langchain-ai/langgraphjs
1
0
Fork 0
mirror of https://github.com/langchain-ai/langgraphjs.git synced 2026-07-22 17:15:25 -04:00
Code Issues 108 Packages Projects Releases 20 Wiki Activity
2,856 Commits 162 Branches 537 Tags
@langchain/angular@1.0.3
Commit Graph

93 Commits

Author SHA1 Message Date
dependabot[bot] 428c4e3f29 chore(deps): bump ws from 8.19.0 to 8.20.1 (#2413) 
Bumps [ws](https://github.com/websockets/ws) from 8.19.0 to 8.20.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases">ws's
releases</a>.</em></p>
<blockquote>
<h2>8.20.1</h2>
<h1>Bug fixes</h1>
<ul>
<li>Fixed an uninitialized memory disclosure issue in
<code>websocket.close()</code>
(c0327ec1).</li>
</ul>
<p>Providing a <code>TypedArray</code> (e.g. <code>Float32Array</code>)
as the <code>reason</code> argument for
<code>websocket.close()</code>, rather than the supported string or
<code>Buffer</code> types, caused
uninitialized memory to be disclosed to the remote peer.</p>
<pre lang="js"><code>import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
<p>const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(<code>ws://localhost:${port}</code>, {
skipUTF8Validation: true
});</p>
<pre><code>ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});
</code></pre>
<p>}
);</p>
<p>wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});
</code></pre></p>
<p>The issue was privately reported by <a
href="https://github.com/ChALkeR">Nikita Skovoroda</a>.</p>
<h2>8.20.0</h2>
<h1>Features</h1>
<ul>
<li>Added exports for the <code>PerMessageDeflate</code> class and
utilities for the
<code>Sec-WebSocket-Extensions</code> and
<code>Sec-WebSocket-Protocol</code> headers (d3503c1f).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a>
[dist] 8.20.1</li>
<li><a
href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a>
[security] Fix uninitialized memory disclosure in
<code>websocket.close()</code></li>
<li><a
href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a>
[ci] Test on node 26</li>
<li><a
href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a>
[ci] Do not test on node 25</li>
<li><a
href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a>
[ci] Run the lint step on node 24</li>
<li><a
href="https://github.com/websockets/ws/commit/843925544e2f4cffe445e0179947f56d6c5b608f"><code>8439255</code></a>
[dist] 8.20.0</li>
<li><a
href="https://github.com/websockets/ws/commit/d3503c1fd36a310985108f62b343bae18346ab67"><code>d3503c1</code></a>
[minor] Export the <code>PerMessageDeflate</code> class and header
utils</li>
<li><a
href="https://github.com/websockets/ws/commit/3ee5349a0b1580f6e1f347b59ec3371011bd8481"><code>3ee5349</code></a>
[api] Convert the <code>isServer</code> and <code>maxPayload</code>
parameters to options</li>
<li><a
href="https://github.com/websockets/ws/commit/91707b470ebd803aaa3fd1e896217740f39267d4"><code>91707b4</code></a>
[doc] Add missing space</li>
<li><a
href="https://github.com/websockets/ws/commit/8b553192268810a83253e2a4a39ac16768e75bb3"><code>8b55319</code></a>
[pkg] Update eslint to version 10.0.1</li>
<li>Additional commits viewable in <a
href="https://github.com/websockets/ws/compare/8.19.0...8.20.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ws&package-manager=npm_and_yarn&previous-version=8.19.0&new-version=8.20.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-18 14:45:30 -07:00
dependabot[bot] 57a72458df chore(deps): bump axios from 1.15.1 to 1.16.1 (#2410) 
Bumps [axios](https://github.com/axios/axios) from 1.15.1 to 1.16.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.16.1 — May 13, 2026</h2>
<p>This release ships a defence-in-depth fix for prototype pollution in
<code>formDataToJSON</code>, hardens proxy and CI workflows, restores
Webpack 4 compatibility for the fetch adapter, and includes several
small bug fixes and maintenance improvements.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Prototype Pollution Defence-in-Depth:</strong> Hardened
<code>formDataToJSON</code> against already-polluted
<code>Object.prototype</code> by walking own properties only, so
attacker-controlled keys inherited from a poisoned prototype cannot
propagate through deserialization. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7413">#7413</a></strong>)</li>
<li><strong>Proxy Cleartext Leak:</strong> Fixed an issue where HTTPS
request data could be transmitted in cleartext to an HTTP proxy under
certain configurations. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10858">#10858</a></strong>)</li>
<li><strong>CI Cache Removal:</strong> Removed all GitHub Actions caches
as a defence-in-depth measure against cache poisoning vectors in the
build pipeline. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10882">#10882</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Data URI Parsing:</strong> Updated the
<code>fromDataURI</code> regex to match RFC 2397 more strictly, fixing
edge cases in <code>data:</code> URL handling. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10829">#10829</a></strong>)</li>
<li><strong>Unicode Headers:</strong> Preserved Unicode header values
when running through request interceptors, so non-ASCII header content
is no longer corrupted before dispatch. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10850">#10850</a></strong>)</li>
<li><strong>XHR Upload Progress:</strong> Guarded against malformed
<code>ProgressEvent</code> payloads emitted by some environments during
XHR upload, preventing crashes when <code>loaded</code> /
<code>total</code> are missing or invalid. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10868">#10868</a></strong>)</li>
<li><strong>Webpack 4 Fetch Adapter:</strong> Fixed an &quot;unexpected
token&quot; error caused by syntax in the fetch adapter that Webpack 4
could not parse, restoring compatibility for legacy bundler users.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10864">#10864</a></strong>)</li>
<li><strong>Type Definitions:</strong> Made <code>parseReviver</code>
<code>context.source</code> optional in the type definitions to align
with the ES2023 specification. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10837">#10837</a></strong>)</li>
<li><strong>URL Object Support Reverted:</strong> Reverted the change
that allowed passing a <code>URL</code> object as
<code>config.url</code> (originally <strong><a
href="https://redirect.github.com/axios/axios/issues/10866">#10866</a></strong>)
due to regressions; this support will be reintroduced in a later release
once the underlying issues are addressed. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10874">#10874</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>Cycle Detection Refactor:</strong> Replaced the array-based
cycle tracker in <code>toJSONObject</code> with a <code>WeakSet</code>,
improving performance and memory behaviour on large nested structures.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10832">#10832</a></strong>)</li>
<li><strong>composeSignals Cleanup:</strong> Refactored
<code>composeSignals</code> to use a clearer early-return structure,
simplifying the cancellation/abort composition path. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10844">#10844</a></strong>)</li>
<li><strong>AI Readiness &amp; Repo Docs:</strong> Added
<code>AGENTS.md</code> and related contributor-guide updates for both
human and AI agents, plus post-release documentation improvements.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10835">#10835</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10841">#10841</a></strong>)</li>
<li><strong>Docs Improvements:</strong> Clarified the GET request
example, fixed the interceptor <code>eject</code> example to reference
the correct instance, and corrected the Buzzoid sponsor description in
the README. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10836">#10836</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10853">#10853</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10856">#10856</a></strong>)</li>
<li><strong>Sponsorship Tooling:</strong> Fixed empty sponsor arrays in
the sponsor processing script, added the ability to inject additional
sponsors, updated the sponsorship link, and added a Twicsy advertisement
entry. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10843">#10843</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10859">#10859</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10869">#10869</a></strong>)</li>
<li><strong>Dependencies:</strong> Bumped <code>@commitlint/cli</code>
from 20.5.0 to 20.5.2. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10846">#10846</a></strong>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/hpinmetaverse"><code>@​hpinmetaverse</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10836">#10836</a></strong>)</li>
<li><strong><a
href="https://github.com/tommyhgunz14"><code>@​tommyhgunz14</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7413">#7413</a></strong>)</li>
<li><strong><a
href="https://github.com/abhu85"><code>@​abhu85</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10829">#10829</a></strong>)</li>
<li><strong><a
href="https://github.com/divyanshuraj1095"><code>@​divyanshuraj1095</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10853">#10853</a></strong>)</li>
<li><strong><a
href="https://github.com/sagodi97"><code>@​sagodi97</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10856">#10856</a></strong>)</li>
<li><strong><a
href="https://github.com/rkdfx"><code>@​rkdfx</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10868">#10868</a></strong>)</li>
<li><strong><a
href="https://github.com/Liuwei1125"><code>@​Liuwei1125</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10866">#10866</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.16.0...v1.16.1">Full
Changelog</a></p>
<h2>v1.16.0 — May 2, 2026</h2>
<p>This release adds support for the QUERY HTTP method and a new
<code>ECONNREFUSED</code> error constant, lands a substantial wave of
HTTP, fetch, and XHR adapter bug fixes around redirects, aborts,
headers, and timeouts, and welcomes 23 new contributors.</p>
<h2>⚠️ Notable Changes</h2>
<p>A handful of fixes in this release are either security-adjacent or
change observable behaviour. Please review before upgrading:</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v1.16.0 — May 2, 2026</h2>
<p>This release adds support for the QUERY HTTP method and a new
<code>ECONNREFUSED</code> error constant, lands a substantial wave of
HTTP, fetch, and XHR adapter bug fixes around redirects, aborts,
headers, and timeouts, and welcomes 23 new contributors.</p>
<h2>⚠️ Notable Changes</h2>
<p>A handful of fixes in this release are either security-adjacent or
change observable behaviour. Please review before upgrading:</p>
<ul>
<li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and
<code>maxContentLength</code>.</strong> These limits were silently
ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as
a safety net (DoS protection, accidental large uploads) had no
protection. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li>
<li><strong>Proxy requests now preserve user-supplied <code>Host</code>
headers.</strong> Previously, the proxy path could overwrite a custom
<code>Host</code>. Virtual-host-style routing through a proxy will now
behave correctly. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li>
<li><strong>Basic auth credentials embedded in URLs are now
URL-decoded.</strong> If you have percent-encoded credentials in a URL
(e.g. <code>https://user:p%40ss@host</code>), the decoded value is what
now goes on the wire. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong><code>parseProtocol</code> now strictly requires a colon in
the protocol separator.</strong> Strings that loosely parsed as
protocols before may no longer match. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Deprecated <code>unescape()</code> replaced with modern
UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct;
consumers depending on legacy <code>unescape()</code> quirks may see
different output bytes. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong><code>transformRequest</code> input typing change was
reverted.</strong> The typing change introduced in <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
was reverted in <a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a>
after follow-up review — net behavior is unchanged from 1.15.2.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP
method across adapters and type definitions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li>
<li><strong>ECONNREFUSED Error Constant:</strong> Exposed
<code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so
callers can match connection-refused failures without comparing string
literals (closes <a
href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>).
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li>
<li><strong>Encode Helper Export:</strong> Exported the internal
<code>encode</code> helper from <code>buildURL</code> so userland param
serializers can reuse the same encoding logic that axios uses
internally. (<strong><a
href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>HTTP Adapter — Redirects &amp; Headers:</strong> Cleared
stale headers when a redirect targets a no-proxy host, fixed the
redirect listener chain so listeners no longer stack across hops,
restored the missing <code>requestDetails</code> argument on
<code>beforeRedirect</code>, preserved user-supplied <code>Host</code>
headers when forwarding through a proxy, and properly URL-decoded basic
auth credentials. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong>HTTP Adapter — Streams &amp; Timeouts:</strong> Preserved
the partial response object on <code>AxiosError</code> when a stream is
aborted after headers arrive, honoured the <code>timeout</code> option
during the connect phase when redirects are disabled, and resolved an
unsettled-promise hang when an aborted request was combined with
compression and <code>maxRedirects: 0</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li>
<li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code>
/ <code>maxContentLength</code> in the fetch adapter, set the
<code>User-Agent</code> header to match the HTTP adapter, preserved the
original abort reason instead of replacing it with a generic error, and
deferred global access so importing the module no longer throws a
<code>TypeError</code> in restricted environments. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li>
<li><strong>XHR Adapter:</strong> Unsubscribed the
<code>cancelToken</code> and <code>AbortSignal</code> listeners on the
error, timeout, and abort code paths to prevent leaked subscriptions.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
<li><strong>Error Handling:</strong> Attached the parsed response to
<code>AxiosError</code> when <code>JSON.parse</code> fails inside
<code>dispatchRequest</code>, prevented <code>settle</code> from
emitting <code>undefined</code> error codes, and tightened the
<code>parseProtocol</code> regex to require a colon in the protocol
separator. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Types &amp; Exports:</strong> Aligned the CommonJS
<code>CancelToken</code> typings with the ESM build, fixed a compiler
error caused by <code>RawAxiosHeaders</code>, and re-exported
<code>create</code> from the package index. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li>
<li><strong>UTF-8 Encoding:</strong> Replaced the deprecated
<code>unescape()</code> call with a modern UTF-8 encoding
implementation. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong>Misc Cleanup:</strong> Resolved a batch of small
inconsistencies and gadget-level issues across the codebase. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>Refactor — ES6 Modernisation:</strong> Modernised the
<code>utils</code> module and XHR adapter to use ES6 features, and
tidied the multipart boundary error message. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to
fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform
support for the pipe tests, and corrected an incorrect test assumption.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li>
<li><strong>Docs:</strong> Documented
<code>paramsSerializer.encode</code> for strict RFC 3986 query encoding,
updated the <code>parseReviver</code> TypeScript definitions and
configuration docs for ES2023, added timeout guidance to the README's
first async example, and expanded notes around the recent type changes.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li>
<li><strong>Reverted:</strong> Reverted the
<code>transformRequest</code> input typing change from <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
after follow-up review. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
<li><strong>Dependencies:</strong> Bumped
<code>actions/setup-node</code>, the <code>github-actions</code> group,
and <code>postcss</code> (in <code>/docs</code>) to their latest
versions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li>
<li><strong>Release:</strong> Updated changelog and packages, and
prepared the 1.16.0 release. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/singhankit001"><code>@​singhankit001</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li>
<li><strong><a
href="https://github.com/cuiweixie"><code>@​cuiweixie</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong><a
href="https://github.com/iruizsalinas"><code>@​iruizsalinas</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/1337d6b537afb2d3f501074c8ac4ef4308221197"><code>1337d6b</code></a>
chore(release): prepare release 1.16.1 (<a
href="https://redirect.github.com/axios/axios/issues/10877">#10877</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/858a790cec06054547d0d3f941916d6fb2a4d18e"><code>858a790</code></a>
fix: remove all caches (<a
href="https://redirect.github.com/axios/axios/issues/10882">#10882</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/34adfd90efc9c145488399e1cf7fa96de67080fa"><code>34adfd9</code></a>
revert: &quot;fix: support URL object as config.url input (<a
href="https://redirect.github.com/axios/axios/issues/10866">#10866</a>)&quot;
(<a
href="https://redirect.github.com/axios/axios/issues/10874">#10874</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/847d89b43654405d9a231e0b669832c2092b621f"><code>847d89b</code></a>
fix: support URL object as config.url input (<a
href="https://redirect.github.com/axios/axios/issues/10866">#10866</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/40948863677bb793bfff0293cce7e7b4f8a1b212"><code>4094886</code></a>
fix(progress): guard malformed XHR upload events (<a
href="https://redirect.github.com/axios/axios/issues/10868">#10868</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/44f0c5bf73c45df6009365141faa394d73596bd7"><code>44f0c5b</code></a>
chore: change sponsorship link and add Twicsy advertisement (<a
href="https://redirect.github.com/axios/axios/issues/10869">#10869</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/64e1095efedc64c9fecf5176bd9cf2e5e93140d6"><code>64e1095</code></a>
chore: update PR and issue template to use h2 (<a
href="https://redirect.github.com/axios/axios/issues/10865">#10865</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/3e6b4e1f311b43aa1dc77d78150a601d9fe4b280"><code>3e6b4e1</code></a>
fix: error unexpected token in fetch JS compatibility issue with Webpack
4 (#...</li>
<li><a
href="https://github.com/axios/axios/commit/c4453bab70f53575175903aee60810c821f72129"><code>c4453ba</code></a>
fix: add the ability to add additional sponsors to the process sponsors
scrip...</li>
<li><a
href="https://github.com/axios/axios/commit/caa00a90b524bb67ed033474abcf4d8645ced793"><code>caa00a9</code></a>
fix: https data in cleartext to proxy (<a
href="https://redirect.github.com/axios/axios/issues/10858">#10858</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.15.1...v1.16.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axios&package-manager=npm_and_yarn&previous-version=1.15.1&new-version=1.16.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-18 12:56:38 -07:00
dependabot[bot] bd72a897e1 chore(deps): bump postcss from 8.5.8 to 8.5.14 (#2399) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.8 to
8.5.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.14</h2>
<ul>
<li>Fixed custom syntax regression (by <a
href="https://github.com/43081j"><code>@​43081j</code></a>).</li>
</ul>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
<h2>8.5.12</h2>
<ul>
<li>Fixed reading any file via user-generated CSS.</li>
<li>Added <code>opts.unsafeMap</code> to disable checks.</li>
</ul>
<h2>8.5.11</h2>
<ul>
<li>Fixed nested brackets parsing performance (by <a
href="https://github.com/offset"><code>@​offset</code></a>).</li>
</ul>
<h2>8.5.10</h2>
<ul>
<li>Fixed XSS via unescaped <code>&lt;/style&gt;</code> in non-bundler
cases (by <a
href="https://github.com/TharVid"><code>@​TharVid</code></a>).</li>
</ul>
<h2>8.5.9</h2>
<ul>
<li>Speed up source map encoding paring in case of the error.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.14</h2>
<ul>
<li>Fixed custom syntax regression (by <a
href="https://github.com/43081j"><code>@​43081j</code></a>).</li>
</ul>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
<h2>8.5.12</h2>
<ul>
<li>Fixed reading any file via user-generated CSS.</li>
<li>Added <code>opts.unsafeMap</code> to disable checks.</li>
</ul>
<h2>8.5.11</h2>
<ul>
<li>Fixed nested brackets parsing performance (by <a
href="https://github.com/offset"><code>@​offset</code></a>).</li>
</ul>
<h2>8.5.10</h2>
<ul>
<li>Fixed XSS via unescaped <code>&lt;/style&gt;</code> in non-bundler
cases (by <a
href="https://github.com/TharVid"><code>@​TharVid</code></a>).</li>
</ul>
<h2>8.5.9</h2>
<ul>
<li>Speed up source map encoding paring in case of the error.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/3ec13948ae0006e1bde2dfb545346341ac8b2dcf"><code>3ec1394</code></a>
Release 8.5.14 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/f2bb827b20b591080977412555aa3e5baf588620"><code>f2bb827</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/d75953d60854ad835fd21dde0b11081522341020"><code>d75953d</code></a>
Merge pull request <a
href="https://redirect.github.com/postcss/postcss/issues/2084">#2084</a>
from 43081j/raw-raws-rawing</li>
<li><a
href="https://github.com/postcss/postcss/commit/68bd2139b5dcaf5a682bc2e8826d8557be2d1480"><code>68bd213</code></a>
fix: always call <code>raw</code> to retrieve raw values</li>
<li><a
href="https://github.com/postcss/postcss/commit/af58cf1b7af02e9b9fcb138a4a2d7ef3450158b1"><code>af58cf1</code></a>
Release 8.5.13 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/f227dbd0e9443e5f33e18e633b8b4d2b55aac5ee"><code>f227dbd</code></a>
Temporary ignore pnpm 11 config</li>
<li><a
href="https://github.com/postcss/postcss/commit/d3abd40d723cf3559e5ddb5fc738b7cb64e92bb0"><code>d3abd40</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/dd06c3e11362087bc18f9c20cee30fd82bda3de9"><code>dd06c3e</code></a>
Revert stringifier changes because of the conflict with
postcss-scss</li>
<li><a
href="https://github.com/postcss/postcss/commit/ae889c815fb88d785401a88f1a7dfc8cb11915fb"><code>ae889c8</code></a>
Try to fix CI</li>
<li><a
href="https://github.com/postcss/postcss/commit/e0093e49bcf00347383a13e40bb1f67bc823ca15"><code>e0093e4</code></a>
Move to pnpm 11</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.8...8.5.14">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.8&new-version=8.5.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-16 03:30:45 -07:00
dependabot[bot] 14f7cbc517 chore(deps): bump mermaid from 11.13.0 to 11.15.0 (#2402) 
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.13.0 to
11.15.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mermaid-js/mermaid/releases">mermaid's
releases</a>.</em></p>
<blockquote>
<h2>mermaid@11.15.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7174">#7174</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/0aca21739c0d1fcaaa206e04a6cd574ebc415483"><code>0aca217</code></a>
Thanks <a
href="https://github.com/milesspencer35"><code>@​milesspencer35</code></a>!
- feat(sequence): Add support for decimal start and increment values in
the <code>autonumber</code> directive</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7512">#7512</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/8e17492f7365ba50896382feb69a23efd9d8a22d"><code>8e17492</code></a>
Thanks <a
href="https://github.com/aruncveli"><code>@​aruncveli</code></a>! -
feat(flowchart): add datastore shape</p>
<p>In Data flow diagrams, a datastore/warehouse/file/database is used to
represent data persistence. It is denoted by a rectangle with only top
and bottom borders, and can be used in flowcharts with <code>A@{ shape:
datastore, label: &quot;Datastore&quot; }</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/6440">#6440</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/9ad8dde6d049adde85d8ed2d476c09b5820f3f4b"><code>9ad8dde</code></a>
Thanks <a href="https://github.com/yordis"><code>@​yordis</code></a>, <a
href="https://github.com/lgazo"><code>@​lgazo</code></a>! - feat: add
Event Modeling diagram</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7707">#7707</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/27db774627be1cee881961dfd0d2cb21cd01b79d"><code>27db774</code></a>
Thanks <a href="https://github.com/txmxthy"><code>@​txmxthy</code></a>!
- feat(architecture): expose four fcose layout knobs for
<code>architecture-beta</code> diagrams (<code>nodeSeparation</code>,
<code>idealEdgeLengthMultiplier</code>, <code>edgeElasticity</code>,
<code>numIter</code>) so authors can tune layout density and spread
overlapping siblings without changing diagram source</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7604">#7604</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/bf9502fb6012a4b724679b401ac928f5ee55161c"><code>bf9502f</code></a>
Thanks <a href="https://github.com/M-a-c"><code>@​M-a-c</code></a>! -
feat(class): add nested namespace support for class diagrams via dot
notation and syntactic nesting</p>
<p>If you have namespaces in class diagrams that use <code>.</code>s
already and want to render them without nesting (≤v11.14.0 behaviour),
you can use set <code>class.hierarchicalNamespaces=false</code> in your
mermaid config:</p>
<pre lang="yaml"><code>config:
  class:
    hierarchicalNamespaces: false
</code></pre>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7272">#7272</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/88cdd3dc0aab9577174561b04e14760c565a232b"><code>88cdd3d</code></a>
Thanks <a
href="https://github.com/xinbenlv"><code>@​xinbenlv</code></a>! -
feat(sankey): add outlined label style, configurable
nodeWidth/nodePadding, and custom node colors</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f"><code>e9b0f34</code></a>
Thanks <a
href="https://github.com/ashishjain0512"><code>@​ashishjain0512</code></a>!
- fix: prevent unbalanced CSS styles in classDefs</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056"><code>37ff937</code></a>
Thanks <a
href="https://github.com/ashishjain0512"><code>@​ashishjain0512</code></a>!
- fix: create CSS styles using the CSSOM</p>
<p>This removes some invalid CSS and normalizes some CSS formatting.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7508">#7508</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/bfe60cc67b9a6dec64f9161f58e4d24a06c42b65"><code>bfe60cc</code></a>
Thanks <a href="https://github.com/biiab"><code>@​biiab</code></a>! -
fix(stateDiagram): <code>end note</code> now only closes a note when
used on a new line</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e"><code>faafb5d</code></a>
Thanks <a
href="https://github.com/ashishjain0512"><code>@​ashishjain0512</code></a>!
- fix(gantt): add iteration limit for <code>excludes</code> field</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/65f8be2a42faf869b811469571983cba7eeeca99"><code>65f8be2</code></a>
Thanks <a
href="https://github.com/ashishjain0512"><code>@​ashishjain0512</code></a>!
- fix: disallow some CSS at-rules in custom CSS</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7726">#7726</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/1502f32f3c5fb944925b0c527fbbde3c4f041824"><code>1502f32</code></a>
Thanks <a
href="https://github.com/aloisklink"><code>@​aloisklink</code></a>! -
fix(wardley): fix unnecessary sanitization of text</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7578">#7578</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/1f98db8e326299ac97a2fa60abfd509d8f5f16e2"><code>1f98db8</code></a>
Thanks <a
href="https://github.com/Gaston202"><code>@​Gaston202</code></a>! -
fix(class): self-referential class multiplicity labels no longer
rendered multiple times</p>
<p>Fixes <a
href="https://redirect.github.com/mermaid-js/mermaid/issues/7560">#7560</a>.
Resolves an issue where cardinality labels on self-referential class
relationships were rendered three times due to edge splitting in the
dagre layout. The fix ensures that each sub-edge only carries its
relevant label positions.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7592">#7592</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/2343e38498a3b31f8ce5e79f1f009e0b56fbe086"><code>2343e38</code></a>
Thanks <a
href="https://github.com/knsv-bot"><code>@​knsv-bot</code></a>! -
fix(sequence): add background box behind alt/else section title labels
in sequence diagrams</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7589">#7589</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/7fb9509b8b5cb1dc48519dc60cf6cdc6afba0462"><code>7fb9509</code></a>
Thanks <a
href="https://github.com/NYCU-Chung"><code>@​NYCU-Chung</code></a>! -
fix(block): prevent column widths from shrinking when mixing different
column spans</p>
</li>
<li>
<p><a
href="https://redirect.github.com/mermaid-js/mermaid/pull/7632">#7632</a>
<a
href="https://github.com/mermaid-js/mermaid/commit/3f9e0f15bedc1e2c71ddb6b34192d1a21124cfc2"><code>3f9e0f1</code></a>
Thanks <a
href="https://github.com/ekiauhce"><code>@​ekiauhce</code></a>! -
fix(sequence): correct messageAlign label position for right-to-left
arrows in sequence diagrams</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/41646dfd43ac83f001b03c70605feb036afae46d"><code>41646df</code></a>
Merge pull request <a
href="https://redirect.github.com/mermaid-js/mermaid/issues/7739">#7739</a>
from aloisklink/ci/fix-release</li>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/2671f5c44a1515960ebc41c09a365c41860f95ee"><code>2671f5c</code></a>
docs: fix v11.15.0 release</li>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/f4bf04b5db8bed603e40ed3d5ce5228d6b07754e"><code>f4bf04b</code></a>
Merge pull request <a
href="https://redirect.github.com/mermaid-js/mermaid/issues/7738">#7738</a>
from mermaid-js/changeset-release/master</li>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/abfb563e1dcbd46d617f44a6361bd6d926dc6289"><code>abfb563</code></a>
Version Packages</li>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/60b289f428d0a0832ad95ed4e1fb326344e23532"><code>60b289f</code></a>
Release Candidate 11.15.0 (<a
href="https://redirect.github.com/mermaid-js/mermaid/issues/7737">#7737</a>)</li>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/d37c0db39ca2405b4473361063df2c47109dc2c9"><code>d37c0db</code></a>
Merge pull request <a
href="https://redirect.github.com/mermaid-js/mermaid/issues/7730">#7730</a>
from aloisklink/fix/fix-edgeLabelRightLeft-changes</li>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/5ab5a2895fa8b7e90de85b43a4b99aa50b39b0f1"><code>5ab5a28</code></a>
docs: improve nested namespace changeset</li>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/18f8b4c5bf67aface3485272b48042f2fdd6fad2"><code>18f8b4c</code></a>
fix: revert endEdgeLabelLeft/endEdgeLabelRight change</li>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/504b2eb73d4d827baa817efd47ab6f44ae769b5a"><code>504b2eb</code></a>
Merge pull request <a
href="https://redirect.github.com/mermaid-js/mermaid/issues/7726">#7726</a>
from aloisklink/fix/correct-unnecessary-html-escapes...</li>
<li><a
href="https://github.com/mermaid-js/mermaid/commit/1502f32f3c5fb944925b0c527fbbde3c4f041824"><code>1502f32</code></a>
fix(wardley): fix unnecessary sanitization of text</li>
<li>Additional commits viewable in <a
href="https://github.com/mermaid-js/mermaid/compare/mermaid@11.13.0...mermaid@11.15.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mermaid&package-manager=npm_and_yarn&previous-version=11.13.0&new-version=11.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-16 03:30:28 -07:00
dependabot[bot] ed630b8ce5 chore(deps): bump @protobufjs/utf8 from 1.1.0 to 1.1.1 (#2401) 
Bumps [@protobufjs/utf8](https://github.com/dcodeIO/protobuf.js) from
1.1.0 to 1.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dcodeIO/protobuf.js/releases">@​protobufjs/utf8's
releases</a>.</em></p>
<blockquote>
<h2>protobufjs-cli: v1.1.1</h2>
<h2><a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1">1.1.1</a>
(2023-02-02)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>cli:</strong> fix relative path to Google pb files (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/1859">#1859</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/e42eea4868b11f4a07934804a56683321ed191e2">e42eea4</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/644d588c0495da6a570344248e1b5af901bc3b0c"><code>644d588</code></a>
chore: release master (<a
href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1865">#1865</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/e42eea4868b11f4a07934804a56683321ed191e2"><code>e42eea4</code></a>
fix(cli): fix relative path to Google pb files (<a
href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1859">#1859</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/dce9a2ef92d363752e40b295b0da9bd178f82e83"><code>dce9a2e</code></a>
fix: use bundled filename to fix common pb includes (<a
href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1860">#1860</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/64e8936ad9f73c68b3fa1e57857dd38323b5a745"><code>64e8936</code></a>
fix: use ES5 style function syntax (<a
href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1830">#1830</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/4489fa771464bcb49b57149760e9cc4131e8077e"><code>4489fa7</code></a>
Revert &quot;fix: error should be thrown (<a
href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1817">#1817</a>)&quot;
(<a
href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1864">#1864</a>)</li>
<li>See full diff in <a
href="https://github.com/dcodeIO/protobuf.js/compare/protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@protobufjs/utf8&package-manager=npm_and_yarn&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-16 03:30:12 -07:00
dependabot[bot] 4ea95d7f70 chore(deps): bump fast-xml-builder from 1.1.4 to 1.2.0 (#2404) 
Bumps
[fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder)
from 1.1.4 to 1.2.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md">fast-xml-builder's
changelog</a>.</em></p>
<blockquote>
<p><strong>1.2.0</strong> (2026-05-08)</p>
<ul>
<li>Add support for <code>sanitizeName</code> option</li>
<li>Support xml-naming for validating and sanitizing tag and attribute
names</li>
</ul>
<p><strong>1.1.9</strong> (2026-05-06)</p>
<ul>
<li>fix: format output for preserve order when indent by is set to empty
string</li>
</ul>
<p><strong>1.1.8</strong> (2026-05-05)</p>
<ul>
<li>fix: skip text property for PI tags</li>
<li>improve typings</li>
</ul>
<p><strong>1.1.7</strong> (2026--05-04)</p>
<ul>
<li>fix security issues when attribute value contains quotes</li>
</ul>
<p><strong>1.1.6</strong> (2026--05-04)</p>
<ul>
<li>fix security issues related to comment</li>
<li>skip comment with null value</li>
</ul>
<p><strong>1.1.5</strong> (2026-04-17)</p>
<ul>
<li>fix security issues related to comment and cdata</li>
</ul>
<p><strong>1.1.4</strong> (2026-03-16)</p>
<ul>
<li>support maxNestedTags option</li>
</ul>
<p><strong>1.1.3</strong> (2026-03-13)</p>
<ul>
<li>declare Matcher &amp; Expression as unknown so user is not forced to
install path-expression-matcher</li>
</ul>
<p><strong>1.1.2</strong> (2026-03-11)</p>
<ul>
<li>fix typings</li>
</ul>
<p><strong>1.1.1</strong> (2026-03-11)</p>
<ul>
<li>upgrade path-expression-matcher to 1.1.3</li>
</ul>
<p><strong>1.1.0</strong> (2026-03-10)</p>
<ul>
<li>Integrate <a
href="https://github.com/NaturalIntelligence/path-expression-matcher">path-expression-matcher</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/a9a905b316176ef9a97bdf5450e60efbf0341f25"><code>a9a905b</code></a>
for release</li>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/42680e8d730c48082268823fd285e10127ddba21"><code>42680e8</code></a>
support name sanitization</li>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/8b00185bf6be67981ffc40e06c18acbbbe908779"><code>8b00185</code></a>
release info</li>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/8a08f173d7b9c9a82599fe7de279ca7e12c3ad6b"><code>8a08f17</code></a>
allow indentation to be empty string</li>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/7fc5decb9613afbd5d03747b1a0f11e0916e34ef"><code>7fc5dec</code></a>
update docs</li>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/c241b6a8ed1863e5f518490ec1fcc38b13f2c370"><code>c241b6a</code></a>
improve documentation</li>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/15d5668b53777400c8d80b6e21029c1a70888c78"><code>15d5668</code></a>
update for release</li>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/98774853a696a1aee4dca830dd3eee2759676bd2"><code>9877485</code></a>
fix: skip text property for PI tags</li>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/311a2213a817cf31558bea7c0e0807b0d4441814"><code>311a221</code></a>
fix <a
href="https://redirect.github.com/NaturalIntelligence/fast-xml-builder/issues/5">#5</a>
typing import issues</li>
<li><a
href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/e8fc5b15d9d54b559781961f066de82a55aabcdd"><code>e8fc5b1</code></a>
update for releast</li>
<li>Additional commits viewable in <a
href="https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.4...v1.2.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-xml-builder&package-manager=npm_and_yarn&previous-version=1.1.4&new-version=1.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-16 03:29:40 -07:00
dependabot[bot] 6ddc76d25d chore(deps): bump basic-ftp from 5.3.0 to 5.3.1 (#2398) 
Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.3.0
to 5.3.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/patrickjuchli/basic-ftp/releases">basic-ftp's
releases</a>.</em></p>
<blockquote>
<h2>5.3.1</h2>
<ul>
<li>Fixed: Protect against unbounded control response, fixes <a
href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md">basic-ftp's
changelog</a>.</em></p>
<blockquote>
<h2>5.3.1</h2>
<ul>
<li>Fixed: Protect against unbounded control response, fixes <a
href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/patrickjuchli/basic-ftp/commit/980371bb6057d78d479b5cfc18683392abd2c45f"><code>980371b</code></a>
Guard against unbounded control response</li>
<li><a
href="https://github.com/patrickjuchli/basic-ftp/commit/50827c73ca6c1d786c97276e47be8a33d0f2277d"><code>50827c7</code></a>
Adjust changelog to match release notes</li>
<li>See full diff in <a
href="https://github.com/patrickjuchli/basic-ftp/compare/v5.3.0...v5.3.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=basic-ftp&package-manager=npm_and_yarn&previous-version=5.3.0&new-version=5.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-16 03:28:58 -07:00
dependabot[bot] 67831afa7f chore(deps-dev): bump svelte from 5.55.5 to 5.55.7 (#2394) 
Bumps
[svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)
from 5.55.5 to 5.55.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sveltejs/svelte/releases">svelte's
releases</a>.</em></p>
<blockquote>
<h2>svelte@5.55.7</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: prevent XSS on <code>hydratable</code> from user contents (<a
href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p>
</li>
<li>
<p>chore: bump devalue (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p>
</li>
<li>
<p>fix: disallow empty attribute names during SSR (<a
href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p>
</li>
<li>
<p>fix: harden regex (<a
href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p>
</li>
<li>
<p>fix: move Svelte runtime properties to symbols (<a
href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p>
</li>
</ul>
<h2>svelte@5.55.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: leave stale promises to wait for a later resolution, instead of
rejecting (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p>
</li>
<li>
<p>fix: keep dependencies of <code>$state.eager/pending</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p>
</li>
<li>
<p>fix: reapply context after transforming error during SSR (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p>
</li>
<li>
<p>fix: don't rebase just-created batches (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p>
</li>
<li>
<p>chore: allow <code>null</code> for <code>pending</code> in typings
(<a
href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p>
</li>
<li>
<p>fix: flush eager effects in production (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p>
</li>
<li>
<p>fix: rethrow error of failed iterable after calling
<code>return()</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p>
</li>
<li>
<p>fix: account for proxified instance when updating
<code>bind:this</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p>
</li>
<li>
<p>fix: ensure scheduled batch is flushed if not obsolete (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p>
</li>
<li>
<p>fix: resolve stale deriveds with latest value (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p>
</li>
<li>
<p>chore: remove unnecessary <code>increment_pending</code> calls (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p>
</li>
<li>
<p>fix: correctly compile component member expressions for SSR (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p>
</li>
<li>
<p>fix: reset <code>source.updated</code> stack traces after
<code>flush</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p>
</li>
<li>
<p>fix: replacing async 'blocking' strategy with 'merging' (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p>
</li>
<li>
<p>fix: allow <code>@debug</code> tags to reference awaited variables
(<a
href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p>
</li>
<li>
<p>fix: re-run fallback props if dependencies update (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p>
</li>
<li>
<p>fix: abort running obsolete async branches (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18118">#18118</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's
changelog</a>.</em></p>
<blockquote>
<h2>5.55.7</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: prevent XSS on <code>hydratable</code> from user contents (<a
href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p>
</li>
<li>
<p>chore: bump devalue (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p>
</li>
<li>
<p>fix: disallow empty attribute names during SSR (<a
href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p>
</li>
<li>
<p>fix: harden regex (<a
href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p>
</li>
<li>
<p>fix: move Svelte runtime properties to symbols (<a
href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p>
</li>
</ul>
<h2>5.55.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: leave stale promises to wait for a later resolution, instead of
rejecting (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p>
</li>
<li>
<p>fix: keep dependencies of <code>$state.eager/pending</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p>
</li>
<li>
<p>fix: reapply context after transforming error during SSR (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p>
</li>
<li>
<p>fix: don't rebase just-created batches (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p>
</li>
<li>
<p>chore: allow <code>null</code> for <code>pending</code> in typings
(<a
href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p>
</li>
<li>
<p>fix: flush eager effects in production (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p>
</li>
<li>
<p>fix: rethrow error of failed iterable after calling
<code>return()</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p>
</li>
<li>
<p>fix: account for proxified instance when updating
<code>bind:this</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p>
</li>
<li>
<p>fix: ensure scheduled batch is flushed if not obsolete (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p>
</li>
<li>
<p>fix: resolve stale deriveds with latest value (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p>
</li>
<li>
<p>chore: remove unnecessary <code>increment_pending</code> calls (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p>
</li>
<li>
<p>fix: correctly compile component member expressions for SSR (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p>
</li>
<li>
<p>fix: reset <code>source.updated</code> stack traces after
<code>flush</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p>
</li>
<li>
<p>fix: replacing async 'blocking' strategy with 'merging' (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p>
</li>
<li>
<p>fix: allow <code>@debug</code> tags to reference awaited variables
(<a
href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p>
</li>
<li>
<p>fix: re-run fallback props if dependencies update (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sveltejs/svelte/commit/4d8f99a2709e3c02e48d8bc6c77458f4ba49d0e3"><code>4d8f99a</code></a>
Version Packages (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18220">#18220</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/05523088173e10af0753877af6936088de924833"><code>0552308</code></a>
chore: bump devalue (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18219">#18219</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd9</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc6</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/55f9c85c09d625c3dd80c71ce7542f57386fafb4"><code>55f9c85</code></a>
Version Packages (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18158">#18158</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/a10e8e47a5946623a60a1e36b9023c23926eae87"><code>a10e8e4</code></a>
fix: keep dependencies of <code>$state.eager</code>/<code>pending</code>
(alternative approach) (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/1">#1</a>...</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/ef4b97dfabfd7a23b27933e18f7393587c343d66"><code>ef4b97d</code></a>
fix: duplicated &quot;of&quot; in events.js comment (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18217">#18217</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/5122936edb3c14e9a602e579727479b49cbd3239"><code>5122936</code></a>
fix: treat batches as a linked list (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18205">#18205</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/sveltejs/svelte/commits/svelte@5.55.7/packages/svelte">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=svelte&package-manager=npm_and_yarn&previous-version=5.55.5&new-version=5.55.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-15 23:19:22 -07:00
dependabot[bot] c8aaf91753 chore(deps): bump postcss from 8.5.8 to 8.5.14 (#2391) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.8 to
8.5.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.14</h2>
<ul>
<li>Fixed custom syntax regression (by <a
href="https://github.com/43081j"><code>@​43081j</code></a>).</li>
</ul>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
<h2>8.5.12</h2>
<ul>
<li>Fixed reading any file via user-generated CSS.</li>
<li>Added <code>opts.unsafeMap</code> to disable checks.</li>
</ul>
<h2>8.5.11</h2>
<ul>
<li>Fixed nested brackets parsing performance (by <a
href="https://github.com/offset"><code>@​offset</code></a>).</li>
</ul>
<h2>8.5.10</h2>
<ul>
<li>Fixed XSS via unescaped <code>&lt;/style&gt;</code> in non-bundler
cases (by <a
href="https://github.com/TharVid"><code>@​TharVid</code></a>).</li>
</ul>
<h2>8.5.9</h2>
<ul>
<li>Speed up source map encoding paring in case of the error.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.14</h2>
<ul>
<li>Fixed custom syntax regression (by <a
href="https://github.com/43081j"><code>@​43081j</code></a>).</li>
</ul>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
<h2>8.5.12</h2>
<ul>
<li>Fixed reading any file via user-generated CSS.</li>
<li>Added <code>opts.unsafeMap</code> to disable checks.</li>
</ul>
<h2>8.5.11</h2>
<ul>
<li>Fixed nested brackets parsing performance (by <a
href="https://github.com/offset"><code>@​offset</code></a>).</li>
</ul>
<h2>8.5.10</h2>
<ul>
<li>Fixed XSS via unescaped <code>&lt;/style&gt;</code> in non-bundler
cases (by <a
href="https://github.com/TharVid"><code>@​TharVid</code></a>).</li>
</ul>
<h2>8.5.9</h2>
<ul>
<li>Speed up source map encoding paring in case of the error.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/3ec13948ae0006e1bde2dfb545346341ac8b2dcf"><code>3ec1394</code></a>
Release 8.5.14 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/f2bb827b20b591080977412555aa3e5baf588620"><code>f2bb827</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/d75953d60854ad835fd21dde0b11081522341020"><code>d75953d</code></a>
Merge pull request <a
href="https://redirect.github.com/postcss/postcss/issues/2084">#2084</a>
from 43081j/raw-raws-rawing</li>
<li><a
href="https://github.com/postcss/postcss/commit/68bd2139b5dcaf5a682bc2e8826d8557be2d1480"><code>68bd213</code></a>
fix: always call <code>raw</code> to retrieve raw values</li>
<li><a
href="https://github.com/postcss/postcss/commit/af58cf1b7af02e9b9fcb138a4a2d7ef3450158b1"><code>af58cf1</code></a>
Release 8.5.13 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/f227dbd0e9443e5f33e18e633b8b4d2b55aac5ee"><code>f227dbd</code></a>
Temporary ignore pnpm 11 config</li>
<li><a
href="https://github.com/postcss/postcss/commit/d3abd40d723cf3559e5ddb5fc738b7cb64e92bb0"><code>d3abd40</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/dd06c3e11362087bc18f9c20cee30fd82bda3de9"><code>dd06c3e</code></a>
Revert stringifier changes because of the conflict with
postcss-scss</li>
<li><a
href="https://github.com/postcss/postcss/commit/ae889c815fb88d785401a88f1a7dfc8cb11915fb"><code>ae889c8</code></a>
Try to fix CI</li>
<li><a
href="https://github.com/postcss/postcss/commit/e0093e49bcf00347383a13e40bb1f67bc823ca15"><code>e0093e4</code></a>
Move to pnpm 11</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.8...8.5.14">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.8&new-version=8.5.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-15 23:18:42 -07:00
dependabot[bot] aa6deb60c7 chore(deps): bump hono from 4.12.14 to 4.12.18 (#2374) 
Bumps [hono](https://github.com/honojs/hono) from 4.12.14 to 4.12.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.18</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Cache Middleware ignores Vary: Authorization / Vary: Cookie leading
to cross-user cache leakage</h3>
<p>Affects: Cache Middleware. Fixes missing cache-skip handling for
<code>Vary: Authorization</code> and <code>Vary: Cookie</code>, where a
response cached for one authenticated user could be served to other
users. GHSA-p77w-8qqv-26rm</p>
<h3>CSS Declaration Injection via Style Object Values in JSX SSR</h3>
<p>Affects: hono/jsx. Fixes a missing CSS-context escape for
<code>style</code> object values and property names, where untrusted
input could inject additional CSS declarations. The impact is limited to
CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p</p>
<h3>Improper validation of NumericDate claims (exp, nbf, iat) in JWT
verify()</h3>
<p>Affects: <code>hono/utils/jwt</code>. Fixes improper validation of
<code>exp</code>, <code>nbf</code>, and <code>iat</code> claims, where
falsy, non-finite, or non-numeric values could silently bypass
time-based checks instead of being rejected per RFC 7519.
GHSA-hm8q-7f3q-5f36</p>
<hr />
<p>Users who use the JWT helper, hono/jsx, or the Cache middleware are
strongly encouraged to upgrade to this version.</p>
<h2>v4.12.17</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(jsx): normalize SVG attributes on the <!-- raw HTML omitted -->
root element by <a
href="https://github.com/kfly8"><code>@​kfly8</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li>
<li>fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to
<code>defaultExtensionMap</code> by <a
href="https://github.com/yuintei"><code>@​yuintei</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4899">honojs/hono#4899</a></li>
<li>fix(cors): make origin optional in CORSOptions by <a
href="https://github.com/truffle-dev"><code>@​truffle-dev</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li>
<li>fix(types): propagate middleware response types to app.on overloads
by <a href="https://github.com/T4ko0522"><code>@​T4ko0522</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4906">honojs/hono#4906</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/kfly8"><code>@​kfly8</code></a> made
their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li>
<li><a
href="https://github.com/truffle-dev"><code>@​truffle-dev</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.16...v4.12.17">https://github.com/honojs/hono/compare/v4.12.16...v4.12.17</a></p>
<h2>v4.12.16</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection</h3>
<p>Affects: hono/jsx. Fixes missing validation of JSX tag names when
using <code>jsx()</code> or <code>createElement()</code>, which could
allow HTML injection if untrusted input is used as the tag name.
GHSA-69xw-7hcm-h432</p>
<h3>bodyLimit() can be bypassed for chunked / unknown-length
requests</h3>
<p>Affects: Body Limit Middleware. Fixes late enforcement for request
bodies without a reliable Content-Length (e.g. chunked requests), where
oversized requests could reach handlers and return successful responses
before being rejected. GHSA-9vqf-7f2p-gf9v</p>
<h2>v4.12.15</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(jwt): support single-line PEM keys by <a
href="https://github.com/hiendv"><code>@​hiendv</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4889">honojs/hono#4889</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/f10dee89ced5956b73c1cdc416d6bc0fd54d63b7"><code>f10dee8</code></a>
4.12.18</li>
<li><a
href="https://github.com/honojs/hono/commit/a5bd9ebead279ed9d0239ecbd854f629edfc0e57"><code>a5bd9eb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/58d3d3ad5656e007ed99da1b73865975952de5e9"><code>58d3d3a</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/568c2ecc1dd556894fad4dfa4a7ba499db6dba9c"><code>568c2ec</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/ff2b3d31df1be35f7d597a95dd3369402b6e87f2"><code>ff2b3d3</code></a>
4.12.17</li>
<li><a
href="https://github.com/honojs/hono/commit/52aaaf9714b06303ce5caa655b1d80675be687e9"><code>52aaaf9</code></a>
fix(types): propagate middleware response types to app.on overloads (<a
href="https://redirect.github.com/honojs/hono/issues/4906">#4906</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/76d5589e9b0569f4e74ec37e8dd6979455f70dfa"><code>76d5589</code></a>
fix(cors): make origin optional in CORSOptions (<a
href="https://redirect.github.com/honojs/hono/issues/4905">#4905</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/8f027e5574e91e3c7f263a728656e3888559e51a"><code>8f027e5</code></a>
fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to
<code>defaultExtensionMap</code> (<a
href="https://redirect.github.com/honojs/hono/issues/4899">#4899</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/bfba97ca7ea3d4541a3419f1749e5a1a3e8f1727"><code>bfba97c</code></a>
fix(jsx): normalize SVG attributes on the &lt;svg&gt; root element (<a
href="https://redirect.github.com/honojs/hono/issues/4893">#4893</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/90d4182aabd328e2ec6af3f25ec62ddc574ad8cb"><code>90d4182</code></a>
4.12.16</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.14...v4.12.18">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.14&new-version=4.12.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-11 14:20:47 -07:00
dependabot[bot] c79cf7f813 chore(deps): bump the angular group across 1 directory with 9 updates (#2365) 
Bumps the angular group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
|
[@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common)
| `21.2.7` | `21.2.11` |
|
[@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler)
| `21.2.7` | `21.2.11` |
|
[@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core)
| `21.2.7` | `21.2.11` |
|
[@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms)
| `21.2.7` | `21.2.11` |
|
[@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser)
| `21.2.7` | `21.2.11` |
|
[@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router)
| `21.2.7` | `21.2.11` |
| [@angular/build](https://github.com/angular/angular-cli) | `21.2.6` |
`21.2.9` |
| [@angular/cli](https://github.com/angular/angular-cli) | `21.2.6` |
`21.2.9` |
|
[@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli)
| `21.2.7` | `21.2.11` |


Updates `@angular/common` from 21.2.7 to 21.2.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/common's
releases</a>.</em></p>
<blockquote>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<h2>21.2.10</h2>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img
src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix -
0d5ee9ae1b" /></a></td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img
src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix -
5533ab4f56" /></a></td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img
src="https://img.shields.io/badge/580212c995-fix-green" alt="fix -
580212c995" /></a></td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
</tbody>
</table>
<h2>21.2.9</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img
src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix -
f603d4714f" /></a></td>
<td>escape forward slashes in transfer state to prevent crawler
indexing</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img
src="https://img.shields.io/badge/540536c386-fix-green" alt="fix -
540536c386" /></a></td>
<td>add CSP nonce support to JsonpClientBackend</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img
src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix -
63a857b874" /></a></td>
<td>Don't on Passthru outside of reactive context</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img
src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix -
e0b5078cf2" /></a></td>
<td>prevent SSRF bypasses via protocol-relative and backslash URLs</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/common's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.11 (2026-04-29)</h1>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td>
<td>fix</td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td>
<td>fix</td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td>
<td>fix</td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td>
<td>fix</td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td>
<td>fix</td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.9 (2026-04-22)</h1>
<h2>Breaking Changes</h2>
<h3>router</h3>
<ul>
<li>
<p>paramsInheritanceStrategy now defaults to 'always'</p>
<p>The default value of paramsInheritanceStrategy has been changed from
'emptyOnly' to 'always'. This means that route parameters are inherited
from all parent routes by default. To restore the previous behavior, set
paramsInheritanceStrategy to 'emptyOnly' in your router
configuration.</p>
</li>
</ul>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td>
<td>feat</td>
<td>introduce <code>@Service</code> decorator</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td>
<td>feat</td>
<td>Update Testability to use PendingTasks for stability indicator</td>
</tr>
</tbody>
</table>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td>
<td>fix</td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td>
<td>fix</td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td>
<td>fix</td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td>
<td>fix</td>
<td>set default paramsInheritanceStrategy to 'always'</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/42d57c35781fb65fc4d44df59b6a85287664216a"><code>42d57c3</code></a>
refactor(common): fix viewport tests</li>
<li><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><code>10ad3c0</code></a>
fix(common): prevent focus from scrollToAnchor</li>
<li><a
href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><code>540536c</code></a>
fix(http): add CSP nonce support to JsonpClientBackend</li>
<li><a
href="https://github.com/angular/angular/commit/8102331f82c808ca2256ba51a1d83803a61beabb"><code>8102331</code></a>
test(http): disable XSRF and mock location in HttpClient tests to avoid
Domin...</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v21.2.11/packages/common">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/compiler` from 21.2.7 to 21.2.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/compiler's
releases</a>.</em></p>
<blockquote>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<h2>21.2.10</h2>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img
src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix -
0d5ee9ae1b" /></a></td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img
src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix -
5533ab4f56" /></a></td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img
src="https://img.shields.io/badge/580212c995-fix-green" alt="fix -
580212c995" /></a></td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
</tbody>
</table>
<h2>21.2.9</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img
src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix -
f603d4714f" /></a></td>
<td>escape forward slashes in transfer state to prevent crawler
indexing</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img
src="https://img.shields.io/badge/540536c386-fix-green" alt="fix -
540536c386" /></a></td>
<td>add CSP nonce support to JsonpClientBackend</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img
src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix -
63a857b874" /></a></td>
<td>Don't on Passthru outside of reactive context</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img
src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix -
e0b5078cf2" /></a></td>
<td>prevent SSRF bypasses via protocol-relative and backslash URLs</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/compiler's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.11 (2026-04-29)</h1>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td>
<td>fix</td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td>
<td>fix</td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td>
<td>fix</td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td>
<td>fix</td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td>
<td>fix</td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.9 (2026-04-22)</h1>
<h2>Breaking Changes</h2>
<h3>router</h3>
<ul>
<li>
<p>paramsInheritanceStrategy now defaults to 'always'</p>
<p>The default value of paramsInheritanceStrategy has been changed from
'emptyOnly' to 'always'. This means that route parameters are inherited
from all parent routes by default. To restore the previous behavior, set
paramsInheritanceStrategy to 'emptyOnly' in your router
configuration.</p>
</li>
</ul>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td>
<td>feat</td>
<td>introduce <code>@Service</code> decorator</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td>
<td>feat</td>
<td>Update Testability to use PendingTasks for stability indicator</td>
</tr>
</tbody>
</table>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td>
<td>fix</td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td>
<td>fix</td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td>
<td>fix</td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td>
<td>fix</td>
<td>set default paramsInheritanceStrategy to 'always'</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><code>4f5d8a2</code></a>
fix(compiler): let declaration span not including end character</li>
<li><a
href="https://github.com/angular/angular/commit/a4f312060cdf745e4fb0b15eda24ee2b4df0440c"><code>a4f3120</code></a>
refactor(compiler): require a reference in DirectiveMeta</li>
<li><a
href="https://github.com/angular/angular/commit/de533fe49181ee7409fd0b0ae4c0391a1e220ee6"><code>de533fe</code></a>
refactor(compiler-cli): move ClassPropertyMapping into compiler</li>
<li><a
href="https://github.com/angular/angular/commit/ea1e34c4ddf404cde8d5c4ba0ba762bb0b9edbf8"><code>ea1e34c</code></a>
refactor(compiler): move matchSource into base metadata</li>
<li><a
href="https://github.com/angular/angular/commit/e40d378f3e3e7e57a45c8fbd9565ee06a3a6a13f"><code>e40d378</code></a>
fix(compiler): handle nested brackets in host object bindings</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v21.2.11/packages/compiler">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/core` from 21.2.7 to 21.2.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/core's
releases</a>.</em></p>
<blockquote>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<h2>21.2.10</h2>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img
src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix -
0d5ee9ae1b" /></a></td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img
src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix -
5533ab4f56" /></a></td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img
src="https://img.shields.io/badge/580212c995-fix-green" alt="fix -
580212c995" /></a></td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
</tbody>
</table>
<h2>21.2.9</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img
src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix -
f603d4714f" /></a></td>
<td>escape forward slashes in transfer state to prevent crawler
indexing</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img
src="https://img.shields.io/badge/540536c386-fix-green" alt="fix -
540536c386" /></a></td>
<td>add CSP nonce support to JsonpClientBackend</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img
src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix -
63a857b874" /></a></td>
<td>Don't on Passthru outside of reactive context</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img
src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix -
e0b5078cf2" /></a></td>
<td>prevent SSRF bypasses via protocol-relative and backslash URLs</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/core's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.11 (2026-04-29)</h1>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td>
<td>fix</td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td>
<td>fix</td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td>
<td>fix</td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td>
<td>fix</td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td>
<td>fix</td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.9 (2026-04-22)</h1>
<h2>Breaking Changes</h2>
<h3>router</h3>
<ul>
<li>
<p>paramsInheritanceStrategy now defaults to 'always'</p>
<p>The default value of paramsInheritanceStrategy has been changed from
'emptyOnly' to 'always'. This means that route parameters are inherited
from all parent routes by default. To restore the previous behavior, set
paramsInheritanceStrategy to 'emptyOnly' in your router
configuration.</p>
</li>
</ul>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td>
<td>feat</td>
<td>introduce <code>@Service</code> decorator</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td>
<td>feat</td>
<td>Update Testability to use PendingTasks for stability indicator</td>
</tr>
</tbody>
</table>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td>
<td>fix</td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td>
<td>fix</td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td>
<td>fix</td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td>
<td>fix</td>
<td>set default paramsInheritanceStrategy to 'always'</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/4900e453e1a2e9351ad2672a804d876ff5a62968"><code>4900e45</code></a>
build: update cross-repo angular dependencies</li>
<li><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><code>a40e2ce</code></a>
fix(core): fix ordering of view queries metadata in JIT mode</li>
<li><a
href="https://github.com/angular/angular/commit/9bcbf376413632590ef1fb1cebe68d049d9bd45b"><code>9bcbf37</code></a>
refactor(core): fix bundling symbol test</li>
<li><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><code>885a1a1</code></a>
fix(core): guard against non-object events and avoid listener wrapper
identit...</li>
<li><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><code>7a64aff</code></a>
fix(core): prevent event replay double-invocation when element hydrates
befor...</li>
<li><a
href="https://github.com/angular/angular/commit/750af5b12325277e04a345aaa74256bd8a1fbf26"><code>750af5b</code></a>
build: update cross-repo angular dependencies to v21.2.8</li>
<li><a
href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><code>5533ab4</code></a>
fix(migrations): fix NgClass leaving trailing comma after removal</li>
<li><a
href="https://github.com/angular/angular/commit/2b9954fd3dab124bfd88a49fc46f77271831c778"><code>2b9954f</code></a>
fix(migrations): fix NgClass leaving trailing comma after removal</li>
<li><a
href="https://github.com/angular/angular/commit/c9215b353975163c1d2b67d2fffe499ae82ceeef"><code>c9215b3</code></a>
Revert &quot;refactor(core): complete removal of deprecated
<code>createNgModuleRef</code> al...</li>
<li><a
href="https://github.com/angular/angular/commit/d88d6ed69e05decd2957e1235615926f49fb35c6"><code>d88d6ed</code></a>
refactor(core): complete removal of deprecated
<code>createNgModuleRef</code> alias</li>
<li>Additional commits viewable in <a
href="https://github.com/angular/angular/commits/v21.2.11/packages/core">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/forms` from 21.2.7 to 21.2.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/forms's
releases</a>.</em></p>
<blockquote>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<h2>21.2.10</h2>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img
src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix -
0d5ee9ae1b" /></a></td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img
src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix -
5533ab4f56" /></a></td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img
src="https://img.shields.io/badge/580212c995-fix-green" alt="fix -
580212c995" /></a></td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
</tbody>
</table>
<h2>21.2.9</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img
src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix -
f603d4714f" /></a></td>
<td>escape forward slashes in transfer state to prevent crawler
indexing</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img
src="https://img.shields.io/badge/540536c386-fix-green" alt="fix -
540536c386" /></a></td>
<td>add CSP nonce support to JsonpClientBackend</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img
src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix -
63a857b874" /></a></td>
<td>Don't on Passthru outside of reactive context</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img
src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix -
e0b5078cf2" /></a></td>
<td>prevent SSRF bypasses via protocol-relative and backslash URLs</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/forms's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.11 (2026-04-29)</h1>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td>
<td>fix</td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td>
<td>fix</td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td>
<td>fix</td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td>
<td>fix</td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td>
<td>fix</td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.9 (2026-04-22)</h1>
<h2>Breaking Changes</h2>
<h3>router</h3>
<ul>
<li>
<p>paramsInheritanceStrategy now defaults to 'always'</p>
<p>The default value of paramsInheritanceStrategy has been changed from
'emptyOnly' to 'always'. This means that route parameters are inherited
from all parent routes by default. To restore the previous behavior, set
paramsInheritanceStrategy to 'emptyOnly' in your router
configuration.</p>
</li>
</ul>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td>
<td>feat</td>
<td>introduce <code>@Service</code> decorator</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td>
<td>feat</td>
<td>Update Testability to use PendingTasks for stability indicator</td>
</tr>
</tbody>
</table>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td>
<td>fix</td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td>
<td>fix</td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td>
<td>fix</td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td>
<td>fix</td>
<td>set default paramsInheritanceStrategy to 'always'</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/600da64ba4df4b73ee00ab1b13f490a7de436ff6"><code>600da64</code></a>
docs(forms): add NG01902 error reference and link to docs</li>
<li><a
href="https://github.com/angular/angular/commit/dc9581469fe552faf45984362508d7e05adb5930"><code>dc95814</code></a>
docs: add documentation for NG1002</li>
<li><a
href="https://github.com/angular/angular/commit/b0dc2fbfcb909c558c7dcff89c2fe47c89878991"><code>b0dc2fb</code></a>
docs(forms): clarify disabled FormArray value behavior</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v21.2.11/packages/forms">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/platform-browser` from 21.2.7 to 21.2.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/platform-browser's
releases</a>.</em></p>
<blockquote>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<h2>21.2.10</h2>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img
src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix -
0d5ee9ae1b" /></a></td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img
src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix -
5533ab4f56" /></a></td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img
src="https://img.shields.io/badge/580212c995-fix-green" alt="fix -
580212c995" /></a></td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
</tbody>
</table>
<h2>21.2.9</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img
src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix -
f603d4714f" /></a></td>
<td>escape forward slashes in transfer state to prevent crawler
indexing</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img
src="https://img.shields.io/badge/540536c386-fix-green" alt="fix -
540536c386" /></a></td>
<td>add CSP nonce support to JsonpClientBackend</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img
src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix -
63a857b874" /></a></td>
<td>Don't on Passthru outside of reactive context</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img
src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix -
e0b5078cf2" /></a></td>
<td>prevent SSRF bypasses via protocol-relative and backslash URLs</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/platform-browser's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.11 (2026-04-29)</h1>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td>
<td>fix</td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td>
<td>fix</td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td>
<td>fix</td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td>
<td>fix</td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td>
<td>fix</td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.9 (2026-04-22)</h1>
<h2>Breaking Changes</h2>
<h3>router</h3>
<ul>
<li>
<p>paramsInheritanceStrategy now defaults to 'always'</p>
<p>The default value of paramsInheritanceStrategy has been changed from
'emptyOnly' to 'always'. This means that route parameters are inherited
from all parent routes by default. To restore the previous behavior, set
paramsInheritanceStrategy to 'emptyOnly' in your router
configuration.</p>
</li>
</ul>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td>
<td>feat</td>
<td>introduce <code>@Service</code> decorator</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td>
<td>feat</td>
<td>Update Testability to use PendingTasks for stability indicator</td>
</tr>
</tbody>
</table>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td>
<td>fix</td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td>
<td>fix</td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td>
<td>fix</td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td>
<td>fix</td>
<td>set default paramsInheritanceStrategy to 'always'</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v21.2.11/packages/platform-browser">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/router` from 21.2.7 to 21.2.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/router's
releases</a>.</em></p>
<blockquote>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<h2>21.2.10</h2>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0d5ee9ae1ba4b7acd8f27a059a778f0b4bd8a5bd"><img
src="https://img.shields.io/badge/0d5ee9ae1b-fix-green" alt="fix -
0d5ee9ae1b" /></a></td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5533ab4f56f574bc9365cf0573c4a34a3ab5aaf1"><img
src="https://img.shields.io/badge/5533ab4f56-fix-green" alt="fix -
5533ab4f56" /></a></td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><img
src="https://img.shields.io/badge/580212c995-fix-green" alt="fix -
580212c995" /></a></td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
</tbody>
</table>
<h2>21.2.9</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f603d4714fa184aad34a6f7f9ea4e79c8af3afac"><img
src="https://img.shields.io/badge/f603d4714f-fix-green" alt="fix -
f603d4714f" /></a></td>
<td>escape forward slashes in transfer state to prevent crawler
indexing</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/540536c386f2c735a700c2c9e2697a88dcb3d4ec"><img
src="https://img.shields.io/badge/540536c386-fix-green" alt="fix -
540536c386" /></a></td>
<td>add CSP nonce support to JsonpClientBackend</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/63a857b874172766451aa75ed3347ba50f0ee229"><img
src="https://img.shields.io/badge/63a857b874-fix-green" alt="fix -
63a857b874" /></a></td>
<td>Don't on Passthru outside of reactive context</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e0b5078cf2ebe79a6de85e9123148ae948b3d81d"><img
src="https://img.shields.io/badge/e0b5078cf2-fix-green" alt="fix -
e0b5078cf2" /></a></td>
<td>prevent SSRF bypasses via protocol-relative and backslash URLs</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/router's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.11 (2026-04-29)</h1>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6">10ad3c0692</a></td>
<td>fix</td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d">4f5d8a2c0b</a></td>
<td>fix</td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf">a40e2cebc8</a></td>
<td>fix</td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31">885a1a1d97</a></td>
<td>fix</td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659">7a64aff9b5</a></td>
<td>fix</td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909">be1f80a253</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.9 (2026-04-22)</h1>
<h2>Breaking Changes</h2>
<h3>router</h3>
<ul>
<li>
<p>paramsInheritanceStrategy now defaults to 'always'</p>
<p>The default value of paramsInheritanceStrategy has been changed from
'emptyOnly' to 'always'. This means that route parameters are inherited
from all parent routes by default. To restore the previous behavior, set
paramsInheritanceStrategy to 'emptyOnly' in your router
configuration.</p>
</li>
</ul>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8f3d0b9d97424e058eb7bce57d80833fb68dec4a">8f3d0b9d97</a></td>
<td>feat</td>
<td>introduce <code>@Service</code> decorator</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9f479ae9641a5c928f8eeab9c7846245002b3eff">9f479ae964</a></td>
<td>feat</td>
<td>Update Testability to use PendingTasks for stability indicator</td>
</tr>
</tbody>
</table>
<h3>docs</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b24b4cb699c325fc2ce40681724341baaabf277b">b24b4cb699</a></td>
<td>fix</td>
<td>link formatting in &quot;Animating your Application with
CSS&quot;</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/b395173cf206b8c04c5ab74298e640c9086d0bac">b395173cf2</a></td>
<td>fix</td>
<td>fix NgClass leaving trailing comma after removal</td>
</tr>
</tbody>
</table>
<h3>router</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6eff4395467de51a46656d79d957b448b32dde0c">6eff439546</a></td>
<td>fix</td>
<td>restore internal URL on popstate when <code>browserUrl</code> is
used</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/17d10f7a9921429d0192df6925d20d7236425c9a">17d10f7a99</a></td>
<td>fix</td>
<td>set default paramsInheritanceStrategy to 'always'</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/fbe080f829a677610d6bc8ab68af5f4e969f8422"><code>fbe080f</code></a>
docs(router): Fix method name for retrieving stored handles</li>
<li><a
href="https://github.com/angular/angular/commit/1be52ad880933139852ca785a5bf19098d8d6594"><code>1be52ad</code></a>
docs: Align Router API docs with inject based DI</li>
<li><a
href="https://github.com/angular/angular/commit/fa4eff36cb288c4d16aa96bfeedaefdd211f74c2"><code>fa4eff3</code></a>
docs(docs-infra): Validate case-sensitive API symbol links in
<code>@link</code></li>
<li><a
href="https://github.com/angular/angular/commit/580212c995751c4bf4ce8a49df4167498743e0ea"><code>580212c</code></a>
fix(router): restore internal URL on popstate when
<code>browserUrl</code> is used</li>
<li><a
href="https://github.com/angular/angular/commit/684e9fd53daacb9e910f42d98c6017f9e5cb4180"><code>684e9fd</code></a>
fix(router): normalize multiple leading slashes in URL parser</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v21.2.11/packages/router">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/build` from 21.2.6 to 21.2.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular-cli/releases">@​angular/build's
releases</a>.</em></p>
<blockquote>
<h2>21.2.9</h2>
<h3><code>@​schematics/angular</code></h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular-cli/commit/e7abeb5c74024daf125070c9b4f7f8d2426bab66"><img
src="https://img.shields.io/badge/e7abeb5c7-fix-green" alt="fix -
e7abeb5c7" /></a></td>
<td>add missing imports for focus and skip APIs in
refactor-jasmine-vitest</td>
</tr>
</tbody>
</table>
<h3><code>@​angular/cli</code></h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular-cli/commit/233deef01288c6aa39a048d6bd66a1f09595dc15"><img
src="https://img.shields.io/badge/233deef01-fix-green" alt="fix -
233deef01" /></a></td>
<td>fix broken img ref in ai-tutor</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular-cli/commit/7cea9885c64a747b391b74e6434cdf005c843766"><img
src="https://img.shields.io/badge/7cea9885c-fix-green" alt="fix -
7cea9885c" /></a></td>
<td>introduce initial package manager workspace awareness</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular-cli/commit/5b1a5b7434323eb383df1f53c389fe9dc948a785"><img
src="https://img.s...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-05 22:13:16 -07:00
dependabot[bot] 58c3de24f7 chore(deps-dev): bump the svelte group across 1 directory with 3 updates (#2368) 
Bumps the svelte group with 3 updates in the / directory:
[@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte),
[svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)
and
[vitest-browser-svelte](https://github.com/vitest-community/vitest-browser-svelte).

Updates `@sveltejs/vite-plugin-svelte` from 7.0.0 to 7.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sveltejs/vite-plugin-svelte/releases">@​sveltejs/vite-plugin-svelte's
releases</a>.</em></p>
<blockquote>
<h2><code>@​sveltejs/vite-plugin-svelte</code><a
href="https://github.com/7"><code>@​7</code></a>.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: pass <code>typescript.onlyRemoveTypeImports</code> to
<code>transformWithOxc</code> in <code>vitePreprocess</code> so that
value imports are not dropped when they are only referenced in Svelte
template markup (<a
href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1326">#1326</a>)</p>
</li>
<li>
<p>fix: correctly resolve compiled CSS for optimised Svelte dependencies
on the server (<a
href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1336">#1336</a>)</p>
</li>
</ul>
<h2><code>@​sveltejs/vite-plugin-svelte</code><a
href="https://github.com/7"><code>@​7</code></a>.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>feat: enable optimizer for server environments during dev (<a
href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1328">#1328</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md">@​sveltejs/vite-plugin-svelte's
changelog</a>.</em></p>
<blockquote>
<h2>7.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: pass <code>typescript.onlyRemoveTypeImports</code> to
<code>transformWithOxc</code> in <code>vitePreprocess</code> so that
value imports are not dropped when they are only referenced in Svelte
template markup (<a
href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1326">#1326</a>)</p>
</li>
<li>
<p>fix: correctly resolve compiled CSS for optimised Svelte dependencies
on the server (<a
href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1336">#1336</a>)</p>
</li>
</ul>
<h2>7.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>feat: enable optimizer for server environments during dev (<a
href="https://redirect.github.com/sveltejs/vite-plugin-svelte/pull/1328">#1328</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sveltejs/vite-plugin-svelte/commit/508d91bbdd495d62bc99fef26b9323977c20d5a9"><code>508d91b</code></a>
Version Packages (<a
href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1339">#1339</a>)</li>
<li><a
href="https://github.com/sveltejs/vite-plugin-svelte/commit/990e58cc9062a8d9b258d9248223e5cbd53935a1"><code>990e58c</code></a>
fix: correctly resolve Svelte CSS on the server during development (<a
href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1336">#1336</a>)</li>
<li><a
href="https://github.com/sveltejs/vite-plugin-svelte/commit/d5458a9c5122cb81fbf2a03c4a825124eb1a0f0d"><code>d5458a9</code></a>
fix: restore value imports stripped by oxc in script preprocessing (<a
href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1326">#1326</a>)</li>
<li><a
href="https://github.com/sveltejs/vite-plugin-svelte/commit/1c851266cb22f269156406a7c5e094aa8cdf475d"><code>1c85126</code></a>
Version Packages (<a
href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1331">#1331</a>)</li>
<li><a
href="https://github.com/sveltejs/vite-plugin-svelte/commit/1a4d225148d17af1dbab447dc9202b82e2bc1663"><code>1a4d225</code></a>
feat: enable optimizer for server environments during dev (<a
href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1328">#1328</a>)</li>
<li><a
href="https://github.com/sveltejs/vite-plugin-svelte/commit/d91be5f6dd2dff5806432e113c362e49aa19e356"><code>d91be5f</code></a>
fix: use correct pnpm catalog syntax</li>
<li><a
href="https://github.com/sveltejs/vite-plugin-svelte/commit/4d3afb492087e94581be7fc77f63b379b3a1c4e2"><code>4d3afb4</code></a>
chore: fix audit CI (<a
href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1327">#1327</a>)</li>
<li><a
href="https://github.com/sveltejs/vite-plugin-svelte/commit/8b3687bc2bf90ca81faadf42c8d9d2738851b968"><code>8b3687b</code></a>
use modern JSDoc imports (<a
href="https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte/issues/1309">#1309</a>)</li>
<li>See full diff in <a
href="https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/vite-plugin-svelte@7.1.1/packages/vite-plugin-svelte">compare
view</a></li>
</ul>
</details>
<br />

Updates `svelte` from 5.55.1 to 5.55.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sveltejs/svelte/releases">svelte's
releases</a>.</em></p>
<blockquote>
<h2>svelte@5.55.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: don't mark deriveds while an effect is updating (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18124">#18124</a>)</p>
</li>
<li>
<p>fix: do not dispatch introstart event with animation of animate
directive (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18122">#18122</a>)</p>
</li>
</ul>
<h2>svelte@5.55.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: never mark a child effect root as inert (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18111">#18111</a>)</p>
</li>
<li>
<p>fix: reset context after waiting on blockers of <code>@const</code>
expressions (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18100">#18100</a>)</p>
</li>
<li>
<p>fix: keep flushing new eager effects (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18102">#18102</a>)</p>
</li>
</ul>
<h2>svelte@5.55.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: ensure proper HMR updates for dynamic components (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18079">#18079</a>)</p>
</li>
<li>
<p>fix: correctly calculate <code>@const</code> blockers (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18039">#18039</a>)</p>
</li>
<li>
<p>fix: freeze deriveds once their containing effects are destroyed (<a
href="https://redirect.github.com/sveltejs/svelte/pull/17921">#17921</a>)</p>
</li>
<li>
<p>fix: defer error boundary rendering in forks (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18076">#18076</a>)</p>
</li>
<li>
<p>fix: avoid false positives for reactivity loss warning (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18088">#18088</a>)</p>
</li>
</ul>
<h2>svelte@5.55.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: invalidate <code>@const</code> tags based on visible references
in legacy mode (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18041">#18041</a>)</p>
</li>
<li>
<p>fix: handle parens in template expressions more robustly (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18075">#18075</a>)</p>
</li>
<li>
<p>fix: disallow <code>--</code> in <code>idPrefix</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18038">#18038</a>)</p>
</li>
<li>
<p>fix: correct types for <code>ontoggle</code> on
<code>&lt;details&gt;</code> elements (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18063">#18063</a>)</p>
</li>
<li>
<p>fix: don't override <code>$destroy/set/on</code> instance methods in
dev mode (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18034">#18034</a>)</p>
</li>
<li>
<p>fix: unskip branches of earlier batches after commit (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18048">#18048</a>)</p>
</li>
<li>
<p>fix: never set derived.v inside fork (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18037">#18037</a>)</p>
</li>
<li>
<p>fix: skip rebase logic in non-async mode (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18040">#18040</a>)</p>
</li>
<li>
<p>fix: don't reset status of uninitialized deriveds (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18054">#18054</a>)</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's
changelog</a>.</em></p>
<blockquote>
<h2>5.55.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: don't mark deriveds while an effect is updating (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18124">#18124</a>)</p>
</li>
<li>
<p>fix: do not dispatch introstart event with animation of animate
directive (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18122">#18122</a>)</p>
</li>
</ul>
<h2>5.55.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: never mark a child effect root as inert (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18111">#18111</a>)</p>
</li>
<li>
<p>fix: reset context after waiting on blockers of <code>@const</code>
expressions (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18100">#18100</a>)</p>
</li>
<li>
<p>fix: keep flushing new eager effects (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18102">#18102</a>)</p>
</li>
</ul>
<h2>5.55.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: ensure proper HMR updates for dynamic components (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18079">#18079</a>)</p>
</li>
<li>
<p>fix: correctly calculate <code>@const</code> blockers (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18039">#18039</a>)</p>
</li>
<li>
<p>fix: freeze deriveds once their containing effects are destroyed (<a
href="https://redirect.github.com/sveltejs/svelte/pull/17921">#17921</a>)</p>
</li>
<li>
<p>fix: defer error boundary rendering in forks (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18076">#18076</a>)</p>
</li>
<li>
<p>fix: avoid false positives for reactivity loss warning (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18088">#18088</a>)</p>
</li>
</ul>
<h2>5.55.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: invalidate <code>@const</code> tags based on visible references
in legacy mode (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18041">#18041</a>)</p>
</li>
<li>
<p>fix: handle parens in template expressions more robustly (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18075">#18075</a>)</p>
</li>
<li>
<p>fix: disallow <code>--</code> in <code>idPrefix</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18038">#18038</a>)</p>
</li>
<li>
<p>fix: correct types for <code>ontoggle</code> on
<code>&lt;details&gt;</code> elements (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18063">#18063</a>)</p>
</li>
<li>
<p>fix: don't override <code>$destroy/set/on</code> instance methods in
dev mode (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18034">#18034</a>)</p>
</li>
<li>
<p>fix: unskip branches of earlier batches after commit (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18048">#18048</a>)</p>
</li>
<li>
<p>fix: never set derived.v inside fork (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18037">#18037</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sveltejs/svelte/commit/b771df346444d486243882099d2a36f88e32dde0"><code>b771df3</code></a>
Version Packages (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18125">#18125</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/8e7319063aa609cca2cbf8cdf1958e5392dd2fa0"><code>8e73190</code></a>
fix: don't mark deriveds while an effect is updating (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18124">#18124</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/51736e576d86cc8879211632e3969730c513236b"><code>51736e5</code></a>
fix: do not dispatch transition event with animation (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18122">#18122</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/7fddfbdbbde8813ee107d56f70f5ea6c3d3abbc3"><code>7fddfbd</code></a>
Version Packages (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18105">#18105</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/671fc2ea11b56f050f37f7e03564fb070bc8abea"><code>671fc2e</code></a>
fix: never mark a child effect root as inert (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18111">#18111</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/0ed8c282f96960f52eaf077ffbe6e53c181b3774"><code>0ed8c28</code></a>
fix: reset context after waiting on blockers of <code>@const</code>
expressions (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18100">#18100</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/273f1a85a4dbe2937f2d97afa2511e828eb8ebba"><code>273f1a8</code></a>
fix: keep flushing new eager effects (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18102">#18102</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/4a50e8ea3b7db1d8cd752b825032e4ce2878524b"><code>4a50e8e</code></a>
Version Packages (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18085">#18085</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/15588f5fbfe736f65e189e56047ee08678f5509f"><code>15588f5</code></a>
fix: avoid false positives for reactivity loss warning (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18088">#18088</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/0e9e76f29262b5f64ac7a5d4db37ec83c9181634"><code>0e9e76f</code></a>
fix: freeze deriveds once their containing effects are destroyed (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/17921">#17921</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/sveltejs/svelte/commits/svelte@5.55.5/packages/svelte">compare
view</a></li>
</ul>
</details>
<br />

Updates `vitest-browser-svelte` from 2.1.0 to 2.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-community/vitest-browser-svelte/releases">vitest-browser-svelte's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.1</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li>Move <code>@playwright/test</code> out of dependencies  -  by <a
href="https://github.com/ocavue"><code>@​ocavue</code></a> in <a
href="https://redirect.github.com/vitest-community/vitest-browser-svelte/issues/26">vitest-community/vitest-browser-svelte#26</a>
<a
href="https://github.com/vitest-community/vitest-browser-svelte/commit/ff94b22"><!--
raw HTML omitted -->(ff94b)<!-- raw HTML omitted --></a></li>
</ul>
<h5>    <a
href="https://github.com/vitest-community/vitest-browser-svelte/compare/v2.1.0...v2.1.1">View
changes on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-community/vitest-browser-svelte/commit/092253b3ee80af3de6ac708199d6e7b1bb3f2dc4"><code>092253b</code></a>
chore: release v2.1.1</li>
<li><a
href="https://github.com/vitest-community/vitest-browser-svelte/commit/ff94b225d11b40cdfad6da1fd12044d7de842e41"><code>ff94b22</code></a>
fix: move <code>@playwright/test</code> out of dependencies (<a
href="https://redirect.github.com/vitest-community/vitest-browser-svelte/issues/26">#26</a>)</li>
<li>See full diff in <a
href="https://github.com/vitest-community/vitest-browser-svelte/compare/v2.1.0...v2.1.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-05 22:12:42 -07:00
dependabot[bot] c17ee878d4 chore(deps): bump the vue group across 1 directory with 2 updates (#2361) 
Bumps the vue group with 2 updates in the / directory:
[vue](https://github.com/vuejs/core) and
[@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue).

Updates `vue` from 3.5.31 to 3.5.33
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vuejs/core/releases">vue's
releases</a>.</em></p>
<blockquote>
<h2>v3.5.33</h2>
<p>For stable releases, please refer to <a
href="https://github.com/vuejs/core/blob/main/CHANGELOG.md">CHANGELOG.md</a>
for details.
For pre-releases, please refer to <a
href="https://github.com/vuejs/core/blob/minor/CHANGELOG.md">CHANGELOG.md</a>
of the <code>minor</code> branch.</p>
<h2>v3.5.32</h2>
<p>For stable releases, please refer to <a
href="https://github.com/vuejs/core/blob/main/CHANGELOG.md">CHANGELOG.md</a>
for details.
For pre-releases, please refer to <a
href="https://github.com/vuejs/core/blob/minor/CHANGELOG.md">CHANGELOG.md</a>
of the <code>minor</code> branch.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vuejs/core/blob/main/CHANGELOG.md">vue's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/vuejs/core/compare/v3.5.32...v3.5.33">3.5.33</a>
(2026-04-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>compiler-sfc:</strong> handle nested :deep in selector
pseudos (<a
href="https://redirect.github.com/vuejs/core/issues/14725">#14725</a>)
(<a
href="https://github.com/vuejs/core/commit/bb9d265d8dcdde2af824fc01b24f9a7b3169f5fa">bb9d265</a>),
closes <a
href="https://redirect.github.com/vuejs/core/issues/14724">#14724</a></li>
<li><strong>reactivity:</strong> unlink effect scopes on out-of-order
off (<a
href="https://redirect.github.com/vuejs/core/issues/14734">#14734</a>)
(<a
href="https://github.com/vuejs/core/commit/e7659beafc5407e892fa70f3f4ade80263b0905d">e7659be</a>),
closes <a
href="https://redirect.github.com/vuejs/core/issues/14733">#14733</a></li>
<li><strong>runtime-dom:</strong> preserve textarea resize dimensions
(<a
href="https://redirect.github.com/vuejs/core/issues/14747">#14747</a>)
(<a
href="https://github.com/vuejs/core/commit/11fb2fd4a246e40f6f350701dfea73ec525b4f59">11fb2fd</a>),
closes <a
href="https://redirect.github.com/vuejs/core/issues/14741">#14741</a></li>
<li><strong>teleport:</strong> don't move teleport children if not
mounted (<a
href="https://redirect.github.com/vuejs/core/issues/14702">#14702</a>)
(<a
href="https://github.com/vuejs/core/commit/6a61f4452ba1a31fc929cadf8abe3337ac4d3a46">6a61f44</a>),
closes <a
href="https://redirect.github.com/vuejs/core/issues/14701">#14701</a></li>
<li><strong>transition:</strong> preserve placeholder for conditional
explicit default slots (<a
href="https://redirect.github.com/vuejs/core/issues/14748">#14748</a>)
(<a
href="https://github.com/vuejs/core/commit/45990cecf4604b2f39c571ab6aefa49d362af36a">45990ce</a>),
closes <a
href="https://redirect.github.com/vuejs/core/issues/14727">#14727</a></li>
</ul>
<h2><a
href="https://github.com/vuejs/core/compare/v3.5.31...v3.5.32">3.5.32</a>
(2026-04-03)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>runtime-core:</strong> prevent currentInstance leak into
sibling render during async setup re-entry (<a
href="https://redirect.github.com/vuejs/core/issues/14668">#14668</a>)
(<a
href="https://github.com/vuejs/core/commit/f1663535a163057788d3285dec54a245c3efb3ad">f166353</a>),
closes <a
href="https://redirect.github.com/vuejs/core/issues/14667">#14667</a></li>
<li><strong>teleport:</strong> handle updates before deferred mount (<a
href="https://redirect.github.com/vuejs/core/issues/14642">#14642</a>)
(<a
href="https://github.com/vuejs/core/commit/32b44f19f67aa30899817a7e79a4510f3b52970a">32b44f1</a>),
closes <a
href="https://redirect.github.com/vuejs/core/issues/14640">#14640</a></li>
<li><strong>types:</strong> allow customRef to have different
getter/setter types (<a
href="https://redirect.github.com/vuejs/core/issues/14639">#14639</a>)
(<a
href="https://github.com/vuejs/core/commit/e20ddb00188e9935884930046fa572eab7c9dcba">e20ddb0</a>)</li>
<li><strong>types:</strong> use private branding for shallowReactive (<a
href="https://redirect.github.com/vuejs/core/issues/14641">#14641</a>)
(<a
href="https://github.com/vuejs/core/commit/302c47a4994bc8b47b8a2af6693d8cb6bbd4b06b">302c47a</a>),
closes <a
href="https://redirect.github.com/vuejs/core/issues/14638">#14638</a> <a
href="https://redirect.github.com/vuejs/core/issues/14493">#14493</a></li>
</ul>
<h3>Reverts</h3>
<ul>
<li>Revert &quot;fix(server-renderer): cleanup component effect scopes
after SSR render&quot; (<a
href="https://redirect.github.com/vuejs/core/issues/14674">#14674</a>)
(<a
href="https://github.com/vuejs/core/commit/219d83bd305ce6fc052941acaaf02e7bc70616a4">219d83b</a>),
closes <a
href="https://redirect.github.com/vuejs/core/issues/14674">#14674</a> <a
href="https://redirect.github.com/vuejs/core/issues/14669">#14669</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vuejs/core/commit/3310eea4ececff0379ea657e633e3c18b0f647eb"><code>3310eea</code></a>
release: v3.5.33</li>
<li><a
href="https://github.com/vuejs/core/commit/bb9d265d8dcdde2af824fc01b24f9a7b3169f5fa"><code>bb9d265</code></a>
fix(compiler-sfc): handle nested :deep in selector pseudos (<a
href="https://redirect.github.com/vuejs/core/issues/14725">#14725</a>)</li>
<li><a
href="https://github.com/vuejs/core/commit/60402cd4771be1b758cae759d27ffa6c01428364"><code>60402cd</code></a>
Revert &quot;chore(deps): update pnpm/action-setup action to v6&quot;
(<a
href="https://redirect.github.com/vuejs/core/issues/14749">#14749</a>)</li>
<li><a
href="https://github.com/vuejs/core/commit/11fb2fd4a246e40f6f350701dfea73ec525b4f59"><code>11fb2fd</code></a>
fix(runtime-dom): preserve textarea resize dimensions (<a
href="https://redirect.github.com/vuejs/core/issues/14747">#14747</a>)</li>
<li><a
href="https://github.com/vuejs/core/commit/974e2d21b75c677e835656b8743b44c4eb285ca8"><code>974e2d2</code></a>
chore(deps): update test (<a
href="https://redirect.github.com/vuejs/core/issues/14713">#14713</a>)</li>
<li><a
href="https://github.com/vuejs/core/commit/45990cecf4604b2f39c571ab6aefa49d362af36a"><code>45990ce</code></a>
fix(transition): preserve placeholder for conditional explicit default
slots ...</li>
<li><a
href="https://github.com/vuejs/core/commit/6a61f4452ba1a31fc929cadf8abe3337ac4d3a46"><code>6a61f44</code></a>
fix(teleport): don't move teleport children if not mounted (<a
href="https://redirect.github.com/vuejs/core/issues/14702">#14702</a>)</li>
<li><a
href="https://github.com/vuejs/core/commit/e7659beafc5407e892fa70f3f4ade80263b0905d"><code>e7659be</code></a>
fix(reactivity): unlink effect scopes on out-of-order off (<a
href="https://redirect.github.com/vuejs/core/issues/14734">#14734</a>)</li>
<li><a
href="https://github.com/vuejs/core/commit/268115dc49fe8aa9a2a6c820a7b91eba6ca68208"><code>268115d</code></a>
chore: update pnpm config (<a
href="https://redirect.github.com/vuejs/core/issues/14694">#14694</a>)</li>
<li><a
href="https://github.com/vuejs/core/commit/24f26f41af5aea64b5054ec57066679a4d71aff4"><code>24f26f4</code></a>
chore(deps): update pnpm/action-setup action to v6 (<a
href="https://redirect.github.com/vuejs/core/issues/14716">#14716</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vuejs/core/compare/v3.5.31...v3.5.33">compare
view</a></li>
</ul>
</details>
<br />

Updates `@vitejs/plugin-vue` from 6.0.5 to 6.0.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-vue/releases">@​vitejs/plugin-vue's
releases</a>.</em></p>
<blockquote>
<h2>plugin-vue@6.0.6</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite-plugin-vue/blob/plugin-vue@6.0.6/packages/plugin-vue/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md">@​vitejs/plugin-vue's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite-plugin-vue/compare/plugin-vue@6.0.5...plugin-vue@6.0.6">6.0.6</a>
(2026-04-13)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li><strong>plugin-vue:</strong> propagate multiRoot for template-only
vapor components (<a
href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/745">#745</a>)
(<a
href="https://github.com/vitejs/vite-plugin-vue/commit/9e07ae94d0ca2e40cf0c2aac6a3d355a445a5e2d">9e07ae9</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/738">#738</a>)
(<a
href="https://github.com/vitejs/vite-plugin-vue/commit/050c9962660e7bb189fe8e03f0fa4cbd0b5ba766">050c996</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update dependency rollup to ^4.59.0 (<a
href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/749">#749</a>)
(<a
href="https://github.com/vitejs/vite-plugin-vue/commit/a0e1ef83bd841c22c3fddc62189b545ec7c71729">a0e1ef8</a>)</li>
<li>remove unused deps (<a
href="https://redirect.github.com/vitejs/vite-plugin-vue/issues/760">#760</a>)
(<a
href="https://github.com/vitejs/vite-plugin-vue/commit/6d834d82614ec76eb7618a2b015b6e8b0664f096">6d834d8</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite-plugin-vue/commit/51dbf4b494ef3e8b87febdb285d3c15b8a9c5490"><code>51dbf4b</code></a>
release: plugin-vue@6.0.6</li>
<li><a
href="https://github.com/vitejs/vite-plugin-vue/commit/9e07ae94d0ca2e40cf0c2aac6a3d355a445a5e2d"><code>9e07ae9</code></a>
feat(plugin-vue): propagate multiRoot for template-only vapor components
(<a
href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/745">#745</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-vue/commit/050c9962660e7bb189fe8e03f0fa4cbd0b5ba766"><code>050c996</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/738">#738</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-vue/commit/6d834d82614ec76eb7618a2b015b6e8b0664f096"><code>6d834d8</code></a>
chore: remove unused deps (<a
href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/760">#760</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-vue/commit/a0e1ef83bd841c22c3fddc62189b545ec7c71729"><code>a0e1ef8</code></a>
chore(deps): update dependency rollup to ^4.59.0 (<a
href="https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue/issues/749">#749</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.6/packages/plugin-vue">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-05 21:54:16 -07:00
Christian Bromann 085a07f569 feat(core): event based streaming (#2314) 
All stream v2 changes consolidated.

---------

Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-05-05 00:13:12 -07:00
dependabot[bot] fe09385cb1 chore(deps): bump the langchain group across 1 directory with 9 updates (#2358) 
Bumps the langchain group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) |
`1.3.26` | `1.3.28` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) |
`1.1.40` | `1.1.43` |
| [langchain](https://github.com/langchain-ai/langchainjs) | `1.3.0` |
`1.3.5` |
| [@langchain/openai](https://github.com/langchain-ai/langchainjs) |
`1.4.1` | `1.4.5` |
| [@langchain/groq](https://github.com/langchain-ai/langchainjs) |
`1.1.5` | `1.2.0` |
| [@langchain/mistralai](https://github.com/langchain-ai/langchainjs) |
`1.0.7` | `1.0.8` |
| [@langchain/ollama](https://github.com/langchain-ai/langchainjs) |
`1.2.6` | `1.2.7` |
| [@langchain/classic](https://github.com/langchain-ai/langchainjs) |
`1.0.27` | `1.0.32` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.5.20`
| `0.6.0` |


Updates `@langchain/anthropic` from 1.3.26 to 1.3.28
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/anthropic's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/anthropic</code><a
href="https://github.com/1"><code>@​1</code></a>.3.27</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10726">#10726</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ad153c185b6cf813d4b7695740d9a4453d2cb63f"><code>ad153c1</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
feat(anthropic): add Claude Opus 4.7 compatibility updates</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7"><code>589f29c</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4"><code>2e9e696</code></a>]:</p>
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.41</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/core` from 1.1.40 to 1.1.43
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.41</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10733">#10733</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7"><code>589f29c</code></a>
Thanks <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a>! -
fix(core): Update inheritance behavior for tracer metadata for special
keys</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10711">#10711</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4"><code>2e9e696</code></a>
Thanks <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a>! -
feat(core): Add chat model and llm invocation params to traced
metadata</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `langchain` from 1.3.0 to 1.3.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">langchain's
releases</a>.</em></p>
<blockquote>
<h2>langchain@1.3.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10713">#10713</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/49ac9e7404e5a9269b9ac047711ee96dd928b231"><code>49ac9e7</code></a>
Thanks <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a>! -
feat(langchain): Adds ls_agent_type to create agent runs as tracing
metadata</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7"><code>589f29c</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4"><code>2e9e696</code></a>]:</p>
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.41</li>
</ul>
</li>
</ul>
<h2>langchain@1.3.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/9386">#9386</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>
Thanks <a
href="https://github.com/Josh-Engle"><code>@​Josh-Engle</code></a>! -
Prevent local file corruption when using <code>LocalFileStore</code></p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f"><code>d3e0809</code></a>]:</p>
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.40</li>
</ul>
</li>
</ul>
<h2>langchain@1.3.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10693">#10693</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/5a6e0ab6617587f3aed19d07bf3ed91994dcdac8"><code>5a6e0ab</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
fix(agents): derive middleware hook state from invocation state</p>
<p>Prevents middleware state from leaking across threads by deriving
middleware hook input state from the current invocation state instead of
cross-node cached state.</p>
</li>
</ul>
<h2>langchain@1.3.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10673">#10673</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/f0693657b7e5bdbf888a46d04e68431e446c7bc0"><code>f069365</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
bump langgraph dependency to 1.2.8</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/6845a1ef129450cd6e75bb8a8e7390a416ab3d9c"><code>6845a1e</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10690">#10690</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5a6e0ab6617587f3aed19d07bf3ed91994dcdac8"><code>5a6e0ab</code></a>
fix(agents): derive middleware hook state from invocation state (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10693">#10693</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/607696e8143ad30faeebb800028e244a11d46638"><code>607696e</code></a>
chore(ci): add label-gated publish-preview workflow (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10696">#10696</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/1f8b2c0b863645da45114d8756dc5b66fcb43c98"><code>1f8b2c0</code></a>
chore(ci): add label-gated publish-preview workflow (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10695">#10695</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/2ff51cf0688e45d5d237b2b435334b5fd987afa9"><code>2ff51cf</code></a>
fix(aws): normalize Bedrock Converse object errors for tracing (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10688">#10688</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/4a91db32a80a1b9da3bea4f6333eff63980b28b4"><code>4a91db3</code></a>
chore(deps): bump langsmith from 0.5.9 to 0.5.18 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10687">#10687</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/312d60536da66827791e9b0f4a9d5d9091439183"><code>312d605</code></a>
chore(deps): bump axios from 1.13.6 to 1.15.0 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10686">#10686</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3e071bb44ec9c80a0eb964eff089434f4edd78b2"><code>3e071bb</code></a>
chore: remove suppressed CodeQL query filter and deduplicate
paths-ignore (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/1">#1</a>...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e5b6e1c8568115cdda53eccafbdcd23537f554c5"><code>e5b6e1c</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10682">#10682</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2"><code>2301260</code></a>
fix(openai): add index to streaming reasoning content blocks for proper
chunk...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/langchain@1.3.0...@langchain/aws@1.3.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/openai` from 1.4.1 to 1.4.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/openai's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.4</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10681">#10681</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2"><code>2301260</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
fix(openai): add index to streaming reasoning content blocks for proper
chunk merging</li>
</ul>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10670">#10670</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/6b8ef6c95e061af47af206926598c983d878f72a"><code>6b8ef6c</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- fix(openai): preserve plain string responses content</li>
</ul>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10614">#10614</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1"><code>d6bf4fc</code></a>
Thanks <a
href="https://github.com/colifran"><code>@​colifran</code></a>! -
feat(openai): imput placeholder filenames for openai file inputs</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>]:</p>
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.39</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/groq` from 1.1.5 to 1.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/groq's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/groq</code><a
href="https://github.com/1"><code>@​1</code></a>.2.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10603">#10603</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/66effb028baf5c923501801c989c7377efb8b77a"><code>66effb0</code></a>
Thanks <a
href="https://github.com/apps/dependabot"><code>@​dependabot</code></a>!
- chore(deps): bump groq-sdk from 0.37.0 to 1.1.2</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/daece6df71e0095c7a354270667a0b851a8cee4d"><code>daece6d</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10560">#10560</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/9781bff525bffdd3b6a75adfa8a30fdb4bfc505e"><code>9781bff</code></a>
fix(google): align ChatGoogle mediaResolution with Gemini scalar type
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10550">#10550</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3bd85c17869e95d5d1a67c5fccc0c4cab2646616"><code>3bd85c1</code></a>
feat(langchain): add ChatGoogle support to initChatModel (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10654">#10654</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>
feat(core): support for headless tools (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10430">#10430</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/793bc69a8af8198de9d157c21070871660e6bb13"><code>793bc69</code></a>
feat(aws): impute file name for document content blocks#963 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10658">#10658</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1"><code>d6bf4fc</code></a>
feat(openai): impute placeholder filenames for openai file inputs (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10614">#10614</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0a7a7298b719f579854e41adddb04f17dc82640b"><code>0a7a729</code></a>
fix(examples): update dependencies (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10651">#10651</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/6f8dafcb9deee169473eadaae6416ad255277a5b"><code>6f8dafc</code></a>
Bump vitest (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10649">#10649</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e89cfd29f36e0b2fee20a7443e6c30c88039d735"><code>e89cfd2</code></a>
chore(deps): bump <code>@​cloudflare/workers-types</code> from
4.20260207.0 to 4.20260402.1...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0de2c14d38716d9c66c546e18a490c5bfda75134"><code>0de2c14</code></a>
chore(deps): bump <code>@​aws-sdk/client-bedrock-agent-runtime</code>
from 3.1006.0 to 3.10...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/groq@1.1.5...@langchain/groq@1.2.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/mistralai` from 1.0.7 to 1.0.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/mistralai's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f"><code>d3e0809</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>]:
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.40</li>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.31</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.30</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.29</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10590">#10590</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ed8cda659c893219d853a402f0fcd46e06cf7c28"><code>ed8cda6</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat: scaffold <code>@​langchain/neo4j</code> provider package</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e"><code>d7a98cd</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86"><code>884c2d3</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e"><code>0fb6fa4</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>]:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.28</li>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.39</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7ea8874715f76c17d3ec3d2ff0503dd12abbc5e9"><code>7ea8874</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9716">#9716</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5707c3edc6a4d43934da0d3e7b9666b2fc144440"><code>5707c3e</code></a>
docs(internal): add AGENTS.md file (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9742">#9742</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8ef152555a945c95322f28209957b69605c04c91"><code>8ef1525</code></a>
feat(google-common): support thinkingLevel parameter for Gemini models
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9738">#9738</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c28d24a8770f6d0e543cde116b0e38b3baf21301"><code>c28d24a</code></a>
fix(core): use getBufferString for message summarization (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9739">#9739</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f6974516b041ed12befd26e1a4cbe457865a2780"><code>f697451</code></a>
fix(langchain): keep tool call / AIMessage pairings when summarizing (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9740">#9740</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/536c7ddacd6c7f80d2edf18ab9caeeab71827ccd"><code>536c7dd</code></a>
fix(langchain): default strict to true in providerStrategy for OpenAI
compati...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/75b3b90c5fa62cbbfa678dfb01f031caed4488ef"><code>75b3b90</code></a>
fix(openai): pass runManager to _streamResponseChunks in responses API
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9737">#9737</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/13c9d5bfa3acac7ffb37642e9a50d84dc9004e88"><code>13c9d5b</code></a>
fix(openai): pass through provider-native content in ToolMessage without
stri...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5cfbedf064ffdc960cb2e5a97e37d7a5900560de"><code>5cfbedf</code></a>
fix(langchain): support callbacks property in stream (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9728">#9728</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/9ac29de3d3f70c75933913d94ad9a47c6ce39c1d"><code>9ac29de</code></a>
fix(langchain-aws): add support for Amazon Nova embedding models (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9701">#9701</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/mistralai@1.0.7...@langchain/classic@1.0.8">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/ollama` from 1.2.6 to 1.2.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/ollama's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f"><code>d3e0809</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>]:
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.40</li>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.31</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.30</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.29</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10590">#10590</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ed8cda659c893219d853a402f0fcd46e06cf7c28"><code>ed8cda6</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat: scaffold <code>@​langchain/neo4j</code> provider package</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e"><code>d7a98cd</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86"><code>884c2d3</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e"><code>0fb6fa4</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>]:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.28</li>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.39</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/bd72d8eb8bde1b2282c9ec88f2ebadd0747dc7b7"><code>bd72d8e</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9762">#9762</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/578574906bdbd9cfce95e34030c1a3d97e63d1c1"><code>5785749</code></a>
fix(internal): fix changeset config (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9768">#9768</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/ddd72b8122e9dc68242b8467292bbee62e1dda2e"><code>ddd72b8</code></a>
chore(standard-tests): move standard-tests into ./internal (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9755">#9755</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/739d4e88cc78b8f578ab019b526c97d63d9c2144"><code>739d4e8</code></a>
Feat/xai responses implementation (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9718">#9718</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e0360d9bdc0e7725d59625902bcfc98c39931e2a"><code>e0360d9</code></a>
fix(langchain): ensure models only make on write_todo call at a time (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9761">#9761</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8619adb81f16977b3ab8d4607ad5c30f79c41e3d"><code>8619adb</code></a>
fix: add properties to check valid props (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9757">#9757</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/23be5afd59b5f4806edef11937ce5e2ba300f7ee"><code>23be5af</code></a>
feat(langchain): consolidate type generics in bags (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9517">#9517</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/85820be04995b4047a798ec44da6077cd1908d7a"><code>85820be</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9754">#9754</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a46a24983fd0fea649d950725a2673b3c435275f"><code>a46a249</code></a>
fix(core): allow shared object references in serialization (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9753">#9753</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3c8ba0d97f1c08e8f8c67ffddff5d57daba46f85"><code>3c8ba0d</code></a>
chore(internal): Turborepo improvements (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9744">#9744</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/ollama@1.2.6...langchain@1.2.7">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/classic` from 1.0.27 to 1.0.32
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/classic's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.31</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/9386">#9386</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>
Thanks <a
href="https://github.com/Josh-Engle"><code>@​Josh-Engle</code></a>! -
Prevent local file corruption when using
<code>LocalFileStore</code></li>
</ul>
<h2><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.30</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2"><code>2301260</code></a>]:
<ul>
<li><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.4</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.29</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/6b8ef6c95e061af47af206926598c983d878f72a"><code>6b8ef6c</code></a>]:
<ul>
<li><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.3</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.28</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10591">#10591</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e"><code>d7a98cd</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat: add <code>@​langchain/perplexity</code> standalone provider
package</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10594">#10594</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86"><code>884c2d3</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat(fireworks): extract standalone provider package</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10593">#10593</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e"><code>0fb6fa4</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat(together-ai): migrate Together AI into provider package</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1"><code>d6bf4fc</code></a>]:</p>
<ul>
<li><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.2</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `langsmith` from 0.5.20 to 0.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(js): bump JS to 0.4.3 by <a
href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2253">langchain-ai/langsmith-sdk#2253</a></li>
<li>Revert &quot;feat: add js prompt caching&quot; by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2258">langchain-ai/langsmith-sdk#2258</a></li>
<li>Revert &quot;feat: Replace UUID5 with deterministic UUID7 for
replicas&quot; by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2257">langchain-ai/langsmith-sdk#2257</a></li>
<li>release(js): bump to 0.4.4 by <a
href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2259">langchain-ai/langsmith-sdk#2259</a></li>
<li>feat: add prompt cache back and setup environment tests by <a
href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2260">langchain-ai/langsmith-sdk#2260</a></li>
<li>feat(python): Bump pydantic to v2 by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2248">langchain-ai/langsmith-sdk#2248</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0</a></p>
<h2>v0.6.0rc0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat(js): Add support for tracing AI SDK 6 by <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2237">langchain-ai/langsmith-sdk#2237</a></li>
<li>fix(js): Remove default Jestlike timeout by <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2243">langchain-ai/langsmith-sdk#2243</a></li>
<li>feat(js): Add support for tracing tool loop agent by <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2244">langchain-ai/langsmith-sdk#2244</a></li>
<li>feat: Replace UUID5 with deterministic UUID7 for replicas by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2249">langchain-ai/langsmith-sdk#2249</a></li>
<li>feat: add prompt caching to python sdk by <a
href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2246">langchain-ai/langsmith-sdk#2246</a></li>
<li>feat: add js prompt caching by <a
href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2251">langchain-ai/langsmith-sdk#2251</a></li>
<li>fix(claude): correctly parse llm and tool inputs in claude agent sdk
by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2255">langchain-ai/langsmith-sdk#2255</a></li>
<li>bump(python): 0.5.2 by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2256">langchain-ai/langsmith-sdk#2256</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits/v0.6.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-04 22:42:09 -07:00
John Kennedy 7f3320cda8 fix: patch 6 medium-severity security alerts (#2333) 
## Security Alert Patch (medium-tier follow-up)

Follow-up to #2329, which patched the critical+high tier. This PR
resolves the remaining **6 medium-severity Dependabot alerts** via
`pnpm.overrides` plus one published-path constraint bump. All fixes are
patch/minor bumps within the current major — no breaking changes.

### Packages Updated

| Package | Old Constraint | New Constraint | Strategy | Scope | CVEs
Resolved |

|---------|---------------|----------------|----------|-------|---------------|
| `axios` | `>=1.13.5` (override) | `>=1.15.0` (override); resolved
1.13.6 → **1.15.1** | C (override) | dev-only (via `@langchain/scripts`
devDep) | CVE-2025-62718 (SSRF via NO_PROXY bypass), CVE-2026-40175
(cloud metadata exfiltration) |
| `dompurify` | (transitive, resolved 3.3.3) | `>=3.4.0` (new override);
resolved **3.4.0** | C (override) | dev-only (private
`@example/ai-elements` via mermaid) | GHSA-39q2-94rc-95cp (ADD_TAGS
bypasses FORBID_TAGS) |
| `follow-redirects` | (transitive, resolved 1.15.11) | `>=1.16.0` (new
override); resolved **1.16.0** | C (override) | dev-only (via
`@langchain/scripts` devDep) | GHSA-r4q5-vmmm-2653 (auth header leak on
cross-domain redirect) |
| `langsmith` (published path) | `langsmith: >=0.3.33 <1.0.0` in
`libs/langgraph-api/package.json` | `>=0.5.19 <1.0.0` | **A (manifest
bump)** | **published** — direct dep of `@langchain/langgraph-api` |
CVE-2026-40190 (prototype pollution), GHSA-rr7j-v2q5-chgv (streaming
redaction bypass) |
| `langsmith` (dev chains) | (transitive 0.4.12, 0.5.16 resolved via
`@langchain/classic`, `langchain@1.3.0`) | `langsmith@<0.5.19: >=0.5.19
<1` (new override) | C (override) | dev-only | same as above (flushes
vulnerable transitive copies) |

*Strategy C overrides follow the existing repo pattern — axios, qs,
undici, minimatch, brace-expansion, protobufjs, basic-ftp, vite, and
defu are already overridden the same way.*

### Published-path rationale

`@langchain/langgraph-api` exercises `langsmith` at runtime for tracing
and streaming, which touches the affected internal code paths (lodash
`set()` prototype-pollution guard, token-event redaction). Therefore the
fix is Strategy A (raise the published lower bound) rather than
A-lockfile — this protects end users who pin `@langchain/langgraph-api`.
The lockfile already resolved `langsmith@0.5.20` before this change, so
installs are unchanged at HEAD; the bump is a downstream-safety
constraint tightening.

### Deferred (not fixed in this PR)

- **`protobufjs@6.11.5`** (CRITICAL, CVE-2026-41242) — reached via
`@xenova/transformers@2.17.2` in `libs/langgraph-core` devDeps +
examples. `@xenova/transformers` is abandoned; the successor is
`@huggingface/transformers@3`. Forcing a 6.x → 7.x override would cross
a breaking API boundary. **Upstream issue — requires a manual migration,
tracked separately.** (See #2329 body for full context.)
- **`elliptic@6.6.1`** (LOW, GHSA-848j-6mx2-7j84) —
`first_patched_version` is `null`; upstream has not released a fix.
Defer until a patched version ships.

### CVE Details

- **CVE-2025-62718** / GHSA-3p68-rc4w-qgx5 — Axios NO_PROXY Hostname
Normalization Bypass Leads to SSRF —
https://github.com/advisories/GHSA-3p68-rc4w-qgx5
- **CVE-2026-40175** / GHSA-fvcv-3m26-pcqx — Axios Unrestricted Cloud
Metadata Exfiltration via Header Injection Chain —
https://github.com/advisories/GHSA-fvcv-3m26-pcqx
- **GHSA-39q2-94rc-95cp** — DOMPurify `ADD_TAGS` bypasses `FORBID_TAGS`
via short-circuit evaluation —
https://github.com/advisories/GHSA-39q2-94rc-95cp
- **GHSA-r4q5-vmmm-2653** — follow-redirects leaks custom authentication
headers to cross-domain redirect targets —
https://github.com/advisories/GHSA-r4q5-vmmm-2653
- **CVE-2026-40190** / GHSA-fw9q-39r9-c252 — LangSmith prototype
pollution via incomplete `__proto__` guard in internal lodash `set()` —
https://github.com/advisories/GHSA-fw9q-39r9-c252
- **GHSA-rr7j-v2q5-chgv** — LangSmith streaming token events bypass
output redaction — https://github.com/advisories/GHSA-rr7j-v2q5-chgv

### Linear Tickets

Linear ticket lookup returned no matches for the resolved CVEs/GHSAs. No
ticket IDs included in the title.

### Verification

- [x] Lockfile regenerated via `pnpm install --lockfile-only`
- [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors
- [x] `pnpm format:check` (oxfmt) — clean
- [x] `pnpm audit --prod` — **No known vulnerabilities found**
- [x] `pnpm typecheck` on `libs/langgraph-api` — clean
- [x] No staged secrets (`gitleaks git --staged`)

🤖 Submitted by langster-patch

Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
 2026-04-22 09:26:44 -07:00
John Kennedy 076f7f81f0 fix: patch 7 security alerts (critical + high severity) (#2329) 
## Security Alert Patch

Resolves **7 Dependabot security alerts** in the critical + high
severity tier via `pnpm.overrides` in the root `package.json`. All fixes
are patch/minor bumps within the current major — no breaking changes.

### Packages Updated

| Package | Old Constraint | New Constraint | Strategy | Scope | CVEs
Resolved |

|---------|---------------|----------------|----------|-------|---------------|
| `protobufjs` | (transitive, resolved 7.5.4) | `>=7.5.5 <8` | C
(override) | dev-only (testcontainers chain + `@xenova/transformers`
devDeps) | CVE-2026-41242 |
| `basic-ftp` | (transitive, resolved 5.2.0) | `>=5.3.0 <6` | C
(override) | effectively dev-only (reached only via `@vitest/browser` —
an optional peerDep of vitest — through webdriverio→proxy-agent) |
GHSA-rp42-5vxx-qpwr, GHSA-6v7q-wjvx-w8wg, CVE-2026-39983 |
| `vite` (7.x only) | (transitive via vitest peer, resolved 7.3.1) |
`>=7.3.2` | C (override, scoped to vite@7) | effectively dev-only (vite
is a peerDependency of vitest — end users supply their own vite) |
CVE-2026-39363, CVE-2026-39364 |
| `defu` | (transitive, resolved 6.1.4) | `>=6.1.5 <7` | C (override) |
dev-only (`internal/build` via tsdown) | CVE-2026-35209 |

*Strategy C (pnpm.overrides) follows the existing pattern in this repo —
axios, qs, undici, minimatch, brace-expansion, etc. are already
overridden the same way.*

### Side-effect Fixes

Bumping `vite@7` to 7.3.2 also resolves one **medium** alert that wasn't
in the primary batch:

- CVE-2026-39365 / GHSA-4w7w-66w2-5vf9 — vite Path Traversal in
Optimized Deps `.map` Handling

### Upstream / Design Issues (NOT fixed in this PR)

- **`protobufjs@6.11.x`** persists in the dependency graph via
`@xenova/transformers@2.17.2` (`libs/langgraph-core` devDep + 9 example
apps). `@xenova/transformers` is abandoned and rebranded as
`@huggingface/transformers@3`; a migration would be a separate manual
dev-only upgrade. The 6.x line is in devDependencies only and does not
ship to published package consumers. Dependabot may continue to flag the
6.x range because the advisory's `vulnerable_range` is `< 7.5.5`.

- **Published-path caveat for `basic-ftp` and `vite`:** Both transit
through `@langchain/langgraph-checkpoint-validation`'s
`dependencies.vitest`. However, `vite` is declared as a
**peerDependency** of vitest (end users supply their own), and
`basic-ftp` reaches end users only through `@vitest/browser` — an
**optional peerDependency** that users must explicitly opt into.
Overrides in this PR protect local dev and CI; end users of
`@langchain/langgraph-checkpoint-validation` are not exposed unless they
independently install and configure the browser-testing chain.

### Deferred (medium + low tier)

Per security-alert-patch policy, only the highest active severity tier
was patched in this PR. The following remain open and would be addressed
in a follow-up batch:

- 6 medium: axios ×2 (SSRF + cloud-metadata exfil — existing `axios:
>=1.13.5` override doesn't cover 1.15.0), dompurify, langsmith ×2,
follow-redirects
- 1 low: elliptic (no `first_patched_version` published — upstream has
not released a fix)

### Verification

- [x] Lockfile regenerated via `pnpm install --lockfile-only`
- [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors
- [x] `pnpm format:check` (oxfmt) — clean
- [x] `pnpm audit --prod` — 0 critical, 0 high remaining (3 moderates =
the deferred medium alerts)
- [x] No staged secrets (gitleaks)

### Linear Tickets

Linear ticket lookup skipped — CLI not authenticated in this
environment. No ticket IDs included in title.

🤖 Submitted by langster-patch

Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
 2026-04-20 21:47:08 -07:00
dependabot[bot] 786fe03646 chore(deps): bump vite from 7.3.2 to 8.0.5 (#2322) 2026-04-20 20:07:04 -07:00
dependabot[bot] ac9947f64d chore(deps): bump langsmith from 0.5.19 to 0.5.20 (#2323) 
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from
0.5.19 to 0.5.20.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=npm_and_yarn&previous-version=0.5.19&new-version=0.5.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-16 03:45:01 +00:00
dependabot[bot] a9db0172df chore(deps): bump hono from 4.12.12 to 4.12.14 (#2321) 
Bumps [hono](https://github.com/honojs/hono) from 4.12.12 to 4.12.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.14</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Improper handling of JSX attribute names in hono/jsx SSR</h3>
<p>Affects: hono/jsx. Fixes missing validation of JSX attribute names
during server-side rendering, which could allow malformed attribute keys
to corrupt the generated HTML output and inject unintended attributes or
elements. GHSA-458j-xx4x-4375</p>
<h2>Other changes</h2>
<ul>
<li>fix(aws-lambda): handle invalid header names in request processing
(<a
href="https://redirect.github.com/honojs/hono/issues/4883">#4883</a>)
fa2c74fe</li>
</ul>
<h2>v4.12.13</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(types): infer response type from last handler in app.on
9-/10-handler overloads by <a
href="https://github.com/T4ko0522"><code>@​T4ko0522</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4865">honojs/hono#4865</a></li>
<li>feat(trailing-slash): add <code>skip</code> option by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4862">honojs/hono#4862</a></li>
<li>feat(cache): add <code>onCacheNotAvailable</code> option by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4876">honojs/hono#4876</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/T4ko0522"><code>@​T4ko0522</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4865">honojs/hono#4865</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.13">https://github.com/honojs/hono/compare/v4.12.12...v4.12.13</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/cf2d2b7edcf07adef2db7614557f4d7f9e2be7ba"><code>cf2d2b7</code></a>
4.12.14</li>
<li><a
href="https://github.com/honojs/hono/commit/66daa2edef8965544c04fcad82c596ab2acdb5ee"><code>66daa2e</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa2c74fe5c3ce996d025d9d97bf5670c207bb82e"><code>fa2c74f</code></a>
fix(aws-lambda): handle invalid header names in request processing (<a
href="https://redirect.github.com/honojs/hono/issues/4883">#4883</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/3779927c17201dc6bfd20697f0e1ec65407da779"><code>3779927</code></a>
4.12.13</li>
<li><a
href="https://github.com/honojs/hono/commit/faa6c46a1aa3a8b792b29e20fc93bcd6d2a4d720"><code>faa6c46</code></a>
feat(cache): add <code>onCacheNotAvailable</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4876">#4876</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/f23e97b7f300bcb8571ae864010b8f7cdb5d0d5d"><code>f23e97b</code></a>
feat(trailing-slash): add <code>skip</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4862">#4862</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/1aa32fb91e7bc1366811d80ebcce61ec0d0c68cb"><code>1aa32fb</code></a>
fix(types): infer response type from last handler in app.on 9- and
10-handler...</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.14">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.12&new-version=4.12.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-15 19:45:00 -07:00
Hunter Lovell 9102d526c8 fix(langgraph): propagate tracer metadata defaults from configurable (#2315) 
## Summary

This updates Pregel callback manager initialization to pass
`tracerInheritableMetadata` defaults derived from `config.configurable`,
and narrows `ensureLangGraphConfig` metadata mirroring to the
allowlisted LangGraph identifiers used in stream/runtime metadata.

## Changes

### `@langchain/langgraph` (`libs/langgraph-core`)

- Updated Pregel callback manager setup to configure core callbacks with
`tracerInheritableMetadata` based on configurable primitive values,
excluding internal and secret-like keys.
- Hoisted tracing default logic into `_getTracingMetadataDefaults` and
`_excludeAsMetadata` for parity with the Python implementation shape.
- Restricted `ensureLangGraphConfig` configurable-to-metadata
propagation to the identifier allowlist:
  - `thread_id`
  - `checkpoint_id`
  - `checkpoint_ns`
  - `task_id`
  - `run_id`
  - `assistant_id`
  - `graph_id`
- Updated config tests to assert the narrowed metadata propagation
behavior.
 2026-04-15 18:48:41 -07:00
dependabot[bot] 7da383a8e6 chore(deps-dev): bump vite from 7.3.1 to 7.3.2 (#2297) 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite)
from 7.3.1 to 7.3.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v7.3.2</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2">7.3.2</a>
(2026-04-06)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>avoid path traversal with optimize deps sourcemap handler (<a
href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>)
(<a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7">09d8c90</a>)</li>
<li>backport <a
href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>,
apply server.fs check to env transport (<a
href="https://redirect.github.com/vitejs/vite/issues/22162">#22162</a>)
(<a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1">19db0f2</a>)</li>
<li>check <code>server.fs</code> after stripping query as well (<a
href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>)
(<a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6">f8103cc</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/cc383e07b66d4c5a9768fcb570e0af812cb8d999"><code>cc383e0</code></a>
release: v7.3.2</li>
<li><a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7"><code>09d8c90</code></a>
fix: avoid path traversal with optimize deps sourcemap handler (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6"><code>f8103cc</code></a>
fix: check <code>server.fs</code> after stripping query as well (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160">#22160</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1"><code>19db0f2</code></a>
fix: backport <a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>,
apply server.fs check to env transport (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162">#22162</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-16 01:43:26 +00:00
dependabot[bot] 5a0d0d0155 chore(deps): bump langsmith from 0.5.18 to 0.5.19 (#2319) 
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from
0.5.18 to 0.5.19.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=npm_and_yarn&previous-version=0.5.18&new-version=0.5.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-14 16:51:50 -07:00
dependabot[bot] aa2cfc8bf7 chore(deps): bump langsmith from 0.5.16 to 0.5.18 (#2307) 
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from
0.5.16 to 0.5.18.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=npm_and_yarn&previous-version=0.5.16&new-version=0.5.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-10 13:58:27 -07:00
dependabot[bot] 9c1e3278fe chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 (#2300) 
Bumps [@hono/node-server](https://github.com/honojs/node-server) from
1.19.11 to 1.19.13.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases"><code>@​hono/node-server</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.19.13</h2>
<h2>Security Fix</h2>
<p>Fixed an issue in Serve Static Middleware where inconsistent handling
of repeated slashes (<code>//</code>) between the router and static file
resolution could allow middleware to be bypassed. Users of Serve Static
Middleware are encouraged to upgrade to this version.</p>
<p>See GHSA-92pp-h63x-v22m for details.</p>
<h2>v1.19.12</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: ignore claude setting by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/314">honojs/node-server#314</a></li>
<li>fix: request draining for early 413 responses by <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/329">honojs/node-server#329</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12">https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/fd64e659a34ec661fd9ccda00d1b9dff88dfaf90"><code>fd64e65</code></a>
1.19.13</li>
<li><a
href="https://github.com/honojs/node-server/commit/025c30f55d589ddbe6048b151d77e904f67a8cc2"><code>025c30f</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/6cdb5a724952f3df5748e435637792068ebea6d9"><code>6cdb5a7</code></a>
1.19.12</li>
<li><a
href="https://github.com/honojs/node-server/commit/70250f780ec99d2ddc0dd8275a42f8e091e06e94"><code>70250f7</code></a>
fix: request draining for early 413 responses (<a
href="https://redirect.github.com/honojs/node-server/issues/329">#329</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/cfc08b330a1f2e0a2d8cc7797cde389465b5f4fb"><code>cfc08b3</code></a>
chore: ignore claude setting (<a
href="https://redirect.github.com/honojs/node-server/issues/314">#314</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.13">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-09 17:27:00 -07:00
dependabot[bot] 96a92c01a6 chore(deps): bump hono from 4.12.7 to 4.12.12 (#2301) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 14:34:47 -07:00
Christian Bromann 2b62610710 feat(sdk): support for headless tools (#2281) 2026-04-03 22:07:54 -07:00
John Kennedy 90631859ba fix: patch 7 security alerts (high+medium severity) (#2282) 
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
 2026-04-04 03:43:41 +00:00
dependabot[bot] e72c8e769e chore(deps-dev): bump the svelte group across 1 directory with 3 updates (#2272) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christian Bromann <git@bromann.dev>
 2026-04-03 09:59:39 -07:00
dependabot[bot] 2bb2ed4565 chore(deps): bump the vue group across 1 directory with 4 updates (#2273) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-04-02 00:37:15 -07:00
dependabot[bot] 271f9750f0 chore(deps): bump the langchain group across 1 directory with 7 updates (#2270) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-01 23:59:19 -07:00
dependabot[bot] 73ae630253 chore(deps): bump the angular group with 13 updates (#2271) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-01 21:30:32 -07:00
John Kennedy 4d2963c313 fix: patch 11 security alerts (critical+high severity) (#2258) 
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
 2026-03-31 13:09:10 -07:00
Christian Bromann d88f29ba25 chore(repo): migrate linting and formatting from ESLint/Prettier to oxlint/oxfmt (#2256) 
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com>
Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>
 2026-03-30 18:08:00 -07:00
dependabot[bot] 50d61a9e72 chore(deps): bump yaml from 2.8.2 to 2.8.3 (#2246) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-26 14:02:32 -07:00
Hunter Lovell bdcf290198 fix(langgraph): clean up resolved checkpointer promises to reduce memory retention (#2242) 2026-03-26 17:15:20 +00:00
Christian Bromann 5460157725 Add Angular 21 to @angular/core peer dependency range (#2217) 
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com>
 2026-03-19 23:10:38 -07:00
Christian Bromann 293cab1c55 fix(examples): react sdk dependency 2026-03-19 22:48:09 -07:00
Christian Bromann 963db6fbc7 fix(sdk): fetch subagent history (#2191) 2026-03-19 21:29:17 -07:00
Christian Bromann bd02965cdf fix(react/vue/svelte/angular): clean up Readme and dev deps (#2214) 2026-03-19 21:17:12 -07:00
dependabot[bot] b07b994043 chore(deps): bump @angular/compiler from 21.2.4 to 21.2.5 (#2212) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-19 13:35:19 -07:00
dependabot[bot] a7f4935ca6 chore(deps): bump @angular/core from 21.2.4 to 21.2.5 (#2211) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-19 13:18:53 -07:00
dependabot[bot] 6d84e2b53d chore(deps): bump @angular/core from 21.2.2 to 21.2.4 (#2184) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-15 21:11:45 -07:00
dependabot[bot] 7da8b64394 chore(deps): bump @angular/compiler from 21.2.2 to 21.2.4 (#2185) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-15 20:56:30 -07:00
Christian Bromann 6816a610df docs: add integration examples for ai elements and assistant-ui (#2180) 2026-03-13 08:09:35 -07:00
Christian Bromann a8f1b9d26b fix(checkpoint-redis): fix dependency (#2181) 2026-03-12 17:08:19 -07:00
Christian Bromann 98da019c92 fix(sdk): revert dependency between old SDK and new react package (#2168) 2026-03-10 23:41:03 -07:00
Christian Bromann b518c474f6 fix(sdk): update deps (#2162) 2026-03-10 14:31:03 -07:00
dependabot[bot] 5eb2a04b72 chore(deps): bump the minor-and-patch group across 1 directory with 4 updates (#2160) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-10 14:01:30 -07:00
dependabot[bot] 1c01ba202f chore(deps): bump the angular group with 10 updates (#2154) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-10 13:30:47 -07:00