build(deps): bump the npm_and_yarn group across 50 directories with 12 updates

[dependabot]

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package	From	To
webpack	5.94.0	5.104.1
axios	1.13.4	1.13.5
fastify	4.28.1	5.7.3
ajv	8.17.1	8.18.0
bn.js	4.12.0	4.12.3
undici	7.8.0	7.18.2
qs	6.13.0	6.14.2
@angular/compiler	17.3.11	19.2.18
markdown-it	14.1.0	14.1.1
axios	1.13.4	1.13.5

Bumps the npm_and_yarn group with 1 update in the /examples/cactus-common-example-server directory: lodash.
Bumps the npm_and_yarn group with 1 update in the /examples/cactus-example-carbon-accounting-backend directory: qs.
Bumps the npm_and_yarn group with 1 update in the /examples/cactus-example-carbon-accounting-business-logic-plugin directory: axios.
Bumps the npm_and_yarn group with 2 updates in the /examples/cactus-example-cbdc-bridging-backend directory: webpack and axios.
Bumps the npm_and_yarn group with 2 updates in the /examples/cactus-example-cbdc-bridging-backend/src/main/typescript/infrastructure/fabric-contracts/satp-contract/chaincode-typescript directory: ajv and diff.
Bumps the npm_and_yarn group with 2 updates in the /examples/cactus-example-cbdc-bridging-frontend directory: webpack and axios.
Bumps the npm_and_yarn group with 1 update in the /examples/cactus-example-discounted-asset-trade directory: axios.
Bumps the npm_and_yarn group with 1 update in the /examples/cactus-example-discounted-asset-trade-client directory: axios.
Bumps the npm_and_yarn group with 1 update in the /examples/cactus-example-supply-chain-backend directory: axios.
Bumps the npm_and_yarn group with 1 update in the /examples/cactus-example-supply-chain-business-logic-plugin directory: axios.
Bumps the npm_and_yarn group with 1 update in the /examples/cactus-example-supply-chain-frontend directory: @angular/compiler.
Bumps the npm_and_yarn group with 1 update in the /extensions/cactus-plugin-htlc-coordinator-besu directory: axios.
Bumps the npm_and_yarn group with 1 update in the /extensions/cactus-plugin-object-store-ipfs directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cacti-ledger-browser directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cacti-plugin-consortium-static directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cacti-plugin-ledger-connector-stellar directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-api-client directory: lodash.
Bumps the npm_and_yarn group with 2 updates in the /packages/cactus-cmd-api-server directory: axios and fastify.
Bumps the npm_and_yarn group with 2 updates in the /packages/cactus-core-api directory: axios and ajv.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-bungee-hermes directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-consortium-manual directory: axios.
Bumps the npm_and_yarn group with 2 updates in the /packages/cactus-plugin-htlc-eth-besu directory: axios and bn.js.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-htlc-eth-besu-erc20 directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-keychain-aws-sm directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-keychain-azure-kv directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-keychain-google-sm directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-keychain-memory directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-keychain-memory-wasm directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-keychain-vault directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-ledger-connector-aries directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-ledger-connector-besu directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-ledger-connector-cdl directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-ledger-connector-corda directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-ledger-connector-ethereum directory: axios.
Bumps the npm_and_yarn group with 3 updates in the /packages/cactus-plugin-ledger-connector-fabric directory: lodash, axios and bn.js.
Bumps the npm_and_yarn group with 2 updates in the /packages/cactus-plugin-ledger-connector-iroha2 directory: axios and undici.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-ledger-connector-polkadot directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-ledger-connector-sawtooth directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-ledger-connector-xdai directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-persistence-ethereum directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-plugin-persistence-fabric directory: axios.
Bumps the npm_and_yarn group with 2 updates in the /packages/cactus-plugin-satp-hermes directory: axios and bn.js.
Bumps the npm_and_yarn group with 2 updates in the /packages/cactus-plugin-satp-hermes/src/test/typescript/fabric/contracts/satp-contract/chaincode-typescript directory: ajv and diff.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-test-plugin-consortium-manual directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-test-plugin-htlc-eth-besu directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-test-plugin-htlc-eth-besu-erc20 directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-test-plugin-ledger-connector-besu directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/cactus-test-plugin-ledger-connector-ethereum directory: lodash.
Bumps the npm_and_yarn group with 2 updates in the /packages/cactus-test-tooling directory: lodash and axios.

Updates webpack from 5.94.0 to 5.104.1

Release notes

Sourced from webpack's releases.

v5.104.1

5.104.1

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

5.104.0

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
• aab1da9: Fixed bugs for css/global type.
• d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
• d3dd841: Handle nested __webpack_require__.
• 728ddb7: The speed of identifier parsing has been improved.
• 0f8b31b: Improve types.
• d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
• 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
• d3dd841: Serialize HookWebpackError.
• d3dd841: Added ability to use built-in properties in dotenv and define plugin.
• 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
• d3dd841: Reduce collision for local indent name in CSS.
• d3dd841: Remove CSS link tags when CSS imports are removed.

v5.103.0

Features

• Added DotenvPlugin and top level dotenv option to enable this plugin
• Added WebpackManifestPlugin
• Added support the ignoreList option in devtool plugins
• Allow to use custom javascript parse function

... (truncated)

Changelog

Sourced from webpack's changelog.

5.104.1

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

5.104.0

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
• aab1da9: Fixed bugs for css/global type.
• d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
• d3dd841: Handle nested __webpack_require__.
• 728ddb7: The speed of identifier parsing has been improved.
• 0f8b31b: Improve types.
• d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
• 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
• d3dd841: Serialize HookWebpackError.
• d3dd841: Added ability to use built-in properties in dotenv and define plugin.
• 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
• d3dd841: Reduce collision for local indent name in CSS.
• d3dd841: Remove CSS link tags when CSS imports are removed.

Commits

• 24e3c2d chore(release): new release (#20253)
• 2efd21b fix(re-exports): reexports runtime calculation should not accessing `__WEBPAC...
• c510070 fix(security): userinfo bypass vulnerability in HttpUriPlugin allowedUris
• 4b0501c ci: fix release (#20252)
• 0c213ce ci: use \<@&1450591255485743204> over @here for discord notificationw
• 5bf8bc5 refactor: types for benchmarks and tests
• 505a5e7 chore(release): new release (#20188)
• 0c06680 refactor: update eslint configuration
• 2eb0d6a ci: release announcement (#20238)
• b2b2459 ci: cancel in progress (#20239)
• Additional commits viewable in compare view

Updates axios from 1.13.4 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

• Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
• Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

• Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

• Fix/5657. (PR #7313)
• Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

• Add input validation to isAbsoluteURL. (PR #7326)
• Refactor: bump minor package versions. (PR #7356)

Documentation

• Clarify object-check comment. (PR #7323)
• Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

• Chore: fix issues with YAML. (PR #7355)
• CI: update workflow YAMLs. (PR #7372)
• CI: fix run condition. (PR #7373)
• Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
• Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

• @​sachin11063 (first contribution — PR #7323)
• @​asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

Commits

• 29f7542 chore(release): prepare release 1.13.5 (#7379)
• 431c3a3 ci: fix run condition (#7373)
• 9ff3a78 ci: update ymls (#7372)
• 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
• 475e75a feat: add input validation to isAbsoluteURL (#7326)
• 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
• 04cf019 docs: clarify object check comment (#7323)
• 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
• 569f028 fix: added a option to choose between legacy and the new request/response int...
• 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
• Additional commits viewable in compare view

Updates fastify from 4.28.1 to 5.7.3

Release notes

Sourced from fastify's releases.

v5.7.3

⚠️ Security Release

• Fix GHSA-mrq3-vjjr-p77c CVE-2026-25224.

What's Changed

• docs: update Reply.send() documentation for string serialization by @​mcollina in fastify/fastify#6466
• chore: ignore agents config files by @​mcollina in fastify/fastify#6474
• docs: update vulnerability reporting to use GitHub Security by @​mcollina in fastify/fastify#6475

Full Changelog: fastify/fastify@v5.7.2...v5.7.3

v5.7.2

⚠️ Notice ⚠️

Parsing of the content-type header has been improved to a strict parser in PR #6414. This means only header values in the form described in RFC 9110 are accepted.

What's Changed

• chore: npm ignore AI related files by @​climba03003 in fastify/fastify#6447
• chore: update sponsor url by @​Eomm in fastify/fastify#6450
• docs: add fastify-http-exceptions to Ecosystem.md by @​bhouston in fastify/fastify#6442
• docs: fix invalid shorten form schema example by @​climba03003 in fastify/fastify#6448
• docs: Simplify and tighten decorators example by @​smith558 in fastify/fastify#6451
• docs: Fix incorrect variable use by @​smith558 in fastify/fastify#6455
• chore: update sponsor link by @​Eomm in fastify/fastify#6460
• fix: Fix MIT Licence file to conform to standard by @​smith558 in fastify/fastify#6464
• docs: move querystringParser option under routerOptions by @​inyourtime in fastify/fastify#6463
• chore: Updated content-type header parsing by @​jsumners in fastify/fastify#6414

New Contributors

• @​bhouston made their first contribution in fastify/fastify#6442

Full Changelog: fastify/fastify@v5.7.1...v5.7.2

v5.7.1

What's Changed

• chore: Bump actions/checkout from 5 to 6 by @​dependabot[bot] in fastify/fastify#6434
• chore: updated version in the fastify.js by @​Tony133 in fastify/fastify#6446

Full Changelog: fastify/fastify@v5.7.0...v5.7.1

v5.7.0

What's Changed

• docs: Improved firebase serverless guide about process remaining stuck by @​alexandercerutti in fastify/fastify#6380
• docs: update migration guide with date-time breaking change by @​craftsman01 in fastify/fastify#6110
• chore: remove test file by @​Eomm in fastify/fastify#6384
• feat: speed up loading with custom compiler by @​Eomm in fastify/fastify#6383
• docs: replace all instances of twitter.com with x.com by @​cseas in fastify/fastify#6355

... (truncated)

Commits

• 49468ed Bumped v5.7.3
• eb11156 Merge commit from fork
• d98ce2a docs: update vulnerability reporting to use GitHub Security (#6475)
• 17172c4 Ignore agents config files (#6474)
• b48826f docs: update Reply.send() documentation for string serialization (#6466)
• e1e4fe7 v5.7.2
• 32d7b6a chore: Updated content-type header parsing (#6414)
• f4a6ac1 docs: move querystringParser example under routerOptions (#6463)
• 2af83d6 fix: Fix MIT Licence file to conform to standard (#6464)
• 5c14e05 chore: update sponsor link (#6460)
• Additional commits viewable in compare view

Updates ajv from 8.17.1 to 8.18.0

Release notes

Sourced from ajv's releases.

v8.18.0

What's Changed

• feat: allow tree-shaking by adding "sideEffects": false to package.json by @​josdejong in ajv-validator/ajv#2480
• fix: #2482 Infinity and NaN serialise to null by @​jasoniangreen in ajv-validator/ajv#2487
• fix: small grammatical error in managing-schemas.md by @​monteiro-renato in ajv-validator/ajv#2508
• fix: typos in schema-language.md by @​monteiro-renato in ajv-validator/ajv#2507
• fix(pattern): use configured RegExp engine with $data keyword to mitigate ReDoS attacks (CVE-2025-69873) by @​epoberezkin in ajv-validator/ajv#2586

New Contributors

• @​josdejong made their first contribution in ajv-validator/ajv#2480
• @​monteiro-renato made their first contribution in ajv-validator/ajv#2508

Full Changelog: ajv-validator/ajv@v8.17.1...v8.18.0

Commits

• 142ce84 8.18.0
• 720a23f fix(pattern): use configured RegExp engine with $data keyword to mitigate ReD...
• 82735a1 fix: typos in schema-language.md (#2507)
• b17ec32 fix: small grammatical error in managing-schemas.md (#2508)
• 69568d0 fix: #2482 Infinity and NaN serialise to null (#2487)
• f06766f feat: allow tree-shaking by adding ``"sideEffects": falsetopackage.json` ...
• See full diff in compare view

Updates bn.js from 4.12.0 to 4.12.3

Commits

• 39fe438 4.12.3
• 67ecb35 backport(4.x): fix imaskn state (#317)
• c4098ba 4.12.2
• 6277fd7 backport(4.x): Fix imuln/muln with zero (backport of #313) (#314)
• ac0d4af 4.12.1
• a5f14b4 Fix serious issue in .toString(16) (#309)
• 0cd2661 Remove package-lock.json added by npm
• See full diff in compare view

Updates undici from 7.8.0 to 7.18.2

Release notes

Sourced from undici's releases.

v7.18.2

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

• fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @​mcollina in nodejs/undici#4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

What's Changed

• Test and Fix running without SSL by @​mcollina in nodejs/undici#4727
• docs: add security warning for strictContentLength option by @​mcollina in nodejs/undici#4726
• build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @​dependabot[bot] in nodejs/undici#4718
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @​dependabot[bot] in nodejs/undici#4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

What's Changed

• chore: extract infra and encoding methods by @​Uzlopak in nodejs/undici#4523
• ci: remove h2 by @​Uzlopak in nodejs/undici#4534
• ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @​Uzlopak in nodejs/undici#4535
• ci: fix nightly shared library case by @​Uzlopak in nodejs/undici#4543
• test: consume bodies of fetch responses to fix failing macos 20 ci by @​Uzlopak in nodejs/undici#4528
• docs: add Cache Interceptor example to README by @​tawseefnabi in nodejs/undici#4393
• test: remove node20 version check by @​Uzlopak in nodejs/undici#4544
• types: use MessagePort instance type in MessageEvent by @​Renegade334 in nodejs/undici#4546
• ci: set write permissions on job level by @​Uzlopak in nodejs/undici#4537
• lint: activate n/no-process-exit by @​Uzlopak in nodejs/undici#4548
• ci: run benchmarks on pull_requests and by pushing on specific branches only by @​Uzlopak in nodejs/undici#4536
• chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @​Uzlopak in nodejs/undici#4547
• feat(H2): correct CONNECT behaviour by @​metcoder95 in nodejs/undici#4541
• test: fix plans by @​Uzlopak in nodejs/undici#4550
• feat: add runtime feature "detection" by @​Uzlopak in nodejs/undici#4545
• perf: use less promises in extractBody by @​Uzlopak in nodejs/undici#4458
• fix(proxy-agent): add missing return after callback-call by @​Uzlopak in nodejs/undici#4553
• fix: remove redundant line in retry-handler by @​Uzlopak in nodejs/undici#4554
• ci: add no-wasm-simd option by @​Uzlopak in nodejs/undici#4533
• fix: use lazyloaders for runtime feature detection by @​Uzlopak in nodejs/undici#4557
• fix: minor changes in dispatcher-base.js and types for Dispatcher by @​Uzlopak in nodejs/undici#4556

... (truncated)

Commits

• 7e5cb2d Bumped v7.18.2 (#4730)
• b04e3cb fix(decompress): limit Content-Encoding chain to 5 to prevent resource exhaus...
• 2bcb77b Bumped v7.18.1 (#4728)
• 58a12b7 build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4719)
• 5fa2930 build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 (#4718)
• fbbe283 docs: add security warning for strictContentLength option (#4726)
• ce12d9e fix: do not crash if Node.js is compiled without SSL (#4727)
• ebe3e33 Bumped v7.18.0 (#4725)
• 4e9b88b fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
• d560767 Bumped v7.17.0 (#4724)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Updates qs from 6.13.0 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

• [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
• [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
• [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
• [Fix] parse: enforce arrayLimit on comma-parsed values
• [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
• [Robustness] avoid .push, use void
• [readme] document that addQueryPrefix does not add ? to empty output (#418)
• [readme] clarify parseArrays and arrayLimit documentation (#543)
• [readme] replace runkit CI badge with shields.io check-runs badge
• [meta] fix changelog typo (arrayLength → arrayLimit)
• [actions] fix rebase workflow permissions

6.14.1

• [Fix] ensure arrayLimit applies to [] notation as well
• [Fix] parse: when a custom decoder returns null for a key, ignore that key
• [Refactor] parse: extract key segment splitting helper
• [meta] add threat model
• [actions] add workflow permissions
• [Tests] stringify: increase coverage
• [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

6.14.0

• [New] parse: add throwOnParameterLimitExceeded option (#517)
• [Refactor] parse: use utils.combine more
• [patch] parse: add explicit throwOnLimitExceeded default
• [actions] use shared action; re-add finishers
• [meta] Fix changelog formatting bug
• [Deps] update side-channel
• [Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols
• [Tests] increase coverage

6.13.3

[Fix] fix regressions from robustness refactor [actions] update reusable workflows

6.13.2

• [Robustness] avoid .push, use void
• [readme] clarify parseArrays and arrayLimit documentation (#543)
• [readme] document that addQueryPrefix does not add ? to empty output (#418)
• [readme] replace runkit CI badge with shields.io check-runs badge
• [actions] fix rebase workflow permissions

6.13.1

• [Fix] stringify: avoid a crash when a filter key is null
• [Fix] utils.merge: functions should not be stringified into keys
• [Fix] parse: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset
• [Fix] stringify: ensure a non-string filter does not crash
• [Refactor] use __proto__ syntax instead of Object.create for null objects
• [Refactor] misc cleanup

... (truncated)

Commits

• bdcf0c7 v6.14.2
• 294db90 [readme] document that addQueryPrefix does not add ? to empty output
• 5c308e5 [readme] clarify parseArrays and arrayLimit documentation
• 6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
• cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
• febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
• f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
• fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
• 1b9a8b4 [actions] fix rebase workflow permissions
• 2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
• Additional commits viewable in compare view

Updates @angular/compiler from 17.3.11 to 19.2.18

Release notes

Sourced from @​angular/compiler's releases.

19.2.18

core

Commit	Description
	sanitize sensitive attributes on SVG script elements

19.2.17

compiler

Commit	Description
	prevent XSS via SVG animation attributeName and MathML/SVG URLs

19.2.16

http

Commit	Description
	prevent XSRF token leakage to protocol-relative URLs

19.2.15

core

Commit	Description
	introduce BootstrapContext for improved server bootstrapping (#63639)

Breaking Changes

core

• The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

  Before:

  const bootstrap = () => bootstrapApplication(AppComponent, config);

  After:

  const bootstrap = (context: BootstrapContext) =>
    bootstrapApplication(AppComponent, config, context);

  A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

  In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

For more information please see: GHSA-68x2-mx4q-78m7

18.2.14

core

Commit	Description
	introduce BootstrapContext for improved server bootstrapping (#63640)

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

19.2.18 (2026-01-07)

core

Commit	Type	Description
26cdc53d9c	fix	sanitize sensitive attributes on SVG script elements

21.0.7 (2026-01-07)

compiler

Commit	Type	Description
8e808740c9	fix	better types for a few expression AST nodes
63b1cdcf70	fix	produce accurate span for typeof and void expressions
3c3ae0cb64	fix	provide location information for literal map keys
523dbaf1c3	fix	stop ThisReceiver inheritance from ImplicitReceiver

compiler-cli

Commit	Type	Description
4d9c4567ed	fix	ensure component import diagnostics are reported within the imports expression
cd405685af	fix	fix up spelling of diagnostic
778460fcca	fix	support qualified names in typeof type references

core

Commit	Type	Description
7c74674eb0	fix	avoid leaking view data in animations
0edbee4550	fix	explicitly cast signal node value to String
f9c29572d2	fix	sanitize sensitive attributes on SVG script elements

forms

Commit	Type	Description
e3fba182f9	feat	add [formField] directive
561772b152	fix	allow custom controls to require dirty input
f0fb1d8581	fix	allow custom controls to require hidden input
ec110f170b	fix	allow custom controls to require pending input
ae1dc16bb0	fix	clean up abort listener after timeout
9748b0d5da	fix	support custom controls with non signal-based models
6bd22df987	fix	Support readonly arrays in signal forms

router

Commit	Type	Description
41cd4a6af8	fix	Fix RouterLink href not updating with queryParamsHandling
5e9e09aee0	fix	handle errors from view transition updateCallbackDone promise

21.0.6 (2025-12-17)

Breaking Changes (affecting only experimental features)

... (truncated)

Commits

• 26cdc53 fix(core): sanitize sensitive attributes on SVG script elements
• 7c42e2e fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
• 24bab55 fix(compiler): lexer support for template literals in object literals (#61601)
• fc2483e refactor(compiler): avoid duplication between FactoryTarget type (#61571)
• 8e54b57 build: move private testing helpers outside platform-browser/testing (#61571)
• 44bb328 fix(compiler): avoid conflicts between HMR code and local symbols (#61550)
• 1007079 build: update compiler-cli to not be stamped when used for the compiler in ng...
• 0d025c5 build: support new ng_project rule (#61336)
• 899cb4a refactor: add explicit types for exports relying on inferred call return type...
• 1312eb1 build: remove irrelevant madge circular deps tests (#61209)
• Additional commits viewable in compare view

Updates markdown-it from 14.1.0 to 14.1.1

ChangelogDescription has been truncated