[dependabot]

Bumps the npm_and_yarn group with 7 updates in the /projects/erp-hgrid directory:

Package	From	To
@angular/platform-server	22.1.4	22.1.6
@angular/router	22.1.4	22.2.2
brace-expansion	1.1.18	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/charts/column-chart directory:

Package	From	To
@angular/platform-server	22.1.1	22.1.6
@angular/router	22.1.1	22.2.2
brace-expansion	1.1.11	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/charts/polar-chart directory:

Package	From	To
@angular/platform-server	22.1.1	22.1.6
@angular/router	22.1.1	22.2.2
brace-expansion	1.1.11	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/charts/bar-chart directory:

Package	From	To
@angular/platform-server	22.1.1	22.1.6
@angular/router	22.1.1	22.2.2
brace-expansion	1.1.11	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/charts/line-chart directory:

Package	From	To
@angular/platform-server	22.1.1	22.1.6
@angular/router	22.1.1	22.2.2
brace-expansion	1.1.11	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/charts/step-chart directory:

Package	From	To
@angular/platform-server	22.1.1	22.1.6
@angular/router	22.1.1	22.2.2
brace-expansion	1.1.11	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/charts/pie-chart directory:

Package	From	To
@angular/platform-server	22.1.1	22.1.6
@angular/router	22.1.1	22.2.2
brace-expansion	1.1.11	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/sales-grid directory:

Package	From	To
@angular/platform-server	22.1.4	22.1.6
@angular/router	22.1.4	22.2.0
brace-expansion	1.1.11	1.1.21
brace-expansion	5.0.9	5.0.12
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/fleet-management-grid directory:

Package	From	To
@angular/platform-server	22.1.4	22.1.6
@angular/router	22.1.4	22.2.0
brace-expansion	1.1.11	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
@angular/platform-server	22.1.4	22.1.6
@angular/router	22.1.4	22.2.0
brace-expansion	1.1.12	1.1.21
brace-expansion	5.0.9	5.0.12
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/hr-portal directory:

Package	From	To
@angular/platform-server	22.1.4	22.1.6
@angular/router	22.1.4	22.2.0
brace-expansion	1.1.11	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.5	3.1.8
hono	4.13.1	4.13.13
ip-address	10.5.0	10.7.4

Bumps the npm_and_yarn group with 7 updates in the /projects/finance-grid directory:

Package	From	To
@angular/platform-server	22.1.4	22.1.6
@angular/router	22.1.4	22.2.0
brace-expansion	1.1.11	1.1.21
dompurify	3.4.13	3.4.17
fast-uri	3.1.6	3.1.8
hono	4.13.5	4.13.13
ip-address	10.5.0	10.7.4

Updates @angular/platform-server from 22.1.4 to 22.1.6

Release notes

Sourced from @​angular/platform-server's releases.

22.1.6

compiler

Commit	Description
	namespace @property declarations

compiler-cli

Commit	Description
	do not flag callable objects with zero parameters in uninvoked track function check

core

Commit	Description
	apply SkipSelf to only the starting node in embedded views

platform-server

Commit	Description
	avoid sourcemap corruption during domino path substitution

router

Commit	Description
	keep detached route subtree contexts isolated and intact

22.1.5

compiler-cli

Commit	Description
	check uninvoked signal aliases in extended diagnostic

core

Commit	Description
	cancel stale debounce timers to prevent timer leaks
	don't fail NgModule checks for a pipe that extends a base class
	validate SVG animation attributes outside the SVG namespace

forms

Commit	Description
	avoid writing to name input on ControlValueAccessor

migrations

Commit	Description
	skip tsconfig files of non-Angular projects

platform-server

Commit	Description
	resolve HTTP(S) URLs without authority as relative during SSR

router

Commit	Description
	avoid view transitions when the user agent provides one

Commits

• d20a379 fix(platform-server): avoid sourcemap corruption during domino path substitution
• 3b8723c fix(platform-server): resolve HTTP(S) URLs without authority as relative duri...
• See full diff in compare view

Updates @angular/router from 22.1.4 to 22.2.2

Release notes

Sourced from @​angular/router's releases.

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

compiler-cli

Commit	Description
	don't mark constructor parameter properties as inherited
	optimize missing directive extended checks

core

Commit	Description
	defer afterRenderEffect sequences registered while hooks run
	strip reserved character from translations
	untrack onError handler to prevent signal write exceptions

forms

Commit	Description
	don't crash when control is missing in setUpValidators
	skip class bindings for orphaned fields
	use Object.is when comparing control bindings in signal forms
	write a pending debounced value when its control is destroyed

language-service

Commit	Description
	add strictUnclaimedEventNames to angularCompilerOptions schema

router

Commit	Description
	fall back when serializing protocol-relative URLs
	remove the navigate event abort listener once it fires
	reset internal state on error handler redirect after state commit

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

... (truncated)

Commits

• 7bc6a1b refactor(router): Remove canLoad from 1p Router
• e0137cb fix(router): remove the navigate event abort listener once it fires
• fc91c72 fix(router): reset internal state on error handler redirect after state commit
• 576df28 fix(router): fall back when serializing protocol-relative URLs
• d98ee02 docs(router): note that shouldReuseRoute doesn't rerun guards and resolvers
• e9bf52a fix(router): require outlets to match a route before processing child segments
• 83abee3 Revert "fix(router): fall back when serializing protocol-relative URLs"
• 3b6796f fix(router): reject duplicate outlets in production builds
• a6e6097 fix(router): fall back when serializing protocol-relative URLs
• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.18 to 1.1.21

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• See full diff in compare view

Updates dompurify from 3.4.13 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

Commits

• a77a3e7 release: 3.4.17 (#1672)
• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• See full diff in compare view

Updates fast-uri from 3.1.5 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

• GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

• ead3ab7 Bumped v3.1.8
• c88b59e fix: normalize decoded reg-name case
• 412e40a Bumped v3.1.7
• 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
• 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• Additional commits viewable in compare view

Updates hono from 4.13.1 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
• docs(request): fix jsdoc comments for some getters in honojs/hono#5445
• fix(jsx): allow JSXNode function component results in honojs/hono#5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
• test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
• fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
• chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

... (truncated)

Commits

• 08a023c 4.13.13
• ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
• f23b146 fix(jsx): allow JSXNode function component results (#5476)
• 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
• deff529 test(client): simulate network error for undefined route in parseResponse tes...
• 6abd35b 4.13.12
• 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
• afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
• e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
• c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
• Additional commits viewable in compare view

Updates ip-address from 10.5.0 to 10.7.4

Release notes

Sourced from ip-address's releases.

v10.7.4

Full Changelog: beaugunderson/ip-address@v10.7.3...v10.7.4

v10.7.3

What's Changed

• Reject an in-addr.arpa name longer than 32 characters before splitting it by @​beaugunderson in beaugunderson/ip-address#228

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

v10.7.2

What's Changed

• Accept an arpa suffix in any case and without the root dot in fromArpa by @​beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

• Bump js-yaml and brace-expansion in the lockfile by @​beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

• Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

• Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @​beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

Commits

• 651c1dd 10.7.4
• ec80fcd Find an IPv6 zone by index so a rejected zone costs one pass
• e22eb4a Check generated docs without writing or hiding partial staging
• c7f838e 10.7.3
• 09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
• 974b48d 10.7.2
• 4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
• f0c25df 10.7.1
• 8b34a21 Merge commit from fork
• 13b6155 Merge commit from fork
• Additional commits viewable in compare view

Updates @angular/platform-server from 22.1.1 to 22.1.6

Release notes

Sourced from @​angular/platform-server's releases.

22.1.6

compiler

Commit	Description
	namespace @property declarations

compiler-cli

Commit	Description
	do not flag callable objects with zero parameters in uninvoked track function check

core

Commit	Description
	apply SkipSelf to only the starting node in embedded views

platform-server

Commit	Description
	avoid sourcemap corruption during domino path substitution

router

Commit	Description
	keep detached route subtree contexts isolated and intact

22.1.5

compiler-cli

Commit	Description
	check uninvoked signal aliases in extended diagnostic

core

Commit	Description
	cancel stale debounce timers to prevent timer leaks
	don't fail NgModule checks for a pipe that extends a base class
	validate SVG animation attributes outside the SVG namespace

forms

Commit	Description
	avoid writing to name input on ControlValueAccessor

migrations

Commit	Description
	skip tsconfig files of non-Angular projects

platform-server

Commit	Description
	resolve HTTP(S) URLs without authority as relative during SSR

router

Commit	Description
	avoid view transitions when the user agent provides one

Commits

• d20a379 fix(platform-server): avoid sourcemap corruption during domino path substitution
• 3b8723c fix(platform-server): resolve HTTP(S) URLs without authority as relative duri...
• See full diff in compare view

Updates @angular/router from 22.1.1 to 22.2.2

Release notes

Sourced from @​angular/router's releases.

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

compiler-cli

Commit	Description
	don't mark constructor parameter properties as inherited
	optimize missing directive extended checks

core

Commit	Description
	defer afterRenderEffect sequences registered while hooks run
	strip reserved character from translations
	untrack onError handler to prevent signal write exceptions

forms

Commit	Description
	don't crash when control is missing in setUpValidators
	skip class bindings for orphaned fields
	use Object.is when comparing control bindings in signal forms
	write a pending debounced value when its control is destroyed

language-service

Commit	Description
	add strictUnclaimedEventNames to angularCompilerOptions schema

router

Commit	Description
	fall back when serializing protocol-relative URLs
	remove the navigate event abort listener once it fires
	reset internal state on error handler redirect after state commit

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

... (truncated)

Commits

• 7bc6a1b refactor(router): Remove canLoad from 1p Router
• e0137cb fix(router): remove the navigate event abort listener once it fires
• fc91c72 fix(router): reset internal state on error handler redirect after state commit
• 576df28 fix(router): fall back when serializing protocol-relative URLs
• d98ee02 docs(router): note that shouldReuseRoute doesn't rerun guards and resolvers
• e9bf52a fix(router): require outlets to match a route before processing child segments
• 83abee3 Revert "fix(router): fall back when serializing protocol-relative URLs"
• 3b6796f fix(router): reject duplicate outlets in production builds
• a6e6097 fix(router): fall back when serializing protocol-relative URLs
• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.21

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• See full diff in compare view

Updates dompurify from 3.4.13 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks <...

  Description has been truncated

[ChronosSF]

@dependabot rebase

[dependabot]

Superseded by #174.