Bump the zeppelin-web-angular-security-updates group across 1 directory with 16 updates by dependabot[bot] · Pull Request #5509 · apache/zeppelin

dependabot · 2026-09-28T20:54:44Z

Bumps the zeppelin-web-angular-security-updates group with 16 updates in the /zeppelin-web-angular directory:

Package	From	To
@angular/common	`21.2.15`	`21.2.20`
@angular/compiler	`21.2.15`	`21.2.19`
@angular/core	`21.2.15`	`21.2.20`
@hono/node-server	`1.19.14`	`1.19.17`
@vitest/mocker	`4.1.8`	`5.0.2`
baseline-browser-mapping	`2.10.32`	`2.11.26`
browserslist	`4.28.2`	`4.29.2`
hono	`4.12.23`	`4.13.10`
http-proxy-middleware	`2.0.9`	`2.0.10`
ip-address	`10.2.0`	`10.7.2`
shell-quote	`1.8.3`	`1.9.0`
piscina	`5.1.4`	`5.2.0`
postcss	`8.5.12`	`8.5.23`
postcss-selector-parser	`7.1.1`	`7.1.6`
tar	`7.5.15`	`7.5.22`
webpack-dev-server	`5.2.3`	`5.2.6`

Updates @angular/common from 21.2.15 to 21.2.20

Release notes

Sourced from @angular/common's releases.

21.2.20

core

Commit Description

sanitize host bindings on concrete hosts

http

Commit Description

match header values exactly when deleting

preserve immutability of materialized clones

run root interceptors in the terminal request chain

21.2.19

compiler

Commit Description

disallow i18n event attributes

restrict possible event handler check to property names longer than 2 characters

http

Commit Description

distinguish repeated transfer cache params

enable xsrf for root-provided HttpClient

platform-server

Commit Description

update domino to latest version

21.2.18

compiler-cli

Commit Description

update babel dependencies to latest v7

core

Commit Description

avoid caching missing locale data

reject dynamic script host elements

http

Commit Description

prevent caching of responses with Set-Cookie headers

service-worker

Commit Description

preserve referrer in asset requests

preserve referrer policy in asset requests

21.2.17

common

... (truncated)

Changelog

Sourced from @angular/common's changelog.

21.2.20 (2026-08-12)

core

Commit Type Description

6afe6fa781 fix sanitize host bindings on concrete hosts

http

Commit Type Description

fec5977df4 fix match header values exactly when deleting

e33d69a71c fix preserve immutability of materialized clones

caf616670f fix run root interceptors in the terminal request chain

21.2.19 (2026-07-29)

compiler

Commit Type Description

e2660c3dee fix disallow i18n event attributes

7b884f585a fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description

948a8d6831 fix distinguish repeated transfer cache params

9949dccce1 fix enable xsrf for root-provided HttpClient

platform-server

Commit Type Description

f34a93c946 fix update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit Type Description

8d22cc953b fix update babel dependencies to latest v7

core

Commit Type Description

6bcce117fb fix avoid caching missing locale data

5a693bafcd fix reject dynamic script host elements

http

Commit Type Description

91df739b80 fix prevent caching of responses with Set-Cookie headers

service-worker

| Commit | Type | Description |

... (truncated)

Commits

caf6166 fix(http): run root interceptors in the terminal request chain
fec5977 fix(http): match header values exactly when deleting
e33d69a fix(http): preserve immutability of materialized clones
948a8d6 fix(http): distinguish repeated transfer cache params
9949dcc fix(http): enable xsrf for root-provided HttpClient
91df739 fix(http): prevent caching of responses with Set-Cookie headers
86a56dc fix(common): Limits date format string length
bcb1b7e fix(http): preserve empty referrer option in HttpRequest
a810a31 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
Additional commits viewable in compare view

Updates @angular/compiler from 21.2.15 to 21.2.19

Release notes

Sourced from @angular/compiler's releases.

21.2.19

compiler

Commit Description

disallow i18n event attributes

restrict possible event handler check to property names longer than 2 characters

http

Commit Description

distinguish repeated transfer cache params

enable xsrf for root-provided HttpClient

platform-server

Commit Description

update domino to latest version

21.2.18

compiler-cli

Commit Description

update babel dependencies to latest v7

core

Commit Description

avoid caching missing locale data

reject dynamic script host elements

http

Commit Description

prevent caching of responses with Set-Cookie headers

service-worker

Commit Description

preserve referrer in asset requests

preserve referrer policy in asset requests

21.2.17

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

21.2.19 (2026-07-29)

compiler

Commit Type Description

e2660c3dee fix disallow i18n event attributes

7b884f585a fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description

948a8d6831 fix distinguish repeated transfer cache params

9949dccce1 fix enable xsrf for root-provided HttpClient

platform-server

Commit Type Description

f34a93c946 fix update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit Type Description

8d22cc953b fix update babel dependencies to latest v7

core

Commit Type Description

6bcce117fb fix avoid caching missing locale data

5a693bafcd fix reject dynamic script host elements

http

Commit Type Description

91df739b80 fix prevent caching of responses with Set-Cookie headers

service-worker

Commit Type Description

1804f73bec fix preserve referrer in asset requests

e86c31bf26 fix preserve referrer policy in asset requests

21.2.17 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

86a56dc279 fix Limits date format string length

... (truncated)

Commits

7b884f5 fix(compiler): restrict possible event handler check to property names longer...
e2660c3 fix(compiler): disallow i18n event attributes
dc9c996 fix(compiler): sanitize two-way properties
ae1c8a1 fix(compiler): move projection attributes into constants
See full diff in compare view

Updates @angular/core from 21.2.15 to 21.2.20

Release notes

Sourced from @angular/core's releases.

21.2.20

core

Commit Description

sanitize host bindings on concrete hosts

http

Commit Description

match header values exactly when deleting

preserve immutability of materialized clones

run root interceptors in the terminal request chain

21.2.19

compiler

Commit Description

disallow i18n event attributes

restrict possible event handler check to property names longer than 2 characters

http

Commit Description

distinguish repeated transfer cache params

enable xsrf for root-provided HttpClient

platform-server

Commit Description

update domino to latest version

21.2.18

compiler-cli

Commit Description

update babel dependencies to latest v7

core

Commit Description

avoid caching missing locale data

reject dynamic script host elements

http

Commit Description

prevent caching of responses with Set-Cookie headers

service-worker

Commit Description

preserve referrer in asset requests

preserve referrer policy in asset requests

21.2.17

common

... (truncated)

Changelog

Sourced from @angular/core's changelog.

21.2.20 (2026-08-12)

core

Commit Type Description

6afe6fa781 fix sanitize host bindings on concrete hosts

http

Commit Type Description

fec5977df4 fix match header values exactly when deleting

e33d69a71c fix preserve immutability of materialized clones

caf616670f fix run root interceptors in the terminal request chain

21.2.19 (2026-07-29)

compiler

Commit Type Description

e2660c3dee fix disallow i18n event attributes

7b884f585a fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description

948a8d6831 fix distinguish repeated transfer cache params

9949dccce1 fix enable xsrf for root-provided HttpClient

platform-server

Commit Type Description

f34a93c946 fix update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit Type Description

8d22cc953b fix update babel dependencies to latest v7

core

Commit Type Description

6bcce117fb fix avoid caching missing locale data

5a693bafcd fix reject dynamic script host elements

http

Commit Type Description

91df739b80 fix prevent caching of responses with Set-Cookie headers

service-worker

| Commit | Type | Description |

... (truncated)

Commits

6afe6fa fix(core): sanitize host bindings on concrete hosts
7b884f5 fix(compiler): restrict possible event handler check to property names longer...
e2660c3 fix(compiler): disallow i18n event attributes
5a693ba fix(core): reject dynamic script host elements
6bcce11 fix(core): avoid caching missing locale data
88832c8 fix(core): validate lowercase SVG animation attribute names (#69269)
3551074 fix(platform-server): harden platform location origin validation during SSR
bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
d846326 fix(common): skip transfer cache for uncacheable HTTP traffic
e245d40 fix(http): skip transfer cache for fetch credentialed requests
Additional commits viewable in compare view

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits

71941da 1.19.17
0208500 ci: add stage option for publishing (#386)
cbdf713 1.19.16
86e96c2 ci: add an action for trusted publisher (#385)
99c1a1a ci: run on v1.x branch pushes
84cb2ee Merge commit from fork
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates @vitest/mocker from 4.1.8 to 5.0.2

Release notes

Sourced from @vitest/mocker's releases.

v5.0.2

   🐞 Bug Fixes

Bind process in case global is overwritten - by @AriPerkkio in vitest-dev/vitest#11343 (0b792)

detect-async-leaks:

Ignore process.stdio handles - by @AriPerkkio in vitest-dev/vitest#11333 (0fd6b)

expect:

Fix toMatchObject with asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)

jsdom:

Fix Request with Blob body on jsdom 28+ - by @harshit-d3v in vitest-dev/vitest#11295 (d1c3e)

reporter:

agent to respect --silent - by @Raj4478 and @AriPerkkio in vitest-dev/vitest#11271 (5b95e)

reporters:

Handle concurrent createReport calls - by @7rulnik in vitest-dev/vitest#11278 (e8e55)

hanging-process to use ESM entrypoint - by @AriPerkkio in vitest-dev/vitest#11316 (4e91e)

spy:

Fix stack overflow when spying Set.prototype.add - by @fengmk2 in vitest-dev/vitest#11299 (a0a93)

ui:

Persist authentication cookie beyond current browser session - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11066 (f8819)

    View changes on GitHub

v5.0.1

   🚀 Features

ui:

Move trace attempts selector to viewer header - by @hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11189 (5dc4b)

Add focused trace view layout mode - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11190 (376dc)

   🐞 Bug Fixes

Exit 1 when vitest list fails collection - by @hamed-bavar in vitest-dev/vitest#11145 and vitest-dev/vitest#11146 (6108b)

Keep parse error details in static collection - by @hamed-bavar in vitest-dev/vitest#11150 and vitest-dev/vitest#11151 (7c818)

Avoid recursive prototype in automocking - by @sheremet-va in vitest-dev/vitest#11195 (99fc5)

Prevent false Vitest import resolution - by @sheremet-va in vitest-dev/vitest#11196 (b426c)

Keep metadata file when clearing the cache - by @sheremet-va in vitest-dev/vitest#11199 (73614)

Correct typos in error message and comments - by @shinji00222 and Shinji in vitest-dev/vitest#11187 (115c3)

Resolve ResolvedConfig exactOptionalPropertyTypes errors - by @LukeAbby in vitest-dev/vitest#11175 (498fb)

Share the server on self-referencing extends - by @sheremet-va in vitest-dev/vitest#11034 (23dda)

Warn when deprecated deps.optimizer.web is used - by @im10furry in vitest-dev/vitest#11214 (2ce29)

browser:

Avoid double quotes in config.define - by @sheremet-va in vitest-dev/vitest#11198 (972e2)

doctor:

Measure vm pools for custom environments - by @sheremet-va in vitest-dev/vitest#11212 (91ab1)

expect:

Correct return value in toMatchAriaSnapshot - by @sheremet-va in vitest-dev/vitest#11208 (c119b)

fakeTimers:

Force queueMicrotask and nextTick in toNotFake - by @kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @hi-ogawa in vitest-dev/vitest#11261 (a47d7)

snapshot:

Report obsolete keys next to skipped tests - by @hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11157 and vitest-dev/vitest#11158 (17e2b)

... (truncated)

Commits

428e2e5 chore: release v5.0.2 (#11357)
03630a5 chore: release v5.0.1 (#11275)
f441c6f chore: release v5.0.0 (#11130)
897f51f chore: release v5.0.0-rc.4 (#11107)
7db80dc chore: release v5.0.0-rc.3 (#11089)
732df2c fix(deps): update all non-major dependencies (#11043)
1e9f80e perf(vm): don't prewarm modules the worker never requests (#11033)
af83d1b chore: release v5.0.0-rc.2 (#10976)
8ff9b9a fix(mocker): restrict redirect mocks to the fs allowlist (#10972)
65263d7 fix(deps): update all non-major dependencies (#10966)
Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.10.32 to 2.11.26

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.

refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @swwind for the idea!

refactor: Some common functions have been moved to a util.ts module for use in other scripts.

fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

c1934c6 Patch to 2.11.26 because browser or feature data changed
4873684 Browser or feature data changed
9030798 Updating static site
a5df351 Updating static site
ecc5b54 Updating static site
719bf7a Patch to 2.11.25 because browser or feature data changed
c4f5b49 Browser or feature data changed
aa194af Updating static site
0d33c4a Patch to 2.11.24 because browser or feature data changed
1dac891 Browser or feature data changed
Additional commits viewable in compare view

Updates browserslist from 4.28.2 to 4.29.2

Release notes

Sourced from browserslist's releases.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

Changelog

Sourced from browserslist's changelog.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

Commits

906d329 Release 4.29.2 version
ff8c83f Update dependencies
067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
f760921 Do not add versions without usage data to cover queries
5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
1e5356f Note that Android version queries return only the latest version
5b7e941 Add missed changes to ChangeLog
d539317 Release 4.29.1 version
5618b50 Update dependencies
1078f90 Fix config loading protection for Windows
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates hono from 4.12.23 to 4.13.10

Release notes

Sourced from hono's releases.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:
- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'
hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

chore: migrate the package manager from bun to pnpm in honojs/hono#5433

chore(package.json): invoke package scripts through pnpm instead of bun in honojs/hono#5434

chore: replace prettier with oxfmt in honojs/hono#5435

chore(deps): upgrade vitest to 5.0.1 in honojs/hono#5437

chore: let oxfmt sort imports instead of eslint in honojs/hono#5442

chore: replace eslint with oxlint in honojs/hono#5443

chore: introduce Vite+ in honojs/hono#5444

fix(types): allow returning a Blob as a response body in honojs/hono#5446

chore: convert build scripts into plugins in honojs/hono#5448

chore: stop editorconfig-checker from checking Markdown indent size in honojs/hono#5455

ci: remove empty step left in cr.yml by the pnpm migration in honojs/hono#5456

chore(deps): upgrade vite-plus to 1.0.0-rc.1 in honojs/hono#5459

feat(adapters): add @hono/bun as a workspace package in honojs/hono#5447

chore(adapters/bun): ship ESM only in honojs/hono#5462

feat(adapters): add the seven adapters as workspace packages in honojs/hono#5463

feat(adapters/deno): publish to JSR in honojs/hono#5465

test: move adapter runtime tests into adapters/* in honojs/hono#5466

Full Changelog:

…ry with 16 updates Bumps the zeppelin-web-angular-security-updates group with 16 updates in the /zeppelin-web-angular directory: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.15` | `21.2.20` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.15` | `21.2.19` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.15` | `21.2.20` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `1.19.17` | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.8` | `5.0.2` | | [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.32` | `2.11.26` | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.2` | `4.29.2` | | [hono](https://github.com/honojs/hono) | `4.12.23` | `4.13.10` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.9` | `2.0.10` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.7.2` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.9.0` | | [piscina](https://github.com/piscinajs/piscina) | `5.1.4` | `5.2.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.23` | | [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.1` | `7.1.6` | | [tar](https://github.com/isaacs/node-tar) | `7.5.15` | `7.5.22` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.3` | `5.2.6` | Updates `@angular/common` from 21.2.15 to 21.2.20 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.20/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.20/packages/common) Updates `@angular/compiler` from 21.2.15 to 21.2.19 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.19/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.19/packages/compiler) Updates `@angular/core` from 21.2.15 to 21.2.20 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.20/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.20/packages/core) Updates `@hono/node-server` from 1.19.14 to 1.19.17 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.14...v1.19.17) Updates `@vitest/mocker` from 4.1.8 to 5.0.2 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.2/packages/mocker) Updates `baseline-browser-mapping` from 2.10.32 to 2.11.26 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.32...v2.11.26) Updates `browserslist` from 4.28.2 to 4.29.2 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.2...4.29.2) Updates `hono` from 4.12.23 to 4.13.10 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.23...v4.13.10) Updates `http-proxy-middleware` from 2.0.9 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.9...v2.0.10) Updates `ip-address` from 10.2.0 to 10.7.2 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.7.2) Updates `shell-quote` from 1.8.3 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.9.0) Updates `piscina` from 5.1.4 to 5.2.0 - [Release notes](https://github.com/piscinajs/piscina/releases) - [Changelog](https://github.com/piscinajs/piscina/blob/v5.2.0/CHANGELOG.md) - [Commits](piscinajs/piscina@v5.1.4...v5.2.0) Updates `postcss` from 8.5.12 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.12...8.5.23) Updates `postcss-selector-parser` from 7.1.1 to 7.1.6 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.6) Updates `tar` from 7.5.15 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.15...v7.5.22) Updates `webpack-dev-server` from 5.2.3 to 5.2.6 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.3...v5.2.6) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 21.2.20 dependency-type: direct:production dependency-group: zeppelin-web-angular-security-updates - dependency-name: "@angular/compiler" dependency-version: 21.2.19 dependency-type: direct:production dependency-group: zeppelin-web-angular-security-updates - dependency-name: "@angular/core" dependency-version: 21.2.20 dependency-type: direct:production dependency-group: zeppelin-web-angular-security-updates - dependency-name: "@hono/node-server" dependency-version: 1.19.17 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: "@vitest/mocker" dependency-version: 5.0.2 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: baseline-browser-mapping dependency-version: 2.11.26 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: browserslist dependency-version: 4.29.2 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: hono dependency-version: 4.13.10 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: ip-address dependency-version: 10.7.2 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: piscina dependency-version: 5.2.0 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: postcss-selector-parser dependency-version: 7.1.6 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: indirect dependency-group: zeppelin-web-angular-security-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 28, 2026

Navigation Menu

Bump the zeppelin-web-angular-security-updates group across 1 directory with 16 updates - #5509

Bump the zeppelin-web-angular-security-updates group across 1 directory with 16 updates#5509
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/zeppelin-web-angular/zeppelin-web-angular-security-updates-48ad48147a

dependabot Bot commented on behalf of github Sep 28, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	match header values exactly when deleting
	preserve immutability of materialized clones
	run root interceptors in the terminal request chain

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

Commit	Description
	distinguish repeated transfer cache params
	enable xsrf for root-provided HttpClient

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

Commit	Type	Description
fec5977df4	fix	match header values exactly when deleting
e33d69a71c	fix	preserve immutability of materialized clones
caf616670f	fix	run root interceptors in the terminal request chain

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

Conversation

dependabot Bot commented on behalf of github Sep 28, 2026

21.2.20

core

http

21.2.19

compiler

http

platform-server

21.2.18

compiler-cli

core

http

service-worker

21.2.17

common

21.2.20 (2026-08-12)

core

http

21.2.19 (2026-07-29)

compiler

http

platform-server

21.2.18 (2026-07-08)

compiler-cli

core

http

service-worker

21.2.19

compiler

http

platform-server

21.2.18

compiler-cli

core

http

service-worker

21.2.17

common

compiler

core

21.2.19 (2026-07-29)

compiler

http

platform-server

21.2.18 (2026-07-08)

compiler-cli

core

http

service-worker

21.2.17 (2026-06-10)

Deprecations

platform-server

common

21.2.20

core

http

21.2.19

compiler

http

platform-server

21.2.18

compiler-cli

core

http

service-worker

21.2.17

common

21.2.20 (2026-08-12)

core

http

21.2.19 (2026-07-29)

compiler

http

platform-server

21.2.18 (2026-07-08)

compiler-cli

core

http

service-worker