chore(deps-dev): bump @angular/platform-server and @angular-devkit/build-angular in /packages/angular by dependabot[bot] · Pull Request #4530 · BuilderIO/builder

dependabot · 2026-04-17T01:22:52Z

Bumps @angular/platform-server and @angular-devkit/build-angular. These dependencies needed to be updated together.
Updates @angular/platform-server from 18.0.6 to 21.2.9

Release notes

Sourced from @angular/platform-server's releases.

21.2.9

core

Commit Description

escape forward slashes in transfer state to prevent crawler indexing

http

Commit Description

add CSP nonce support to JsonpClientBackend

Don't on Passthru outside of reactive context

platform-server

Commit Description

prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Description

normalize multiple leading slashes in URL parser

21.2.8

compiler

Commit Description

handle nested brackets in host object bindings

compiler-cli

Commit Description

error for type parameter declarations

core

Commit Description

handle missing serialized container hydration data

remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit Description

get quick info at local var location to align with TS semantics and support type narrowing

21.2.7

compiler

Commit Description

register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit Description

prevent recursive scope checks for invalid NgModule imports

core

Commit Description

... (truncated)

Changelog

Sourced from @angular/platform-server's changelog.

21.2.9 (2026-04-15)

core

Commit Type Description

f603d4714f fix escape forward slashes in transfer state to prevent crawler indexing

http

Commit Type Description

540536c386 fix add CSP nonce support to JsonpClientBackend

63a857b874 fix Don't on Passthru outside of reactive context

platform-server

Commit Type Description

e0b5078cf2 fix prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit Type Description

684e9fd53d fix normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.

TypeScript versions older than 6.0 are no longer supported.

ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.

ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit Type Description

2ce0e98f79 fix handle nested brackets in host object bindings

compiler-cli

Commit Type Description

7f9450219f feat Adds warning for prefetch without main defer trigger

ab061a7610 fix error for type parameter declarations

9218140348 fix resolve TCB mapping failure for safe property reads with as any

core

Commit Type Description

a0aa8304cd feat bootstrap via ApplicationRef with config

9c55fcb3e6 feat de-duplicate host directives

8fe025f514 feat drop support for TypeScript 5.9

77f1ca08e4 fix handle missing serialized container hydration data

... (truncated)

Commits

e0b5078 fix(platform-server): prevent SSRF bypasses via protocol-relative and backsla...
f603d47 fix(core): escape forward slashes in transfer state to prevent crawler indexing
04f5841 test(platform-server): fix race condition in incremental hydration test
958fc6a test(platform-server): replace fixed timeout with polling in event replay test
c157916 build: consolidate domino bundling in platform-server
81cabc1 feat(core): add support for TypeScript 6
08ea105 refactor(platform-server): split zone/zoneless tests.
11767ca build: update Jasmine to 6.0.0
30e9c62 fix(core): fix memory leak with event replay
6270bba ci: reformat files
Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 18.2.14 to 21.2.7

Release notes

Sourced from @angular-devkit/build-angular's releases.

21.2.7

@angular/cli

Commit Description

handle missing package manager during analytics initialization

@angular/build

Commit Description

preserve coverage ignore comments in development

show clear error when styleUrl points to a TypeScript file

21.2.6

@angular/cli

Commit Description

fix sourceRoot resolution for MCP projects tool

@angular/build

Commit Description

ensure transitive SCSS partial errors are tracked in watch mode

ensure Vitest mock patching is executed only once

preserve error stack traces during prerendering

scope CHROME_BIN executable path to individual playwright instances

21.2.5

@angular/cli

Commit Description

support custom port in MCP devserver start tool

@angular/ssr

Commit Description

allow underscores in host validation

patch Headers.forEach in cloneRequestAndPatchHeaders

21.2.4

@angular/cli

Commit Description

restore console methods after logger completes

@angular/build

Commit Description

deduplicate and merge coverage excludes with vitest

prevent reporter duplicates by explicitly overriding Vitest configuration

remove default for unit-test coverage option

warn about performance of test.exclude in vitest configuration

warn when vitest watch config conflicts with builder

@angular/ssr

| Commit | Description |

... (truncated)

Changelog

Sourced from @angular-devkit/build-angular's changelog.

21.2.7 (2026-04-08)

@angular/cli

Commit Type Description

971041aa1 fix handle missing package manager during analytics initialization

@angular/build

Commit Type Description

365cce81d fix preserve coverage ignore comments in development

9f74660c3 fix show clear error when styleUrl points to a TypeScript file

20.3.23 (2026-04-08)

@angular/build

Commit Type Description

ccab02ba0 fix update vite to 7.3.2

19.2.24 (2026-04-08)

@angular/build

Commit Type Description

f4595d599 fix update vite to 6.4.2

22.0.0-next.4 (2026-04-01)

@angular/cli

Commit Type Description

87d99e98b feat support custom port in MCP devserver start tool

... (truncated)

Commits

22a108e release: cut the v21.2.7 release
9f74660 fix(@angular/build): show clear error when styleUrl points to a TypeScript file
625c5cb build: update cross-repo angular dependencies
44783cc build: lock file maintenance
e15b22d docs: add spam policy and saved reply
dcb36fd build: update dependency vite to v7.3.2
d1605c6 test(@angular/build): verify coverage ignore comments are preserved during co...
365cce8 fix(@angular/build): preserve coverage ignore comments in development
7a27774 build: update github/codeql-action action to v4.35.1
971041a fix(@angular/cli): handle missing package manager during analytics initializa...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Medium Risk
Major-version Angular toolchain updates can introduce build/test/SSR incompatibilities even though changes are limited to dependency/lockfile bumps in packages/angular.

Overview
Updates the Angular package’s dev tooling by bumping @angular/platform-server from 18.0.6 to 21.2.9 and @angular-devkit/build-angular from 18.2.14 to 21.2.7 in packages/angular/package.json.

Regenerates packages/angular/package-lock.json to reflect the new dependency graph/resolved versions for these upgrades.

^{Reviewed by Cursor Bugbot for commit 63d9177. Bugbot is set up for automated code reviews on this repo. Configure here.}

…ild-angular Bumps [@angular/platform-server](https://github.com/angular/angular/tree/HEAD/packages/platform-server) and [@angular-devkit/build-angular](https://github.com/angular/angular-cli). These dependencies needed to be updated together. Updates `@angular/platform-server` from 18.0.6 to 21.2.9 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.9/packages/platform-server) Updates `@angular-devkit/build-angular` from 18.2.14 to 21.2.7 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@18.2.14...v21.2.7) --- updated-dependencies: - dependency-name: "@angular/platform-server" dependency-version: 21.2.9 dependency-type: direct:development - dependency-name: "@angular-devkit/build-angular" dependency-version: 21.2.7 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-04-17T01:22:58Z

⚠️ No Changeset found

Latest commit: 63d9177

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

nx-cloud · 2026-04-17T01:26:18Z

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

_{To disable these notifications, a workspace admin can disable them in workspace settings.}

View your CI Pipeline Execution ↗ for commit 63d9177

Command	Status	Duration	Result
`nx test @e2e/sveltekit`	❌ Failed	3m 22s	View ↗
`nx test @e2e/qwik-city`	✅ Succeeded	7m 48s	View ↗
`nx test @e2e/nextjs-sdk-next-app`	✅ Succeeded	7m 13s	View ↗
`nx test @e2e/angular-17`	✅ Succeeded	6m 52s	View ↗
`nx test @e2e/nuxt`	✅ Succeeded	5m 45s	View ↗
`nx test @e2e/gen1-remix`	✅ Succeeded	5m 9s	View ↗
`nx test @e2e/react-sdk-next-15-app`	✅ Succeeded	5m 23s	View ↗
`nx test @e2e/gen1-next15-app`	✅ Succeeded	4m 48s	View ↗
`Additional runs (38)`	✅ Succeeded	...	View ↗

☁️ Nx Cloud last updated this comment at 2026-04-17 01:40:32 UTC

nx-cloud · 2026-04-17T01:26:18Z

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

_{To disable these notifications, a workspace admin can disable them in workspace settings.}

View your CI Pipeline Execution ↗ for commit 63d9177

Command	Status	Duration	Result
`nx test @e2e/sveltekit`	❌ Failed	3m 22s	View ↗
`nx test @e2e/nuxt`	✅ Succeeded	5m 45s	View ↗
`nx test @e2e/gen1-remix`	✅ Succeeded	5m 9s	View ↗
`nx test @e2e/react-sdk-next-15-app`	✅ Succeeded	5m 23s	View ↗
`nx test @e2e/gen1-next15-app`	✅ Succeeded	4m 48s	View ↗
`nx test @e2e/hydrogen`	✅ Succeeded	5m 9s	View ↗
`nx test @e2e/angular-17-ssr`	✅ Succeeded	5m 13s	View ↗
`nx test @e2e/gen1-react`	✅ Succeeded	4m 45s	View ↗
`Additional runs (35)`	✅ Succeeded	...	View ↗

☁️ Nx Cloud last updated this comment at 2026-04-17 01:31:57 UTC

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps-dev): bump @angular/platform-server and @angular-devkit/build-angular in /packages/angular#4530

chore(deps-dev): bump @angular/platform-server and @angular-devkit/build-angular in /packages/angular#4530
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/packages/angular/multi-66ec1e0894

dependabot Bot commented on behalf of github Apr 17, 2026 •

edited by cursor Bot

Loading

Uh oh!

changeset-bot Bot commented Apr 17, 2026

Uh oh!

nx-cloud Bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

nx-cloud Bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	add CSP nonce support to JsonpClientBackend
	Don't on Passthru outside of reactive context

Commit	Description
	handle missing serialized container hydration data
	remove obsolete iOS cursor pointer hack in event delegation

Commit	Type	Description
540536c386	fix	add CSP nonce support to JsonpClientBackend
63a857b874	fix	Don't on Passthru outside of reactive context

Commit	Type	Description
7f9450219f	feat	Adds warning for prefetch without main defer trigger
ab061a7610	fix	error for type parameter declarations
9218140348	fix	resolve TCB mapping failure for safe property reads with as any

Commit	Type	Description
a0aa8304cd	feat	bootstrap via `ApplicationRef` with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
77f1ca08e4	fix	handle missing serialized container hydration data

Commit	Description
	preserve coverage ignore comments in development
	show clear error when styleUrl points to a TypeScript file

Commit	Description
	ensure transitive SCSS partial errors are tracked in watch mode
	ensure Vitest mock patching is executed only once
	preserve error stack traces during prerendering
	scope CHROME_BIN executable path to individual playwright instances

Commit	Description
	allow underscores in host validation
	patch Headers.forEach in cloneRequestAndPatchHeaders

Commit	Description
	deduplicate and merge coverage excludes with vitest
	prevent reporter duplicates by explicitly overriding Vitest configuration
	remove default for unit-test coverage option
	warn about performance of test.exclude in vitest configuration
	warn when vitest watch config conflicts with builder

Commit	Type	Description
365cce81d	fix	preserve coverage ignore comments in development
9f74660c3	fix	show clear error when styleUrl points to a TypeScript file

Conversation

dependabot Bot commented on behalf of github Apr 17, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

21.2.9

core

http

platform-server

router

21.2.8

compiler

compiler-cli

core

language-service

21.2.7

compiler

compiler-cli

core

21.2.9 (2026-04-15)

core

http

platform-server

router

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

platform-browser

router

compiler

compiler-cli

core

21.2.7

@​angular/cli

@​angular/build

21.2.6

@​angular/cli

@​angular/build

21.2.5

@​angular/cli

@​angular/ssr

21.2.4

@​angular/cli

@​angular/build

@​angular/ssr

21.2.7 (2026-04-08)

@​angular/cli

@​angular/build

20.3.23 (2026-04-08)

@​angular/build

19.2.24 (2026-04-08)

@​angular/build

22.0.0-next.4 (2026-04-01)

@​angular/cli

Uh oh!

changeset-bot Bot commented Apr 17, 2026

⚠️ No Changeset found

Uh oh!

nx-cloud Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Nx Cloud AI Fix Eligible

Uh oh!

nx-cloud Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Nx Cloud AI Fix Eligible

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 17, 2026 •

edited by cursor Bot

Loading

`@angular/cli`

`@angular/build`

`@angular/cli`

`@angular/build`

`@angular/cli`

`@angular/ssr`

`@angular/cli`

`@angular/build`

`@angular/ssr`

`@angular/cli`

`@angular/build`

`@angular/build`

`@angular/build`

`@angular/cli`

nx-cloud Bot commented Apr 17, 2026 •

edited

Loading

nx-cloud Bot commented Apr 17, 2026 •

edited

Loading