot])

#6371: chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)

#6372: chore(deps): update react monorepo to v19 (major) (@renovate[bot])

#6373: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6375: Resolve vulnerabilities (@lukastaegert)

v4.60.2

4.60.2

2026-04-18

Bug Fixes

Resolve a variable rendering bug when generating different formats from the same build (#6350)

Pull Requests

#6327: docs: fix various typos in source and documentation (@Abhi3975, @lukastaegert)

#6331: fix(deps): update minor/patch updates (@renovate[bot])

#6332: chore(deps): update codecov/codecov-action action to v6 (@renovate[bot])

#6333: chore(deps): update dependency eslint-plugin-unicorn to v64 (@renovate[bot])

#6334: fix(deps): update rust crate swc_compiler_base to v51 (@renovate[bot])

#6335: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6346: fix(deps): update minor/patch updates (@renovate[bot])

#6347: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6348: fix(deps): update swc monorepo (major) (@renovate[bot], @lukastaegert)

#6349: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6350: fix: reset variable render names between outputs in the same generate (@barry3406, @lukastaegert)

#6351: chore(deps): update minor/patch updates (@renovate[bot])

#6352: chore(deps): update cross-platform-actions/action action to v1 (@renovate[bot])

#6353: chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)

#6354: chore(deps): lock file maintenance (@renovate[bot])

#6355: chore(deps): lock file maintenance (@renovate[bot])

#6356: chore(deps): lock file maintenance (@renovate[bot])

#6358: chore: remove cross-env from devDeps (@K-tecchan)

v4.60.1

4.60.1

... (truncated)

Changelog

Sourced from rollup's changelog.

rollup changelog

0.68.2

2018-12-23

Bug Fixes

Do not assume hoisted variables to have been initialized (#2607)

Pull Requests

#2607: Fix an issues where hoisted variables were assumed to have been initialized (@lye)

0.68.1

2018-12-19

Bug Fixes

Fix an issue with UMD wrappers where a variable is used without being defined (#2600)

Pull Requests

#2600: Fix UMD and IIFE wrapper issues and add comprehensive functional wrapper tests (@lukastaegert)

0.68.0

2018-12-16

Breaking Changes

optimizeChunks is renamed to experimentalOptimizeChunks to reflect this feature is not production-ready yet ( #2575)

Features

Plugins can iterate all module ids via this.moduleIds (#2565)

Plugins can get graph information about a module via this.getModuleInfo(id) (#2565)

Plugins and JS API users get more information about the generated chunks: dynamicImports, facadeModuleId, isDynamicEntry, name (#2575)

Tree-shaken dynamic imports will no longer create chunks or influence chunking in any way (#2575)

Dynamic imports will no longer follow the entryFileNames but the chunkFileNames property reflecting those are solely internally used (#2575)

If there are chunk naming conflicts, entry chunks will always take precedence (#2575)

If an entry facade is created, only the facade chunk is marked as isEntry (#2575)

Dynamic chunks will only be marked as isEntry if they are actually entry chunks as well; thus there is now a 1-to-1 correspondence between modules listed in input and chunks marked as isEntry (#2575)

Chunks no longer contain imports for variables that are tree-shaken in the chunk but used in other chunks (#2584)

Chunks will always import re-exported variables directly from the chunk where they are originally exported from ( #2584)

Null characters will be pruned from chunk ids to allow for virtually created chunks and make rollup-plugin-multi-entry compatible with code-splitting and thus the upcoming 1.0 version (#2590)

Simplify the UMD wrapper code as much as possible, especially if there are no exports (#2594)

The UMD wrapper will now work in strict mode by checking for self before this when determining the global variable (#2594)

... (truncated)

Commits

d311a84 4.60.4
6aa3248 fix: stabilize chunk assignment across parallel file reads (#6362)
82a0fe7 Resolve vulnerabilities (#6375)
71f5ebc chore(deps): update dependency lru-cache to v11 (#6371)
af91d77 chore(deps): lock file maintenance (#6373)
65e7b94 chore(deps): update react monorepo to v19 (major) (#6372)
642587f fix(deps): update minor/patch updates (#6370)
b47bdab 4.60.3
15c5f33 Add again some unneeded dev dependencies, to make some builds succeed
12195dc fix: do not rename nested "exports" bindings that do not conflict (#6360)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for rollup since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates hono from 4.12.23 to 4.13.8

Release notes

Sourced from hono's releases.

v4.13.8

What's Changed

docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343

perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340

fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351

fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311

fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349

fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357

fix(request): keep the request media type when reusing a cached body in honojs/hono#5366

docs(combine): fix except() JSDoc param and add missing @returns in honojs/hono#5346

perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

... (truncated)

Commits

098e119 4.13.8
e8c8c21 perf(jsx/dom): optimize matching-head child lookup during reconciliation (#5329)
8755b17 docs(combine): fix except() JSDoc param and add missing @returns (#5346)
edd138e fix(request): keep the request media type when reusing a cached body (#5366)
9b4e9c2 fix(accept): clamp a negative q to 0, not 1 (#5357)
65cff90 fix(accept): treat the q parameter name as case-insensitive (#5349)
f147de5 fix(accepts, language): skip accept entries with quality 0 when matching (#5311)
90e1b94 fix(aws-lambda): respect backpressure when streaming the response body (#5351)
7792f5d perf(jsx/dom): reduce lookup work for large keyed updates (#5340)
e7b38ee docs: fix typos in code comments and link third-party middleware section (#5343)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates http-proxy-middleware from 2.0.9 to 2.0.10

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.10

What's Changed

fix: harden proxy-table matching to prevent routing bypass by @G-Rath in chimurai/http-proxy-middleware#1268

ci(github-actions): update publish.yml by @chimurai in chimurai/http-proxy-middleware#1270

chore(package.json): v2.0.10 by @chimurai in chimurai/http-proxy-middleware#1271

New Contributors

@G-Rath made their first contribution in chimurai/http-proxy-middleware#1268

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10

v2.0.10-beta.0

What's Changed

fix: harden proxy-table matching to prevent routing bypass by @G-Rath in chimurai/http-proxy-middleware#1268

ci(github-actions): update publish.yml by @chimurai in chimurai/http-proxy-middleware#1270

New Contributors

@G-Rath made their first contribution in chimurai/http-proxy-middleware#1268

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10-beta.0

Changelog

Sourced from http-proxy-middleware's changelog.

v2.0.10

fix(router): harden proxy-table matching (exact host for host+path keys, prefix-only path matching) to prevent routing bypass

Commits

f0be839 chore(package.json): v2.0.10 (#1271)
19c860d ci(github-actions): update publish.yml (#1270)
d0f7d63 fix: harden proxy-table matching to prevent routing bypass (#1268)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for http-proxy-middleware since your current version.

Updates launch-editor from 2.14.0 to 2.14.1

Commits

3f97c64 v2.14.1
0cc9550 fix: reject UNC paths (#138)
afd1ab9 ci: run tests on mac and windows (#136)
0bfa328 test: add some tests for launch-editor package (#135)
1b006ae chore: add README (#134)
See full diff in compare view

Updates shell-quote from 1.8.3 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

[Fix] quote: validate object-token shapes 4378a6e

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0

[Tests] increase coverage 9f3caa3

[readme] replace runkit CI badge with shields.io check-runs badge 3344a04

[Dev Deps] update @ljharb/eslint-config 699c511

Commits

db09fc7 v1.9.0
7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
b4bafa2 [actions] Wind...
Description has been truncated

voidmatcha · 2026-09-17T14:11:22Z

@dependabot rebase

voidmatcha · 2026-09-20T02:22:22Z

@dependabot recreate

…ry with 11 updates Bumps the zeppelin-web-angular-security-updates group with 11 updates in the /zeppelin-web-angular directory: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.15` | `21.2.20` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.15` | `21.2.19` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.15` | `21.2.20` | | [rollup](https://github.com/rollup/rollup) | `0.25.8` | `4.60.4` | | [hono](https://github.com/honojs/hono) | `4.12.23` | `4.13.8` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.9` | `2.0.10` | | [launch-editor](https://github.com/vitejs/launch-editor) | `2.14.0` | `2.14.1` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.9.0` | | [piscina](https://github.com/piscinajs/piscina) | `5.1.4` | `5.2.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.15` | `7.5.22` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.3` | `5.2.6` | Updates `@angular/common` from 21.2.15 to 21.2.20 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.20/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.20/packages/common) Updates `@angular/compiler` from 21.2.15 to 21.2.19 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.19/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.19/packages/compiler) Updates `@angular/core` from 21.2.15 to 21.2.20 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.20/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.20/packages/core) Updates `rollup` from 0.25.8 to 4.60.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-0.md) - [Commits](rollup/rollup@v0.25.8...v4.60.4) Updates `hono` from 4.12.23 to 4.13.8 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.23...v4.13.8) Updates `http-proxy-middleware` from 2.0.9 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.9...v2.0.10) Updates `launch-editor` from 2.14.0 to 2.14.1 - [Commits](vitejs/launch-editor@v2.14.0...v2.14.1) Updates `shell-quote` from 1.8.3 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.9.0) Updates `piscina` from 5.1.4 to 5.2.0 - [Release notes](https://github.com/piscinajs/piscina/releases) - [Changelog](https://github.com/piscinajs/piscina/blob/v5.2.0/CHANGELOG.md) - [Commits](piscinajs/piscina@v5.1.4...v5.2.0) Updates `tar` from 7.5.15 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.15...v7.5.22) Updates `webpack-dev-server` from 5.2.3 to 5.2.6 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.3...v5.2.6) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 21.2.19 dependency-type: direct:production dependency-group: zeppelin-web-angular-security-updates - dependency-name: "@angular/compiler" dependency-version: 21.2.19 dependency-type: direct:production dependency-group: zeppelin-web-angular-security-updates - dependency-name: "@angular/core" dependency-version: 21.2.17 dependency-type: direct:production dependency-group: zeppelin-web-angular-security-updates - dependency-name: hono dependency-version: 4.13.4 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: launch-editor dependency-version: 2.14.1 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: piscina dependency-version: 5.2.0 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: rollup dependency-version: 4.60.4 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: webpack-dev-server dependency-version: 5.2.5 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates ... Signed-off-by: dependabot[bot] <support@github.com>

voidmatcha · 2026-09-20T07:44:52Z

Closing: @angular/compiler moves to 21.2.19 while @angular/compiler-cli stays at 21.2.15, and compiler-cli peer-requires the exact same version, so npm ci fails before anything builds. A recreate produced the same pair.

The @angular/* packages have to move together, which this group cannot express. Tracked in ZEPPELIN-6657.

dependabot · 2026-09-20T07:44:56Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 25, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/zeppelin-web-angular/zeppelin-web-angular-security-updates-ee2b507370 branch from 23db788 to fa414d8 Compare September 4, 2026 14:55

dependabot Bot force-pushed the dependabot/npm_and_yarn/zeppelin-web-angular/zeppelin-web-angular-security-updates-ee2b507370 branch 2 times, most recently from cb925d2 to ddd4187 Compare September 13, 2026 08:22

dependabot Bot force-pushed the dependabot/npm_and_yarn/zeppelin-web-angular/zeppelin-web-angular-security-updates-ee2b507370 branch from ddd4187 to ccf2afd Compare September 17, 2026 14:14

dependabot Bot force-pushed the dependabot/npm_and_yarn/zeppelin-web-angular/zeppelin-web-angular-security-updates-ee2b507370 branch from ccf2afd to cbe9bb7 Compare September 20, 2026 02:25

voidmatcha closed this Sep 20, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/zeppelin-web-angular/zeppelin-web-angular-security-updates-ee2b507370 branch September 20, 2026 07:45

Navigation Menu

Bump the zeppelin-web-angular-security-updates group across 1 directory with 11 updates - #5438

Bump the zeppelin-web-angular-security-updates group across 1 directory with 11 updates#5438
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/zeppelin-web-angular/zeppelin-web-angular-security-updates-ee2b507370

dependabot Bot commented on behalf of github Aug 25, 2026 •

edited

Loading

Uh oh!

voidmatcha commented Sep 17, 2026

Uh oh!

voidmatcha commented Sep 20, 2026

Uh oh!

voidmatcha commented Sep 20, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Commit	Description
	match header values exactly when deleting
	preserve immutability of materialized clones
	run root interceptors in the terminal request chain

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

Commit	Description
	distinguish repeated transfer cache params
	enable xsrf for root-provided HttpClient

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

Commit	Type	Description
fec5977df4	fix	match header values exactly when deleting
e33d69a71c	fix	preserve immutability of materialized clones
caf616670f	fix	run root interceptors in the terminal request chain

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

Conversation

dependabot Bot commented on behalf of github Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

21.2.20

core

http

21.2.19

compiler

http

platform-server

21.2.18

compiler-cli

core

http

service-worker

21.2.17

common

21.2.20 (2026-08-12)

core

http

21.2.19 (2026-07-29)

compiler

http

platform-server

21.2.18 (2026-07-08)

compiler-cli

core

http

service-worker

21.2.19

compiler

http

platform-server

21.2.18

compiler-cli

core

http

service-worker

21.2.17

common

compiler

core

21.2.19 (2026-07-29)

compiler

http

platform-server

21.2.18 (2026-07-08)

compiler-cli

core

http

service-worker

21.2.17 (2026-06-10)

Deprecations

platform-server

common

21.2.20

core

http

21.2.19

compiler

http

platform-server

21.2.18

compiler-cli

core

http

service-worker

21.2.17

common

21.2.20 (2026-08-12)

core

http

21.2.19 (2026-07-29)

compiler

http

platform-server

21.2.18 (2026-07-08)

compiler-cli

core

http

dependabot Bot commented on behalf of github Aug 25, 2026 •

edited

Loading

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory