56 Commits

Include renames

Author	SHA1	Message	Date
3 people	a1a4572303	chore(deps): update npm dependencies and clean up pnpm overrides (#12592) ... # Which Problems Are Solved Several dependencies across the workspace had fallen behind their latest patch releases, and the override list in pnpm-workspace.yaml had drifted: many of the 28 entries were no longer needed because the dependency tree had already moved past them, while a few enforced outdated version floors. # How the Problems Are Solved Direct dependencies were updated where newer patch releases were available: `@angular/*` → ^21.2.19, `next` → 16.2.11 (docs and login, incl. `@next/eslint-plugin-next`), `nx` → 22.7.7, and `js-yaml` → ^4.3.1 / `postcss` → ^8.5.23 in docs. The lockfile was regenerated from scratch so all transitive dependencies resolve to the newest versions within their allowed ranges. With that in place, the override list was rebuilt down to the 8 entries that are still required because a parent package pins an older version (axios and brace-expansion via nx, postcss and sharp via next, esbuild via tsx, uuid via testcontainers, and the two OpenTelemetry packages); the other 20 overrides were removed. A verification pass confirmed the resolved versions stay at or above the floors the removed overrides used to enforce, and `pnpm audit` comes back clean. --------- Co-authored-by: Livio Spring <[email protected]>	2026-08-19 06:30:10 +00:00
3 people	bc9333aef9	chore: update npm dependencies (#12375) ... # Which Problems Are Solved - npm dependencies across the monorepo are behind current patch/minor releases. - Transitive dependencies are pinned to older versions by parent packages (karma, nx, @changesets/cli, etc.). - Console build fails after the Angular toolchain update because `angular.json` references assets outside the workspace root. # How the Problems Are Solved - Bumps `@angular/*` to `^21.2.17` in console. - Bumps `js-yaml` to `^4.2.0` in docs. - Bumps `concurrently` to `^10.0.3` in login. - Adds pnpm overrides for transitive deps that cannot be bumped directly (ws, undici, minimatch, esbuild, dompurify, qs, and others). # Additional Changes - Removes 10 overrides that are no longer needed after parent packages resolve to newer versions. - Updates 4 existing overrides (`tar`, `js-yaml`, `dompurify`, `brace-expansion`) to match current upstream ranges. - 2 low-severity findings remain via the abandoned `raw-loader` package in docs (peer dep resolution; no upstream fix without replacing `raw-loader`). - Fixes console build: replaced the `angular.json` asset glob `../apps/docs/public/img/tech` with a `prebuild` script that copies tech images into `src/assets/docs/img/tech`. **Verify at runtime that tech images on project grant / integration pages still load.** # Additional Context - Overrides remain where parent packages still pin older transitive versions. - The `angular.json` asset path issue predates this PR (not introduced by the Angular bump). --------- Co-authored-by: Livio Spring <[email protected]>	2026-07-06 14:18:51 +00:00
3 people	4dc89b499f	fix(login): allow custom protocols for native apps again (#12332) ... # Which Problems Are Solved - Native apps (mobile/desktop) use custom protocol schemes (e.g. `myapp://callback`, `io.zitadel.app://auth`) as OAuth/OIDC redirect URIs. The previous redirect-safety check in the login UI only allowed `http:`/`https:` absolute URLs, so these custom-scheme callbacks were wrongly rejected and native app login flows were broken. - Even for valid external redirects, `router.push()` triggers an RSC prefetch `fetch()` that is blocked by the CSP `connect-src 'self'` directive for non-same-origin URLs, so navigation to external/custom-protocol targets failed. - SAML and OIDC callback URLs returned from the backend were not consistently validated before being used for redirects/POSTs across the various flow entry points. # How the Problems Are Solved - Reworked `isSafeRedirectUri` to use `@braintree/sanitize-url` instead of a strict `http/https`-only allowlist. Custom protocol schemes are now permitted, while dangerous schemes (`javascript:`, `data:`, plus an explicit block of `file:`, `blob:`, `about:`) are still rejected. - Added `isExternalUrl` helper to distinguish internal relative paths (`/...`) from external/custom-protocol targets. - In `handleServerActionResponse`, external/custom-protocol redirects now navigate via `window.location.href` (full navigation) instead of `router.push()`, avoiding the CSP-blocked RSC prefetch. Internal paths continue to use `router.push()`. - Added consistent redirect-URI validation for SAML and OIDC callbacks across all relevant entry points (`oidc.ts`, `saml.ts`, `server/flow-initiation.ts` including the `prompt=none` path, and the SAML `samlData` POST case), blocking unsafe URLs with a clear warning and error response. # Additional Changes - Added `@braintree/sanitize-url` (`^7.1.2`) dependency to `apps/login` (`package.json` / `pnpm-lock.yaml`). - Added unit tests for `isExternalUrl` covering relative paths, absolute HTTP/HTTPS URLs, custom protocol schemes, and protocol-relative URLs. - Annotated the intentional `window.location.href` navigation with a CodeQL suppression comment, documenting that the URL is validated by `isSafeRedirectUri` beforehand. - Minor formatting cleanup in `console` JWT provider component. # Additional Context - This restores behavior that previously worked for native apps but regressed when redirect validation was tightened to `http`/`https` only. --------- Co-authored-by: Max Peintner <[email protected]>	2026-06-30 13:19:40 +00:00
Max PeintnerandGitHub	b27fdfc28c	chore: update dependencies (#12242) ... # Which Problems Are Solved Fixes multiple high-severity Dependabot alerts for transitive dependencies (axios, protobufjs, systeminformation, tmp, fast-uri, @babel/plugin-transform-modules-systemjs). # How the Problems Are Solved **Direct dependency updates:** - `@opentelemetry/*` 0.217 → 0.218 in login (new otlp-transformer dropped protobufjs as direct dep) - `posthog-js` 1.374 → 1.380 in console (dropped the OpenTelemetry/protobufjs chain entirely) **pnpm overrides** for remaining transitive deps that can't be updated via their parents (all pulled by the gRPC stack, Cypress, karma, nx, or ajv): - `axios` → ≥1.17.0 (prototype pollution, proxy bypass) - `protobufjs` → ≥7.5.7 / ≥8.0.2 (code injection, prototype pollution, DoS) - `systeminformation` → ≥5.31.6 (command injection) - `tmp` → ≥0.2.6 (path traversal) - `fast-uri` → ≥3.1.2 (path traversal, host confusion) **Benchmark:** refreshed `package-lock.json` to resolve @babel and fast-uri alerts.	2026-06-09 16:27:12 +02:00
4 people	cdc6c43d09	fix: update dependencies (#12216) ... # Which Problems Are Solved Fixes open vulnerabilities # How the Problems Are Solved Updated npm/js dependencies across console, new login v2, and docs Based on https://github.com/zitadel/zitadel/pull/12164 --------- Co-authored-by: conblem <[email protected]> Co-authored-by: Livio Spring <[email protected]>	2026-06-04 14:33:04 +02:00
4 people	349451b028	chore(deps): bump the console group across 1 directory with 31 updates (#12183) ... Bumps the console group with 31 updates in the /console directory: | Package | From | To | | --- | --- | --- | | [@angular/animations](https://github.com/angular/angular/tree/HEAD/packages/animations) | `21.2.10` | `21.2.13` | | [@angular/cdk](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.10` | `21.2.13` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.10` | `21.2.13` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.10` | `21.2.13` | | [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `21.2.10` | `21.2.13` | | [@angular/material](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/material-moment-adapter](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `21.2.10` | `21.2.13` | | [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) | `21.2.10` | `21.2.13` | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `21.2.10` | `21.2.13` | | [@angular/service-worker](https://github.com/angular/angular/tree/HEAD/packages/service-worker) | `21.2.10` | `21.2.13` | | [@tanstack/angular-query-experimental](https://github.com/TanStack/query/tree/HEAD/packages/angular-query-experimental) | `5.100.5` | `5.100.11` | | [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) | `1.12.42` | `1.13.2` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.372.3` | `1.374.2` | | [zone.js](https://github.com/angular/angular/tree/HEAD/packages/zone.js) | `0.16.1` | `0.16.2` | | [@angular-eslint/eslint-plugin](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin) | `21.3.1` | `21.4.0` | | [@angular-eslint/eslint-plugin-template](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin-template) | `21.3.1` | `21.4.0` | | [@angular-eslint/template-parser](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/template-parser) | `21.3.1` | `21.4.0` | | [@angular/build](https://github.com/angular/angular-cli) | `21.2.8` | `21.2.11` | | [@angular/cli](https://github.com/angular/angular-cli) | `21.2.8` | `21.2.11` | | [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `21.2.10` | `21.2.13` | | [@angular/language-service](https://github.com/angular/angular/tree/HEAD/packages/language-service) | `21.2.10` | `21.2.13` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.4` | `4.3.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.9.1` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.59.1` | `8.59.4` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.59.1` | `8.59.4` | | [eslint](https://github.com/eslint/eslint) | `10.2.1` | `10.4.0` | | [globals](https://github.com/sindresorhus/globals) | `17.5.0` | `17.6.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.15` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.4` | `4.3.0` | Updates `@angular/animations` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/animations's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/animations's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/animations">compare view</a></li> </ul> </details> <br /> Updates `@angular/cdk` from 21.2.8 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/components/releases">@​angular/cdk's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <p>No user facing changes in this release</p> <h2>21.2.10</h2> <h3>aria</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><img src="https://img.shields.io/badge/48973661e-fix-green" alt="fix - 48973661e" /></a></td> <td><strong>menu:</strong> do not set default aria-label (<a href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>material</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/51271c6194a9b55ee847c566a8960c9be5ec7cce"><img src="https://img.shields.io/badge/51271c619-fix-green" alt="fix - 51271c619" /></a></td> <td><strong>stepper:</strong> allow stepper to be labelled (<a href="https://redirect.github.com/angular/components/issues/33137">#33137</a>)</td> </tr> </tbody> </table> <h3>cdk</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/3a3852d45a4bbcfb23b46ca00e0eba1d70081ba3"><img src="https://img.shields.io/badge/3a3852d45-fix-green" alt="fix - 3a3852d45" /></a></td> <td><strong>tree:</strong> enter/space key on child node should not toggle parent node expansion (<a href="https://redirect.github.com/angular/components/issues/33125">#33125</a>)</td> </tr> </tbody> </table> <h3>aria</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/bf14cc9d9fd349974cba853d4747b6859b3aae5b"><img src="https://img.shields.io/badge/bf14cc9d9-fix-green" alt="fix - bf14cc9d9" /></a></td> <td><strong>menu:</strong> use computed for menu item patterns, with trigger on visible (<a href="https://redirect.github.com/angular/components/issues/33118">#33118</a>)</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/components/blob/main/CHANGELOG.md">@​angular/cdk's changelog</a>.</em></p> <blockquote> <h1>21.2.11 &quot;crystal ball&quot; (2026-05-13)</h1> <p>No user facing changes in this release</p> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.8 &quot;plastic-wallaby&quot; (2026-05-06)</h1> <h2>Breaking Changes</h2> <h3>aria</h3> <ul> <li> <p>The legacy combobox and autocomplete implementations have been removed. Use the new standalone combobox instead.</p> <ul> <li>feat(aria/combobox): promote simple-combobox to stable un-prefixed combobox</li> </ul> <ul> <li>Relocates public, private, and example directories to clean <code>combobox</code> entry points.</li> <li>Renames internal layout symbols, selectors, and uppercase tokens (<code>SIMPLE_COMBOBOX_POPUP</code> -&gt; <code>COMBOBOX_POPUP</code>).</li> <li>Establishes full documentation extraction parity with the <code>json_api</code> Bazel rule target.</li> <li>Standardizes the accompanying toolbar component showcase into the clean <code>aria-toolbar</code> path.</li> <li>Re-routes dev-app navigation links and migrates public API golden records.</li> </ul> </li> <li> <p><code>SimpleCombobox</code> has been promoted to <code>Combobox</code>. All <code>simple-combobox</code> prefixed symbols, selectors, and tokens have been renamed to use the <code>combobox</code> prefix.</p> <ul> <li>refactor(aria/combobox): relocate and restructure autocomplete and toolbar examples Relocate the autocomplete examples to <code>src/components-examples/aria/autocomplete</code> and toolbar examples to <code>src/components-examples/aria/toolbar</code>.</li> </ul> <ul> <li>Restore naming continuity with the historical codebase by stripping redundant prefixes from example filenames and component selectors.</li> <li>Sync dev-app preview routing layout paths and strict Bazel target dependency links.</li> </ul> </li> </ul> <h3>cdk</h3> <ul> <li> <ul> <li><code>CDK_DESCRIBEDBY_HOST_ATTRIBUTE</code> has been removed.</li> <li><code>CDK_DESCRIBEDBY_ID_PREFIX</code> has been removed.</li> <li>The <code>injector</code> parameter of the <code>ConfigurableFocusTrap</code> and <code>FocusTrap</code> constructors is now required.</li> <li>The boolean parameter of <code>ConfigurableFocusTrapFactory.create</code> has been replaced with a config object.</li> <li><code>MESSAGES_CONTAINER_ID</code> has been removed.</li> </ul> </li> <li> <ul> <li>The <code>event</code> parameter of <code>DropListRef.drop</code> is now required.</li> </ul> </li> <li> <ul> <li><code>ContextMenuTracker</code> has been renamed to <code>MenuTracker</code>.</li> </ul> </li> </ul> <h3>material</h3> <ul> <li> <ul> <li><code>MatListOption.checkboxPosition</code> has been removed. use <code>togglePosition</code> instead.</li> <li><code>MatListOptionCheckboxPosition</code> has been renamed to <code>MatListOptionTogglePosition</code>.</li> </ul> </li> <li> <ul> <li><code>ArrowViewState</code> has been removed.</li> <li><code>ArrowViewStateTransition</code> has been removed.</li> </ul> </li> </ul> <h3>google-maps</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/b8201edeef62258c3d1e1ebeaf8ee14766918c22">b8201edee</a></td> <td>fix</td> <td>deprecate heatmap layer (<a href="https://redirect.github.com/angular/components/pull/33208">#33208</a>)</td> </tr> </tbody> </table> <h3>material</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/add8f16c01ad683b9e2ab9e1bf5ad3a984dd9921">add8f16c0</a></td> <td>fix</td> <td><strong>list:</strong> breaking changes for v22</td> </tr> <tr> <td><a href="https://github.com/angular/components/commit/9d73c98b57d46454d51344bbd59055bc06dabc6b">9d73c98b5</a></td> <td>fix</td> <td><strong>menu:</strong> missing panelClass getter (<a href="https://redirect.github.com/angular/components/pull/33191">#33191</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/components/commit/75718e4fbebce2a7f8aa30550a12d58a5a6f9b93">75718e4fb</a></td> <td>fix</td> <td><strong>sort:</strong> breaking changes for v22</td> </tr> </tbody> </table> <h3>cdk</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/components/commit/1238d1573e706cbf0a2cabcc97e59d28a9499ecb"><code>1238d15</code></a> release: cut the v21.2.11 release</li> <li><a href="https://github.com/angular/components/commit/583da8a564dcb667cb8928e79d286eadee0a5013"><code>583da8a</code></a> release: cut the v21.2.10 release</li> <li><a href="https://github.com/angular/components/commit/babfbb7430547d5f4558174aec1a07ce6c67a26f"><code>babfbb7</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33205">#33205</a>)</li> <li><a href="https://github.com/angular/components/commit/e08fdf2a6a120078b512043bf5804bc3c7f9716a"><code>e08fdf2</code></a> build: fix failing test (<a href="https://redirect.github.com/angular/components/issues/33212">#33212</a>)</li> <li><a href="https://github.com/angular/components/commit/09e89fa188f157c0892019a461459cd9a252a673"><code>09e89fa</code></a> build: lock file maintenance (<a href="https://redirect.github.com/angular/components/issues/33201">#33201</a>)</li> <li><a href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><code>4897366</code></a> fix(aria/menu): do not set default aria-label (<a href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</li> <li><a href="https://github.com/angular/components/commit/a6c5b72562b9d46ea3c10a2ecb668e013b46a103"><code>a6c5b72</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33181">#33181</a>)</li> <li><a href="https://github.com/angular/components/commit/b7c34e306539716a1222468907ad4af5fb6b1aee"><code>b7c34e3</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33160">#33160</a>)</li> <li><a href="https://github.com/angular/components/commit/58e29cf1aa8265d6041350c716c5fbfa9e25b738"><code>58e29cf</code></a> build: update dependency bazel_lib to v3.3.1 (<a href="https://redirect.github.com/angular/components/issues/33177">#33177</a>)</li> <li><a href="https://github.com/angular/components/commit/e2f16ac34e93e69b1ef960ba70c517de799d05cc"><code>e2f16ac</code></a> build: update pnpm to v10.33.2 (<a href="https://redirect.github.com/angular/components/issues/33165">#33165</a>)</li> <li>Additional commits viewable in <a href="https://github.com/angular/components/compare/v21.2.8...v21.2.11">compare view</a></li> </ul> </details> <br /> Updates `@angular/common` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/common's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/common's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/30cf85f71c52683016200ecf6d68b4418084ee6e"><code>30cf85f</code></a> refactor(common): update deprecation message</li> <li><a href="https://github.com/angular/angular/commit/42d57c35781fb65fc4d44df59b6a85287664216a"><code>42d57c3</code></a> refactor(common): fix viewport tests</li> <li><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><code>10ad3c0</code></a> fix(common): prevent focus from scrollToAnchor</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/common">compare view</a></li> </ul> </details> <br /> Updates `@angular/compiler` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/compiler's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/compiler's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/baf92da96ed73a0f4748edf05d3c0702cab219da"><code>baf92da</code></a> test: remove invalid css that was causing issues with the postcss parser</li> <li><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a> fix(core): disallow event attribute bindings in host bindings unconditionally</li> <li><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><code>4f5d8a2</code></a> fix(compiler): let declaration span not including end character</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/compiler">compare view</a></li> </ul> </details> <br /> Updates `@angular/core` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/core's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/core's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a> fix(core): disallow event attribute bindings in host bindings unconditionally</li> <li><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><code>9e38ed7</code></a> fix(core): sanitizer typings</li> <li><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><code>3430251</code></a> fix(core): i18n flags leaking on errors</li> <li><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><code>c37f6ca</code></a> fix(core): visit ng-let expression value in signal migration schematics</li> <li><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><code>fe13bb6</code></a> fix(core): allow explicit read generic with signal input transforms</li> <li><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><code>7a05a9a</code></a> fix(core): validate security-sensitive attributes in i18n bindings</li> <li><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><code>1aeebbe</code></a> fix(core): respect ngSkipHydration on components with projectable nodes in LC...</li> <li><a href="https://github.com/angular/angular/commit/4900e453e1a2e9351ad2672a804d876ff5a62968"><code>4900e45</code></a> build: update cross-repo angular dependencies</li> <li><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><code>a40e2ce</code></a> fix(core): fix ordering of view queries metadata in JIT mode</li> <li><a href="https://github.com/angular/angular/commit/9bcbf376413632590ef1fb1cebe68d049d9bd45b"><code>9bcbf37</code></a> refactor(core): fix bundling symbol test</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/core">compare view</a></li> </ul> </details> <br /> Updates `@angular/forms` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/forms's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/forms's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https:... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marco A. <[email protected]>	2026-05-25 11:14:11 +02:00
4 people	64737bfedf	chore: deps update (#12114) ... <!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved Outdated depdencies # How the Problems Are Solved This PR mostly just updates our NPM depdencies to the newest feature releases. The UUID package was update to version 14, the changelog only includes changes to the supported node version. # Additional Changes Replace tsx for some scripts in the docs. --------- Co-authored-by: Livio Spring <[email protected]> Co-authored-by: Max Peintner <[email protected]>	2026-04-30 14:02:28 +00:00
3 people	dd9dcf9f72	feat(console): improve org search performance in create project grant page #11121 (#12057) ... <!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved When creating a new Project Grant in the Zitadel console, the UI becomes extremely sluggish/unusable. The issue appears tied to the organization search dropdown attempting to load a very large dataset. # How the Problems Are Solved The refactored `SearchOrgAutocompleteComponent` uses server side filtering and ondemand loading using infinite scrolling. This makes sure on a subset of organizations is ever loaded on the client. # Additional Changes - Added tailwindcss for easier styling - Removed build warnings - Removed some of the SCSS syntax warnings # Additional Context - Closes #11121 --------- Co-authored-by: Max Peintner <[email protected]>	2026-04-22 11:46:27 +02:00
3 people	7d231b43d4	fix(login): replace custom SWR cache with lru-cache (#11945) ... # Which Problems Are Solved The in-memory SWR promiseCache in zitadel.ts used keys like getBrandingSettings-${org} that had no instance identifier. In multi-tenant mode, where a single Next.js process serves multiple instances, an instance A's cached settings without org context (branding, languages, settings, etc.) could be served to Instance B request without org context. The cache now additionally is bound to 100 entries by default (configurable via maxSize in `API_CACHE_CONFIG`). When capacity is exceeded, expired entries are swept first It additionally replaces the hand-rolled PromiseCache (Map-based, FIFO eviction) with lru-cache, leveraging its built-in fetchMethod for stale-while-revalidate, request deduplication, and true LRU eviction. # How the Problems Are Solved Added an instanceCacheKey() helpe that prefixes every cache key with serviceConfig.instanceHost in addition to the org context if available. --------- Co-authored-by: Ramon <[email protected]>	2026-04-13 11:19:50 +02:00
RamonandGitHub	5abb51c263	chore: deps update (#11981) ... # Which Problems Are Solved After merging #11968 and rechecking the dependabot alerts there are still some issues leftover. # How the Problems Are Solved This pr makes overrides for vulnerable transitive depdencies to force update to safe versions. It also upgrades the next.js version in the docs and I also ran `pnpm update` once more. # Additional Changes Removed the mochaawesome dependency is this is not really needed and seems unmaintained. # Additional Context - Precursor: #11968	2026-04-07 14:14:12 +02:00
3 people	0945195f68	chore: deps update (#11968) ... # Which Problems Are Solved This pr updates major and minor dependencies and is the first step on getting our dependabot alerts cut down. # How the Problems Are Solved Depedency updates across the board eg: - Upgrade Angular to v21 - Upgrade next.js to v16.2 - Upgrade tailwind to v4 in the login - Upgrade vitest to v4 in the login This is an uncompleted list refer to the changed files for a full overview of all the updates. # Additional Changes Migrated all control flow in the console to the modern control flow syntax. Fixed the dependsOn setting for the @zitadel/login:test-unit nx target. # Additional Context - Closes https://github.com/zitadel/zitadel/issues/11274 --------- Co-authored-by: Max Peintner <[email protected]>	2026-04-02 15:53:08 +02:00
Max PeintnerandGitHub	dad4565d5d	fix: tar, rollup vulnerabilities (#11889) ... # Which Problems Are Solved Add pnpm overrides to resolve two security vulnerabilities in transitive dependencies: node-tar (CVE-2026-23745): Arbitrary file overwrite and symlink poisoning via insufficient path sanitization — fixed by overriding to >=7.5.3 Rollup 4 (#477): Arbitrary file write via path traversal — fixed by overriding to >=4.59.0 # How the Problems Are Solved applied overrides in package.json	2026-03-20 11:24:36 +01:00
3 people	a864434b4b	feat(login): update to nextjs 16, improve caching, change default colors (#11629) ... # Which Problems Are Solved Updated the project to use the latest versions of Next.js and React, and implemented a SWR caching strategy for key settings API calls to improve performance. Adjusted configuration to ensure compatibility with Next.js 16. # How the Problems Are Solved - Updated next to 16.1.6, react & react-dom to 19.2.4, and next-intl to 4.8.3. - Implemented `API_CACHE_ENABLED` and `API_CACHE_CONFIG` (replacing deprecated unstable_cacheLife) for: - getBrandingSettings - getSecuritySettings - getPasswordComplexitySettings - getLoginSettings ... - Updated default theme colors from blue to a more neutral black and white # Additional changes - Updated login docker image to node 24 --------- Co-authored-by: Ramon <[email protected]>	2026-03-17 16:01:50 +01:00
3 people	fca2589fc3	fix(login): http 2 memory leak's (#11830) ... # Which Problems Are Solved All http 2 based connect-es clients caused memory leaks in our testing using the login v2 application as the host. # How the Problems Are Solved Switch to connect-rpc based http 1.1 transport for the login v2 # Additional Changes Improved the otel interceptor implementation and tests. # Additional Context - connect-rpc is only enabled for v2 API's so we have to make sure to not use any v1 apis in the login but this should be the case anyways. - Discussion #10562 --------- Co-authored-by: Max Peintner <[email protected]>	2026-03-17 14:29:21 +00:00
5 people	c1be72765c	chore(login): remove integration tests (#11608) ... # Which Problems Are Solved Removes the Cypress integration tests and associated configuration from the apps/login project to streamline the build process. # How the Problems Are Solved - Removed cypress directory, integration directory, and cypress.config.ts from apps/login. - Updated project.json to remove test-integration targets and dependencies. - Updated package.json to remove the cypress dev dependency and clean script reference. - Updated tsconfig.json to remove the now-redundant integration exclusion. - Ensured acceptance tests are preserved and correctly excluded from build inputs. --------- Co-authored-by: Florian Forster <[email protected]> Co-authored-by: Copilot <[email protected]> Co-authored-by: conblem <[email protected]>	2026-03-17 14:16:39 +00:00
Fabienne BühlerandGitHub	9a4530bf77	docs: Add note for updated terminology (#11802) ... # Which Problems Are Solved For existing customers it could be hard to understand the new aligned terms we have defined, if they are already used to the "old term" # How the Problems Are Solved Adding notes at the top of docs pages to state clearliy new and old terms.	2026-03-16 09:10:48 +00:00
Vitor Bari BucciantiandGitHub	e664d8d04e	chore(deps): upgrade fumadocs (#11787) ... # Which Problems Are Solved Request builder in the API docs does not render oneOf variants: https://github.com/fuma-nama/fumadocs/issues/3063 [Before](https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.CreateUser): <img width="1211" height="965" alt="Screenshot 2026-03-09 at 10 01 54" src="https://github.com/user-attachments/assets/562d2e8f-99e0-438a-96fb-8b3c57d94c85" /> # How the Problems Are Solved Fixed upstream: https://github.com/fuma-nama/fumadocs/commit/440a7efaec4453692a287fe4f75b824c395adfb9 [After](https://docs-coodtipmk-zitadel.vercel.app/docs/reference/api/user/zitadel.user.v2.UserService.CreateUser): <img width="1155" height="1003" alt="Screenshot 2026-03-09 at 10 02 40" src="https://github.com/user-attachments/assets/f503330e-17f8-43ef-8f79-2d8a488794cf" /> # Additional Changes n/a # Additional Context Relates to #11784	2026-03-12 15:12:05 +01:00
Mridang AgarwallaandGitHub	7cdee1703f	chore: standardised the eslint config structure accross the project (#11814)	2026-03-12 11:02:52 +01:00
Mridang AgarwallaandGitHub	3f3413a230	feat(login): added support for otel push-based logs, metrics, and traces (#11429)	2026-03-04 15:58:56 +05:30
4 people	850adc0da4	docs(deps): update fumadocs to latest versions (#11692) ... ## Summary Updates fumadocs packages to their latest versions: | Package | Before | After | |---------|--------|-------| | `fumadocs-core` | 16.6.3 | 16.6.5 | | `fumadocs-ui` | 16.6.3 | 16.6.5 | | `fumadocs-mdx` | 14.2.7 | 14.2.8 | | `fumadocs-openapi` | 10.3.6 | 10.3.11 | See https://github.com/fuma-nama/fumadocs/releases for full changelogs. Co-authored-by: Copilot <[email protected]> Co-authored-by: Federico Coppede <[email protected]>	2026-02-26 06:21:56 +00:00
3 people	bac224c56d	chore: improve docker compose template, tests and docs (#11593) ... Replaces the single-file `docker-compose.yaml` quickstart with a production-aware, Traefik-based compose pack in `deploy/compose/`. The pack covers the full arc from a 2-minute localhost quickstart to a hardened homelab or semi-production deployment. ### What's in the pack **Stack**: Traefik (proxy) → ZITADEL API (Go `:8080`) + ZITADEL Login (Next.js `:3000`) → PostgreSQL All HTTP/gRPC routing is handled by Traefik via Docker labels — no manual proxy config needed. The Login V2 UI is enabled by default. Login URLs are derived automatically from `ZITADEL_DOMAIN`, `ZITADEL_EXTERNALPORT`, and `ZITADEL_PUBLIC_SCHEME` — no separate URL variables needed. **Compose files** | File | Purpose | |------|---------| | `docker-compose.yml` | Base stack — works standalone. Uses explicit `name: zitadel` network for reliable Traefik service discovery. | | `docker-compose.mode-letsencrypt.yml` | TLS overlay: ACME HTTP challenge | | `docker-compose.mode-external-tls.yml` | TLS overlay: upstream LB/CDN terminates TLS. Uses `forwardedHeaders.trustedIPs` (configurable via `TRAEFIK_TRUSTED_IPS`) instead of `insecure=true`. | | `docker-compose.mode-local-tls.yml` | TLS overlay: self-signed certs for LAN | | `docker-compose.prodlike.yml` | Splits init / setup / start for controlled upgrades | | `docker-compose.test.yml` | CI overlay: swaps images to locally-built `:local` tags | **Optional profiles**: `cache` (Redis), `observability` (OpenTelemetry Collector) ### Build infra - New `@zitadel/api:pack` and `@zitadel/login:pack` Nx targets build local Docker images (`zitadel/zitadel:local`, `zitadel/zitadel-login:local`) for use in CI and local testing - `apps/api/Dockerfile` now accepts a `BINARY` build arg so local and release builds share the same image ### Testing - New `@zitadel/compose` Nx project with targets: `test-config` (validates all overlay combinations using `--quiet`), `test-run` (starts full stack with local images), `test-e2e` (Playwright wiring + protocol matrix tests through Traefik), `test-full` (end-to-end: build → start → test → teardown), `stop` - **`@zitadel/compose` is explicitly excluded from `nx affected` in CI for now** — the full stack smoke test requires a Docker daemon and significant resources. The intent is to add a dedicated `compose_smoke_test` CI job in a follow-up. The targets can be run locally with `pnpm nx run @zitadel/compose:test-full`. ### Documentation - **`compose.mdx`**: Complete rewrite with a staged structure (Stage 1 Quickstart → Stage 2 Homelab → Stage 3 Beyond Compose). Documents TLS modes, profiles, secrets hardening, ExternalDomain/Port/Secure invariant, upgrades, and the path to Kubernetes - **New `requirements.mdx`**: Lists supported PostgreSQL versions (14–18), Redis (standalone), Docker Compose v2.x, and reverse proxy h2c requirements - **`reverse_proxy.mdx`**: Added intro covering h2c requirements, TLS modes table, and Login UI routing split - **`troubleshooting.mdx`**: New sections for container restarts on upgrade, FIRSTINSTANCE env vars not taking effect, and diagnosing unhealthy containers - **`caddy/index.mdx`**: Known issue and workaround for the `TE: trailers` header hang - Removed the old `apps/docs/content/self-hosting/deploy/docker-compose.yaml` embedded in the docs ### Breaking change The old `apps/docs/content/self-hosting/deploy/docker-compose.yaml` file is deleted. The getting-started docs page (`/self-hosting/deploy/compose`) now points to the new pack via a `curl | tar` download command. --- ### Checklist - [x] `deploy/compose/` smoke test passes end-to-end locally (`pnpm nx run @zitadel/compose:test-full`) - [x] Docs build passes (`pnpm nx run @zitadel/docs:build`) - [ ] Follow-up issue created to add `compose_smoke_test` CI job --------- Co-authored-by: Mridang Agarwalla <[email protected]>	2026-02-24 16:33:12 -08:00
dependabot[bot]andGitHub	87aae1b5fc	chore(deps): bump the prod group across 1 directory with 16 updates (#11615)	2026-02-24 00:07:34 +00:00
Florian ForsterandGitHub	9dd2773e80	chore(build): enhance proto caching and install binary plugins for improved performance, remove reliance on BSR (#11634)	2026-02-19 08:04:17 +00:00
6 people	93c6099482	chore(deps-dev): bump the dev group across 1 directory with 13 updates (#11548) ... Bumps the dev group with 13 updates in the /apps/docs directory: | Package | From | To | | --- | --- | --- | | [@bufbuild/buf](https://github.com/bufbuild/buf) | `1.61.0` | `1.65.0` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.2` | `10.0.1` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.1.17` | `4.1.18` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.7` | `25.2.3` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.54.0` | `8.55.0` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.54.0` | `8.55.0` | | [eslint](https://github.com/eslint/eslint) | `8.57.1` | `10.0.0` | | [glob](https://github.com/isaacs/node-glob) | `11.0.3` | `13.0.2` | | [globals](https://github.com/sindresorhus/globals) | `17.2.0` | `17.3.0` | | [next-validate-link](https://github.com/fuma-nama/next-validate-link) | `1.6.3` | `1.6.4` | | [semver](https://github.com/npm/node-semver) | `7.7.3` | `7.7.4` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `3.4.14` | `4.1.18` | | [yaml-loader](https://github.com/eemeli/yaml-loader) | `0.8.1` | `0.9.0` | Updates `@bufbuild/buf` from 1.61.0 to 1.65.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/bufbuild/buf/releases"><code>@​bufbuild/buf</code>'s releases</a>.</em></p> <blockquote> <h2>v1.65.0</h2> <ul> <li>Add <code>buf registry policy {commit,create,delete,info,label,settings}</code> commands to manage BSR policies.</li> <li>Add LSP deprecate code action to add the deprecated option on types and symbols.</li> <li>Fix import LSP document link to not include <code>import</code> keyword.</li> <li>Update <code>PROTOVALIDATE</code> lint rule to support checking unenforceable <code>required</code> rules on <code>repeated.items</code>, <code>map.keys</code> and <code>map.values</code>.</li> <li>Add <code>buf source edit deprecate</code> command to deprecate types by setting the <code>deprecate = true</code> option.</li> </ul> <h2>v1.64.0</h2> <ul> <li>Fix LSP completion for options.</li> <li>Add LSP document highlighting support.</li> <li>Add LSP completion for fully-qualified type references.</li> <li>Improve LSP semantic tokens implementation (for syntax highlighting).</li> <li>Add LSP organize imports code action to add missing imports, remove unused imports, and sort imports alphabetically.</li> <li>Add LSP document link support.</li> <li>Add LSP folding range support.</li> <li>Update <code>PROTOVALIDATE</code> lint rule to support checking <code>cel_expression</code> fields for valid CEL.</li> </ul> <h2>v1.63.0</h2> <ul> <li>Update <code>PROTOVALIDATE</code> lint rule to support field mask rules.</li> <li>Add LSP completion for field numbers.</li> </ul> <h2>v1.62.1</h2> <ul> <li>Fix default behavior for <code>swift_prefix</code> to remain unset when no override is provided in managed mode.</li> </ul> <h2>v1.62.0</h2> <ul> <li>Add <code>swift_prefix</code> to managed mode.</li> <li>Add <code>textDocument/rename</code> and <code>textDocument/prepareRename</code> support for <code>buf lsp serve</code>.</li> <li>Fix panic in LSP for empty option paths.</li> <li>Fix support for multi-arch image manifests for <code>buf beta registry plugin push</code>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/bufbuild/buf/blob/main/CHANGELOG.md"><code>@​bufbuild/buf</code>'s changelog</a>.</em></p> <blockquote> <h2>[v1.65.0] - 2026-02-03</h2> <ul> <li>Add <code>buf registry policy {commit,create,delete,info,label,settings}</code> commands to manage BSR policies.</li> <li>Add LSP deprecate code action to add the deprecated option on types and symbols.</li> <li>Fix import LSP document link to not include <code>import</code> keyword.</li> <li>Update <code>PROTOVALIDATE</code> lint rule to support checking unenforceable <code>required</code> rules on <code>repeated.items</code>, <code>map.keys</code> and <code>map.values</code>.</li> <li>Add <code>buf source edit deprecate</code> command to deprecate types by setting the <code>deprecate = true</code> option.</li> </ul> <h2>[v1.64.0] - 2026-01-19</h2> <ul> <li>Fix LSP completion for options.</li> <li>Add LSP document highlighting support.</li> <li>Add LSP completion for fully-qualified type references.</li> <li>Improve LSP semantic tokens implementation (for syntax highlighting).</li> <li>Add LSP organize imports code action to add missing imports, remove unused imports, and sort imports alphabetically.</li> <li>Add LSP document link support.</li> <li>Add LSP folding range support.</li> <li>Update <code>PROTOVALIDATE</code> lint rule to support checking <code>cel_expression</code> fields for valid CEL.</li> </ul> <h2>[v1.63.0] - 2026-01-06</h2> <ul> <li>Update <code>PROTOVALIDATE</code> lint rule to support field mask rules.</li> <li>Add LSP completion for field numbers.</li> </ul> <h2>[v1.62.1] - 2025-12-29</h2> <ul> <li>Fix default behavior for <code>swift_prefix</code> to remain unset when no override is provided in managed mode.</li> </ul> <h2>[v1.62.0] - 2025-12-29</h2> <ul> <li>Add <code>swift_prefix</code> to managed mode.</li> <li>Add <code>textDocument/rename</code> and <code>textDocument/prepareRename</code> support for <code>buf lsp serve</code>.</li> <li>Fix panic in LSP for empty option paths.</li> <li>Fix support for multi-arch image manifests for <code>buf beta registry plugin push</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/bufbuild/buf/commit/5155f6174d9a74aa2668b0ba0ac26a84ed15ba7e"><code>5155f61</code></a> Release v1.65.0 (<a href="https://redirect.github.com/bufbuild/buf/issues/4316">#4316</a>)</li> <li><a href="https://github.com/bufbuild/buf/commit/772be42e9f75a76af4a9b265590fddc6f61cac96"><code>772be42</code></a> Update alpine image (<a href="https://redirect.github.com/bufbuild/buf/issues/4315">#4315</a>)</li> <li><a href="https://github.com/bufbuild/buf/commit/84520721570c729ace25fa5d69061ac7fcf478e3"><code>8452072</code></a> Add buf source edit deprecate command (<a href="https://redirect.github.com/bufbuild/buf/issues/4306">#4306</a>)</li> <li><a href="https://github.com/bufbuild/buf/commit/1596cdd76486c928ed4f985e30d7b766a4c6815c"><code>1596cdd</code></a> Add tags to LSP diagnostics (<a href="https://redirect.github.com/bufbuild/buf/issues/4311">#4311</a>)</li> <li><a href="https://github.com/bufbuild/buf/commit/7b0cdfd737db299bffbe1f79e61fa8cadb6382ba"><code>7b0cdfd</code></a> Make upgrade (<a href="https://redirect.github.com/bufbuild/buf/issues/4314">#4314</a>)</li> <li><a href="https://github.com/bufbuild/buf/commit/16e09a1373cc1b7cb4a641fe41c5509d0c40732c"><code>16e09a1</code></a> Fix edge case in LSP symbol doc hover (<a href="https://redirect.github.com/bufbuild/buf/issues/4310">#4310</a>)</li> <li><a href="https://github.com/bufbuild/buf/commit/08df2b35ef620d7ec4b09afb6e6c01ed56224b18"><code>08df2b3</code></a> Update <code>PROTOVALIDATE</code> lint rule to check unenforceable required rules (<a href="https://redirect.github.com/bufbuild/buf/issues/4309">#4309</a>)</li> <li><a href="https://github.com/bufbuild/buf/commit/4899175426b22dc3344452ca9e5e407d2a94e262"><code>4899175</code></a> Fix import LSP document link to not include <code>import</code> keyword (<a href="https://redirect.github.com/bufbuild/buf/issues/4308">#4308</a>)</li> <li><a href="https://github.com/bufbuild/buf/commit/15d712bc3de6ee522fa95a371b4db9d8f2ac6f2a"><code>15d712b</code></a> Add LSP code action for deprecating symbols (<a href="https://redirect.github.com/bufbuild/buf/issues/4299">#4299</a>)</li> <li><a href="https://github.com/bufbuild/buf/commit/2bdc2170adbc5fb9e24e4d36b85e8a2474aa6775"><code>2bdc217</code></a> Separate deprecated types in protostat (<a href="https://redirect.github.com/bufbuild/buf/issues/4307">#4307</a>)</li> <li>Additional commits viewable in <a href="https://github.com/bufbuild/buf/compare/v1.61.0...v1.65.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by [GitHub Actions](<a href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a> Actions), a new releaser for <code>@​bufbuild/buf</code> since your current version.</p> </details> <br /> Updates `@eslint/js` from 9.39.2 to 10.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslint/releases"><code>@​eslint/js</code>'s releases</a>.</em></p> <blockquote> <h2>v10.0.0</h2> <h2>Breaking Changes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/f9e54f43a5e497cdfa179338b431093245cb787b"><code>f9e54f4</code></a> feat!: estimate rule-tester failure location (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20420">#20420</a>) (ST-DDT)</li> <li><a href="https://github.com/eslint/eslint/commit/a176319d8ade1a7d9b2d7fb8f038f55a2662325f"><code>a176319</code></a> feat!: replace <code>chalk</code> with <code>styleText</code> and add <code>color</code> to <code>ResultsMeta</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20227">#20227</a>) (루밀LuMir)</li> <li><a href="https://github.com/eslint/eslint/commit/c7046e6c1e03c4ca0eee4888a1f2eba4c6454f84"><code>c7046e6</code></a> feat!: enable JSX reference tracking (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20152">#20152</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/fa31a608901684fbcd9906d1907e66561d16e5aa"><code>fa31a60</code></a> feat!: add <code>name</code> to configs (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20015">#20015</a>) (Kirk Waiblinger)</li> <li><a href="https://github.com/eslint/eslint/commit/3383e7ec9028166cafc8ea7986c2f7498d0049f0"><code>3383e7e</code></a> fix!: remove deprecated <code>SourceCode</code> methods (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20137">#20137</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/501abd0e916a35554c58b7c0365537f1fa3880ce"><code>501abd0</code></a> feat!: update dependency minimatch to v10 (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20246">#20246</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/ca4d3b40085de47561f89656a2207d09946ed45e"><code>ca4d3b4</code></a> fix!: stricter rule tester assertions for valid test cases (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20125">#20125</a>) (唯然)</li> <li><a href="https://github.com/eslint/eslint/commit/96512a66c86402fb0538cdcb6cd30b9073f6bf3b"><code>96512a6</code></a> fix!: Remove deprecated rule context methods (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20086">#20086</a>) (Nicholas C. Zakas)</li> <li><a href="https://github.com/eslint/eslint/commit/c69fdacdb2e886b9d965568a397aa8220db3fe90"><code>c69fdac</code></a> feat!: remove eslintrc support (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20037">#20037</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/208b5cc34a8374ff81412b5bec2e0800eebfbd04"><code>208b5cc</code></a> feat!: Use <code>ScopeManager#addGlobals()</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20132">#20132</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/a2ee188ea7a38a0c6155f3d39e2b00e1d0f36e14"><code>a2ee188</code></a> fix!: add <code>uniqueItems: true</code> in <code>no-invalid-regexp</code> option (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20155">#20155</a>) (Tanuj Kanti)</li> <li><a href="https://github.com/eslint/eslint/commit/a89059dbf2832d417dd493ee81483227ec44e4ab"><code>a89059d</code></a> feat!: Program range span entire source text (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20133">#20133</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/39a6424373d915fa9de0d7b0caba9a4dc3da9b53"><code>39a6424</code></a> fix!: assert 'text' is a string across all RuleFixer methods (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20082">#20082</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/f28fbf846244e043c92b355b224d121b06140b44"><code>f28fbf8</code></a> fix!: Deprecate <code>&quot;always&quot;</code> and <code>&quot;as-needed&quot;</code> options of the <code>radix</code> rule (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20223">#20223</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/aa3fb2b233e929b37220be940575f42c280e0b98"><code>aa3fb2b</code></a> fix!: tighten <code>func-names</code> schema (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20119">#20119</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/f6c0ed0311dcfee853367d5068c765d066e6b756"><code>f6c0ed0</code></a> feat!: report <code>eslint-env</code> comments as errors (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20128">#20128</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/4bf739fb533e59f7f0a66b65f7bc80be0f37d8db"><code>4bf739f</code></a> fix!: remove deprecated <code>LintMessage#nodeType</code> and <code>TestCaseError#type</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20096">#20096</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/523c076866400670fb2192a3f55dbf7ad3469247"><code>523c076</code></a> feat!: drop support for jiti &lt; 2.2.0 (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20016">#20016</a>) (michael faith)</li> <li><a href="https://github.com/eslint/eslint/commit/454a292c95f34dad232411ddac06408e6383bb64"><code>454a292</code></a> feat!: update <code>eslint:recommended</code> configuration (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20210">#20210</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/4f880ee02992e1bf0e96ebaba679985e2d1295f1"><code>4f880ee</code></a> feat!: remove <code>v10_*</code> and inactive <code>unstable_*</code> flags (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20225">#20225</a>) (sethamus)</li> <li><a href="https://github.com/eslint/eslint/commit/f18115c363a4ac7671a4c7f30ee13d57ebba330f"><code>f18115c</code></a> feat!: <code>no-shadow-restricted-names</code> report <code>globalThis</code> by default (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20027">#20027</a>) (sethamus)</li> <li><a href="https://github.com/eslint/eslint/commit/c6358c31fbd3937b92d89be2618ffdf5a774604e"><code>c6358c3</code></a> feat!: Require Node.js <code>^20.19.0 || ^22.13.0 || &gt;=24</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20160">#20160</a>) (Milos Djermanovic)</li> </ul> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/bff9091927811497dbf066b0e3b85ecb37d43822"><code>bff9091</code></a> feat: handle <code>Array.fromAsync</code> in <code>array-callback-return</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20457">#20457</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/290c594bb50c439fb71bc75521ee5360daa8c222"><code>290c594</code></a> feat: add <code>self</code> to <code>no-implied-eval</code> rule (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20468">#20468</a>) (sethamus)</li> <li><a href="https://github.com/eslint/eslint/commit/43677de07ebd6e14bfac40a46ad749ba783c45f2"><code>43677de</code></a> feat: fix handling of function and class expression names in <code>no-shadow</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20432">#20432</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/f0cafe5f37e7765e9d8c2751b5f5d33107687009"><code>f0cafe5</code></a> feat: rule tester add assertion option <code>requireData</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20409">#20409</a>) (fnx)</li> <li><a href="https://github.com/eslint/eslint/commit/f7ab6937e63bc618d326710858f5861a68f80616"><code>f7ab693</code></a> feat: output RuleTester test case failure index (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/19976">#19976</a>) (ST-DDT)</li> <li><a href="https://github.com/eslint/eslint/commit/7cbcbf9c3c2008deee7d143ae35e668e8ffbccb3"><code>7cbcbf9</code></a> feat: add <code>countThis</code> option to <code>max-params</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20236">#20236</a>) (Gerkin)</li> <li><a href="https://github.com/eslint/eslint/commit/f148a5eaa1e89dd80ade62f0a690186b00b9f6e1"><code>f148a5e</code></a> feat: add error assertion options (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20247">#20247</a>) (ST-DDT)</li> <li><a href="https://github.com/eslint/eslint/commit/09e66549ecada6dcb8c567a60faf044fce049188"><code>09e6654</code></a> feat: update error loc of <code>require-yield</code> and <code>no-useless-constructor</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20267">#20267</a>) (Tanuj Kanti)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/436b82f3c0a8cfa2fdc17d173e95ea11d5d3ee03"><code>436b82f</code></a> fix: update eslint (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20473">#20473</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/1d29d22fe302443cec2a11da0816397f94af97ec"><code>1d29d22</code></a> fix: detect default <code>this</code> binding in <code>Array.fromAsync</code> callbacks (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20456">#20456</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/727451eff55b35d853e0e443d0de58f4550762bf"><code>727451e</code></a> fix: fix regression of global mode report range in <code>strict</code> rule (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20462">#20462</a>) (ntnyq)</li> <li><a href="https://github.com/eslint/eslint/commit/e80485fcd27196fa0b6f6b5c7ac8cf49ad4b079d"><code>e80485f</code></a> fix: remove fake <code>FlatESLint</code> and <code>LegacyESLint</code> exports (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20460">#20460</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/9eeff3bc13813a786b8a4c3815def97c0fb646ef"><code>9eeff3b</code></a> fix: update esquery (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20423">#20423</a>) (cryptnix)</li> <li><a href="https://github.com/eslint/eslint/commit/b34b93852d014ebbcf3538d892b55e0216cdf681"><code>b34b938</code></a> fix: use <code>Error.prepareStackTrace</code> to estimate failing test location (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20436">#20436</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/51aab5393b058f7cbed69041a9069b2bd106aabd"><code>51aab53</code></a> fix: update eslint (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20443">#20443</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/23490b266276792896a0b7b43c49a1ce87bf8568"><code>23490b2</code></a> fix: handle space before colon in <code>RuleTester</code> location estimation (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20433">#20433</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/f244dbf2191267a4cafd08645243624baf3e8c83"><code>f244dbf</code></a> fix: use <code>MessagePlaceholderData</code> type from <code>@eslint/core</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20348">#20348</a>) (루밀LuMir)</li> <li><a href="https://github.com/eslint/eslint/commit/d186f8c0747f14890e86a5a39708b052b391ddaf"><code>d186f8c</code></a> fix: update eslint (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20427">#20427</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/2332262deb4ef3188b210595896bb0ff552a7e66"><code>2332262</code></a> fix: error location should not modify error message in RuleTester (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20421">#20421</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/ab99b21a6715dee1035d8f4e6d6841853eb5563f"><code>ab99b21</code></a> fix: ensure <code>filename</code> is passed as third argument to <code>verifyAndFix()</code> (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20405">#20405</a>) (루밀LuMir)</li> <li><a href="https://github.com/eslint/eslint/commit/8a60f3bc80ad96c65feeb29886342623c630199c"><code>8a60f3b</code></a> fix: remove <code>ecmaVersion</code> and <code>sourceType</code> from <code>ParserOptions</code> type (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20415">#20415</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/eafd727a060131f7fc79b2eb5698d8d27683c3a2"><code>eafd727</code></a> fix: remove <code>TDZ</code> scope type (<a href="https://github.com/eslint/eslint/tree/HEAD/packages/js/issues/20231">#20231</a>) (jaymarvelz)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/eslint/eslint/commits/HEAD/packages/js">compare view</a></li> </ul> </details> <br /> Updates `@tailwindcss/postcss` from 4.1.17 to 4.1.18 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases"><code>@​tailwindcss/postcss</code>'s releases</a>.</em></p> <blockquote> <h2>v4.1.18</h2> <h3>Fixed</h3> <ul> <li>Ensure validation of <code>source(…)</code> happens relative to the file it is in (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19274">#19274</a>)</li> <li>Include filename and line numbers in CSS parse errors (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19282">#19282</a>)</li> <li>Skip comments in Ruby files when checking for class names (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li> <li>Skip over arbitrary property utilities with a top-level <code>!</code> in the value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li> <li>Support environment API in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18970">#18970</a>)</li> <li>Preserve case of theme keys from JS configs and plugins (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19337">#19337</a>)</li> <li>Write source maps correctly on the CLI when using <code>--watch</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19373">#19373</a>)</li> <li>Handle special defaults (like <code>ringColor.DEFAULT</code>) in JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19348">#19348</a>)</li> <li>Improve backwards compatibility for <code>content</code> theme key from JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19381">#19381</a>)</li> <li>Upgrade: Handle <code>future</code> and <code>experimental</code> config keys (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19344">#19344</a>)</li> <li>Try to canonicalize any arbitrary utility to a bare value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19379">#19379</a>)</li> <li>Validate candidates similarly to Oxide (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19397">#19397</a>)</li> <li>Canonicalization: combine <code>text-*</code> and <code>leading-*</code> classes (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19396">#19396</a>)</li> <li>Correctly handle duplicate CLI arguments (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19416">#19416</a>)</li> <li>Don’t emit color-mix fallback rules inside <code>@keyframes</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19419">#19419</a>)</li> <li>CLI: Don't hang when output is <code>/dev/stdout</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19421">#19421</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md"><code>@​tailwindcss/postcss</code>'s changelog</a>.</em></p> <blockquote> <h2>[4.1.18] - 2025-12-11</h2> <h3>Fixed</h3> <ul> <li>Ensure validation of <code>source(…)</code> happens relative to the file it is in (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19274">#19274</a>)</li> <li>Include filename and line numbers in CSS parse errors (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19282">#19282</a>)</li> <li>Skip comments in Ruby files when checking for class names (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li> <li>Skip over arbitrary property utilities with a top-level <code>!</code> in the value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li> <li>Support environment API in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18970">#18970</a>)</li> <li>Preserve case of theme keys from JS configs and plugins (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19337">#19337</a>)</li> <li>Write source maps correctly on the CLI when using <code>--watch</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19373">#19373</a>)</li> <li>Handle special defaults (like <code>ringColor.DEFAULT</code>) in JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19348">#19348</a>)</li> <li>Improve backwards compatibility for <code>content</code> theme key from JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19381">#19381</a>)</li> <li>Upgrade: Handle <code>future</code> and <code>experimental</code> config keys (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19344">#19344</a>)</li> <li>Try to canonicalize any arbitrary utility to a bare value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19379">#19379</a>)</li> <li>Validate candidates similarly to Oxide (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19397">#19397</a>)</li> <li>Canonicalization: combine <code>text-*</code> and <code>leading-*</code> classes (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19396">#19396</a>)</li> <li>Correctly handle duplicate CLI arguments (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19416">#19416</a>)</li> <li>Don’t emit color-mix fallback rules inside <code>@keyframes</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19419">#19419</a>)</li> <li>CLI: Don't hang when output is <code>/dev/stdout</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19421">#19421</a>)</li> </ul> <h2>[3.4.19] - 2025-12-10</h2> <h3>Fixed</h3> <ul> <li>Don’t break <code>sibling-*()</code> functions when used inside <code>calc(…)</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19335">#19335</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/9b32f7cb2fd341e1f9ddbe40a4d61d2f272ae33f"><code>9b32f7c</code></a> Release v4.1.18 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19431">#19431</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/9c8cf8ac19dd5e742794d33e249b4f9c69b3fa5c"><code>9c8cf8a</code></a> Fix formatting of path in README.md (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19407">#19407</a>)</li> <li>See full diff in <a href="https://github.com/tailwindlabs/tailwindcss/commits/v4.1.18/packages/@tailwindcss-postcss">compare view</a></li> </ul> </details> <br /> Updates `@types/node` from 22.19.7 to 25.2.3 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `@typescript-eslint/eslint-plugin` from 8.54.0 to 8.55.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases"><code>@​typescript-eslint/eslint-plugin</code>'s releases</a>.</em></p> <blockquote> <h2>v8.55.0</h2> <h2>8.55.0 (2026-02-09)</h2> <h3>🚀 Features</h3> <ul> <li><strong>utils:</strong> deprecate defaultOptions in favor of meta.defaultOptions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11992">#11992</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [no-unused-vars] remove trailing newline when removing entire import (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11990">#11990</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] require strictNullChecks (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11966">#11966</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12000">#12000</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] report unnecessary defaults in ternary expressions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11984">#11984</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] reduce param index to ts this handling (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11949">#11949</a>)</li> <li><strong>typescript-estree:</strong> forbid invalid modifier in object expression (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11931">#11931</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Christian Rose <a href="https://github.com/chrros95"><code>@​chrros95</code></a></li> <li>fisker Cheung <a href="https://github.com/fisker"><code>@​fisker</code></a></li> <li>Josh Goldberg</li> <li>Maria Solano <a href="https://github.com/MariaSolOs"><code>@​MariaSolOs</code></a></li> <li>Minyeong Kim <a href="https://github.com/minyeong981"><code>@​minyeong981</code></a></li> <li>SungHyun627 <a href="https://github.com/SungHyun627"><code>@​SungHyun627</code></a></li> <li>Yukihiro Hasegawa <a href="https://github.com/y-hsgw"><code>@​y-hsgw</code></a></li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.55.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md"><code>@​typescript-eslint/eslint-plugin</code>'s changelog</a>.</em></p> <blockquote> <h2>8.55.0 (2026-02-09)</h2> <h3>🚀 Features</h3> <ul> <li><strong>utils:</strong> deprecate defaultOptions in favor of meta.defaultOptions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11992">#11992</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] reduce param index to ts this handling (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11949">#11949</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] report unnecessary defaults in ternary expressions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11984">#11984</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] require strictNullChecks (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11966">#11966</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12000">#12000</a>)</li> <li><strong>eslint-plugin:</strong> [no-unused-vars] remove trailing newline when removing entire import (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11990">#11990</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Christian Rose <a href="https://github.com/chrros95"><code>@​chrros95</code></a></li> <li>Josh Goldberg</li> <li>Maria Solano <a href="https://github.com/MariaSolOs"><code>@​MariaSolOs</code></a></li> <li>Minyeong Kim <a href="https://github.com/minyeong981"><code>@​minyeong981</code></a></li> <li>SungHyun627 <a href="https://github.com/SungHyun627"><code>@​SungHyun627</code></a></li> <li>Yukihiro Hasegawa <a href="https://github.com/y-hsgw"><code>@​y-hsgw</code></a></li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.55.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/fedfe8665afbabd5c7d3ee09d14f450d5ba0b10a"><code>fedfe86</code></a> chore(release): publish 8.55.0</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/8a95834bb5fd818cc049390e4cb57196717a011f"><code>8a95834</code></a> fix(eslint-plugin): [no-useless-default-assignment] reduce param index to ts ...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/4ba1e72cd76f357044dca209978d87137c31e6c0"><code>4ba1e72</code></a> fix(eslint-plugin): [no-useless-default-assignment] report unnecessary defaul...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/a1f86179074a143fdb06445a28b1144427d33ec9"><code>a1f8617</code></a> feat(utils): deprecate defaultOptions in favor of meta.defaultOptions (<a href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/11992">#11992</a>)</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/3f0ce54da520cdc58f1dd2e2c45073c92617e2c2"><code>3f0ce54</code></a> fix(eslint-plugin): [no-useless-default-assignment] require strictNullChecks ...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/3df0002e8663f170749cc4a9a054af377cf0c554"><code>3df0002</code></a> fix(eslint-plugin): [no-unused-vars] remove trailing newline when removing en...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/b931f8c706beafc289462824814dca158694cb48"><code>b931f8c</code></a> chore: use workspace refs for workspace deps (<a href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12018">#12018</a>)</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/1f17a7918cd507b11fd04ce75fe44a9c62bf9542"><code>1f17a79</code></a> chore: migrate to pnpm (<a href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/11248">#11248</a>)</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.55.0/packages/eslint-plugin">compare view</a></li> </ul> </details> <br /> Updates `@typescript-eslint/parser` from 8.54.0 to 8.55.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases"><code>@​typescript-eslint/parser</code>'s releases</a>.</em></p> <blockquote> <h2>v8.55.0</h2> <h2>8.55.0 (2026-02-09)</h2> <h3>🚀 Features</h3> <ul> <li><strong>utils:</strong> deprecate defaultOptions in favor of meta.defaultOptions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11992">#11992</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [no-unused-vars] remove trailing newline when removing entire import (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11990">#11990</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] require strictNullChecks (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11966">#11966</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12000">#12000</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] report unnecessary defaults in ternary expressions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11984">#11984</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] reduce param index to ts this handling (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11949">#11949</a>)</li> <li><strong>typescript-estree:</strong> forbid invalid modifier in object expression (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/11931">#11931</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Christian Rose <a href="https://github.com/chrros95"><code>@​chrros95</code></a></li> <li>fisker Cheung <a href="https://github.com/fisker"><code>@​fisker</code></a></li> <li>Josh Goldberg</li> <li>Maria Solano <a href="https://github.com/MariaSolOs"><code>@​MariaSolOs</code></a></li> <li>Minyeong Kim <a href="https://github.com/minyeong981"><code>@​minyeong981</code></a></li> <li>SungHyun627 <a href="https://github.com/SungHyun627"><code>@​SungHyun627</code></a></li> <li>Yukihiro Hasegawa <a href="https://github.com/y-hsgw"><code>@​y-hsgw</code></a></li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.55.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md"><code>@​typescript-eslint/parser</code>'s changelog</a>.</em></p> <blockquote> <h2>8.55.0 (2026-02-09)</h2> <p>This was a version bump only for parser to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.55.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/fedfe8665afbabd5c7d3ee09d14f450d5ba0b10a"><code>fedfe86</code></a> chore(release): publish 8.55.0</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/b931f8c706beafc289462824814dca158694cb48"><code>b931f8c</code></a> chore: use workspace refs for workspace deps (<a href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12018">#12018</a>)</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/1f17a7918cd507b11fd04ce75fe44a9c62bf9542"><code>1f17a79</code></a> chore: migrate to pnpm (<a href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/11248">#11248</a>)</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.55.0/packages/parser">compare view</a></li> </ul> </details> <br /> Updates `eslint` from 8.57.1 to 10.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslint/releases">eslint's releases</a>.</em></p> <blockquote> <h2>v10.0.0</h2> <h2>Breaking Changes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/f9e54f43a5e497cdfa179338b431093245cb787b"><code>f9e54f4</code></a> feat!: estimate rule-tester failure location (<a href="https://redirect.github.com/eslint/eslint/issues/20420">#20420</a>) (ST-DDT)</li> <li><a href="https://github.com/eslint/eslint/commit/a176319d8ade1a7d9b2d7fb8f038f55a2662325f"><code>a176319</code></a> feat!: replace <code>chalk</code> with <code>styleText</code> and add <code>color</code> to <code>ResultsMeta</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20227">#20227</a>) (루밀LuMir)</li> <li><a href="https://github.com/eslint/eslint/commit/c7046e6c1e03c4ca0eee4888a1f2eba4c6454f84"><code>c7046e6</code></a> feat!: enable JSX reference tracking (<a href="https://redirect.github.com/eslint/eslint/issues/20152">#20152</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/fa31a608901684fbcd9906d1907e66561d16e5aa"><code>fa31a60</code></a> feat!: add <code>name</code> to configs (<a href="https://redirect.github.com/eslint/eslint/issues/20015">#20015</a>) (Kirk Waiblinger)</li> <li><a href="https://github.com/eslint/eslint/commit/3383e7ec9028166cafc8ea7986c2f7498d0049f0"><code>3383e7e</code></a> fix!: remove deprecated <code>SourceCode</code> methods (<a href="https://redirect.github.com/eslint/eslint/issues/20137">#20137</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/501abd0e916a35554c58b7c0365537f1fa3880ce"><code>501abd0</code></a> feat!: update dependency minimatch to v10 (<a href="https://redirect.github.com/eslint/eslint/issues/20246">#20246</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/ca4d3b40085de47561f89656a2207d09946ed45e"><code>ca4d3b4</code></a> fix!: stricter rule tester assertions for valid test cases (<a href="https://redirect.github.com/eslint/eslint/issues/20125">#20125</a>) (唯然)</li> <li><a href="https://github.com/eslint/eslint/commit/96512a66c86402fb0538cdcb6cd30b9073f6bf3b"><code>96512a6</code></a> fix!: Remove deprecated rule context methods (<a href="https://redirect.github.com/eslint/eslint/issues/20086">#20086</a>) (Nicholas C. Zakas)</li> <li><a href="https://github.com/eslint/eslint/commit/c69fdacdb2e886b9d965568a397aa8220db3fe90"><code>c69fdac</code></a> feat!: remove eslintrc support (<a href="https://redirect.github.com/eslint/eslint/issues/20037">#20037</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/208b5cc34a8374ff81412b5bec2e0800eebfbd04"><code>208b5cc</code></a> feat!: Use <code>ScopeManager#addGlobals()</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20132">#20132</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/a2ee188ea7a38a0c6155f3d39e2b00e1d0f36e14"><code>a2ee188</code></a> fix!: add <code>uniqueItems: true</code> in <code>no-invalid-regexp</code> option (<a href="https://redirect.github.com/eslint/eslint/issues/20155">#20155</a>) (Tanuj Kanti)</li> <li><a href="https://github.com/eslint/eslint/commit/a89059dbf2832d417dd493ee81483227ec44e4ab"><code>a89059d</code></a> feat!: Program range span entire source text (<a href="https://redirect.github.com/eslint/eslint/issues/20133">#20133</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/39a6424373d915fa9de0d7b0caba9a4dc3da9b53"><code>39a6424</code></a> fix!: assert 'text' is a string across all RuleFixer methods (<a href="https://redirect.github.com/eslint/eslint/issues/20082">#20082</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/f28fbf846244e043c92b355b224d121b06140b44"><code>f28fbf8</code></a> fix!: Deprecate <code>&quot;always&quot;</code> and <code>&quot;as-needed&quot;</code> options of the <code>radix</code> rule (<a href="https://redirect.github.com/eslint/eslint/issues/20223">#20223</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/aa3fb2b233e929b37220be940575f42c280e0b98"><code>aa3fb2b</code></a> fix!: tighten <code>func-names</code> schema (<a href="https://redirect.github.com/eslint/eslint/issues/20119">#20119</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/f6c0ed0311dcfee853367d5068c765d066e6b756"><code>f6c0ed0</code></a> feat!: report <code>eslint-env</code> comments as errors (<a href="https://redirect.github.com/eslint/eslint/issues/20128">#20128</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/4bf739fb533e59f7f0a66b65f7bc80be0f37d8db"><code>4bf739f</code></a> fix!: remove deprecated <code>LintMessage#nodeType</code> and <code>TestCaseError#type</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20096">#20096</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/523c076866400670fb2192a3f55dbf7ad3469247"><code>523c076</code></a> feat!: drop support for jiti &lt; 2.2.0 (<a href="https://redirect.github.com/eslint/eslint/issues/20016">#20016</a>) (michael faith)</li> <li><a href="https://github.com/eslint/eslint/commit/454a292c95f34dad232411ddac06408e6383bb64"><code>454a292</code></a> feat!: update <code>eslint:recommended</code> configuration (<a href="https://redirect.github.com/eslint/eslint/issues/20210">#20210</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/4f880ee02992e1bf0e96ebaba679985e2d1295f1"><code>4f880ee</code></a> feat!: remove <code>v10_*</code> and inactive <code>unstable_*</code> flags (<a href="https://redirect.github.com/eslint/eslint/issues/20225">#20225</a>) (sethamus)</li> <li><a href="https://github.com/eslint/eslint/commit/f18115c363a4ac7671a4c7f30ee13d57ebba330f"><code>f18115c</code></a> feat!: <code>no-shadow-restricted-names</code> report <code>globalThis</code> by default (<a href="https://redirect.github.com/eslint/eslint/issues/20027">#20027</a>) (sethamus)</li> <li><a href="https://github.com/eslint/eslint/commit/c6358c31fbd3937b92d89be2618ffdf5a774604e"><code>c6358c3</code></a> feat!: Require Node.js <code>^20.19.0 || ^22.13.0 || &gt;=24</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20160">#20160</a>) (Milos Djermanovic)</li> </ul> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/bff9091927811497dbf066b0e3b85ecb37d43822"><code>bff9091</code></a> feat: handle <code>Array.fromAsync</code> in <code>array-callback-return</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20457">#20457</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/290c594bb50c439fb71bc75521ee5360daa8c222"><code>290c594</code></a> feat: add <code>self</code> to <code>no-implied-eval</code> rule (<a href="https://redirect.github.com/eslint/eslint/issues/20468">#20468</a>) (sethamus)</li> <li><a href="https://github.com/eslint/eslint/commit/43677de07ebd6e14bfac40a46ad749ba783c45f2"><code>43677de</code></a> feat: fix handling of function and class expression names in <code>no-shadow</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20432">#20432</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/f0cafe5f37e7765e9d8c2751b5f5d33107687009"><code>f0cafe5</code></a> feat: rule tester add assertion option <code>requireData</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20409">#20409</a>) (fnx)</li> <li><a href="https://github.com/eslint/eslint/commit/f7ab6937e63bc618d326710858f5861a68f80616"><code>f7ab693</code></a> feat: output RuleTester test case failure index (<a href="https://redirect.github.com/eslint/eslint/issues/19976">#19976</a>) (ST-DDT)</li> <li><a href="https://github.com/eslint/eslint/commit/7cbcbf9c3c2008deee7d143ae35e668e8ffbccb3"><code>7cbcbf9</code></a> feat: add <code>countThis</code> option to <code>max-params</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20236">#20236</a>) (Gerkin)</li> <li><a href="https://github.com/eslint/eslint/commit/f148a5eaa1e89dd80ade62f0a690186b00b9f6e1"><code>f148a5e</code></a> feat: add error assertion options (<a href="https://redirect.github.com/eslint/eslint/issues/20247">#20247</a>) (ST-DDT)</li> <li><a href="https://github.com/eslint/eslint/commit/09e66549ecada6dcb8c567a60faf044fce049188"><code>09e6654</code></a> feat: update error loc of <code>require-yield</code> and <code>no-useless-constructor</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20267">#20267</a>) (Tanuj Kanti)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/436b82f3c0a8cfa2fdc17d173e95ea11d5d3ee03"><code>436b82f</code></a> fix: update eslint (<a href="https://redirect.github.com/eslint/eslint/issues/20473">#20473</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/1d29d22fe302443cec2a11da0816397f94af97ec"><code>1d29d22</code></a> fix: detect default <code>this</code> binding in <code>Array.fromAsync</code> callbacks (<a href="https://redirect.github.com/eslint/eslint/issues/20456">#20456</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/727451eff55b35d853e0e443d0de58f4550762bf"><code>727451e</code></a> fix: fix regression of global mode report range in <code>strict</code> rule (<a href="https://redirect.github.com/eslint/eslint/issues/20462">#20462</a>) (ntnyq)</li> <li><a href="https://github.com/eslint/eslint/commit/e80485fcd27196fa0b6f6b5c7ac8cf49ad4b079d"><code>e80485f</code></a> fix: remove fake <code>FlatESLint</code> and <code>LegacyESLint</code> exports (<a href="https://redirect.github.com/eslint/eslint/issues/20460">#20460</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/9eeff3bc13813a786b8a4c3815def97c0fb646ef"><code>9eeff3b</code></a> fix: update esquery (<a href="https://redirect.github.com/eslint/eslint/issues/20423">#20423</a>) (cryptnix)</li> <li><a href="https://github.com/eslint/eslint/commit/b34b93852d014ebbcf3538d892b55e0216cdf681"><code>b34b938</code></a> fix: use <code>Error.prepareStackTrace</code> to estimate failing test location (<a href="https://redirect.github.com/eslint/eslint/issues/20436">#20436</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/51aab5393b058f7cbed69041a9069b2bd106aabd"><code>51aab53</code></a> fix: update eslint (<a href="https://redirect.github.com/eslint/eslint/issues/20443">#20443</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/23490b266276792896a0b7b43c49a1ce87bf8568"><code>23490b2</code></a> fix: handle space before colon in <code>RuleTester</code> location estimation (<a href="https://redirect.github.com/eslint/eslint/issues/20433">#20433</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/f244dbf2191267a4cafd08645243624baf3e8c83"><code>f244dbf</code></a> fix: use <code>MessagePlaceholderData</code> type from <code>@eslint/core</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20348">#20348</a>) (루밀LuMir)</li> <li><a href="https://github.com/eslint/eslint/commit/d186f8c0747f14890e86a5a39708b052b391ddaf"><code>d186f8c</code></a> fix: update eslint (<a href="https://redirect.github.com/eslint/eslint/issues/20427">#20427</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/2332262deb4ef3188b210595896bb0ff552a7e66"><code>2332262</code></a> fix: error location should not modify error message in RuleTester (<a href="https://redirect.github.com/eslint/eslint/issues/20421">#20421</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/ab99b21a6715dee1035d8f4e6d6841853eb5563f"><code>ab99b21</code></a> fix: ensure <code>filename</code> is passed as third argument to <code>verifyAndFix()</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20405">#20405</a>) (루밀LuMir)</li> <li><a href="https://github.com/eslint/eslint/commit/8a60f3bc80ad96c65feeb29886342623c630199c"><code>8a60f3b</code></a> fix: remove <code>ecmaVersion</code> and <code>sourceType</code> from <code>ParserOptions</code> type (<a href="https://redirect.github.com/eslint/eslint/issues/20415">#20415</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/eafd727a060131f7fc79b2eb5698d8d27683c3a2"><code>eafd727</code></a> fix: remove <code>TDZ</code> scope type (<a href="https://redirect.github.com/eslint/eslint/issues/20231">#20231</a>) (jaymarvelz)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eslint/eslint/commit/4e6c4ac042e321da8fc29ce53ed03c86dcaa44a7"><code>4e6c4ac</code></a> 10.0.0</li> <li><a href="https://github.com/eslint/eslint/commit/ddd8a223000ac6a2182cc8eae35254806a3b0289"><code>ddd8a22</code></a> Build: changelog update for 10.0.0</li> <li><a href="https://github.com/eslint/eslint/commit/bff9091927811497dbf066b0e3b85ecb37d43822"><code>bff9091</code></a> feat: handle <code>Array.fromAsync</code> in <code>array-callback-return</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20457">#20457</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/1ece282c2286b5dc187ece2a793dbd8798f20bd7"><code>1ece282</code></a> chore: ignore <code>/docs/v9.x</code> in link checker (<a href="https://redirect.github.com/eslint/eslint/issues/20452">#20452</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/034e1397446205e83eb341354605380195c88633"><code>034e139</code></a> ci: add type integration test for <code>@html-eslint/eslint-plugin</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20345">#20345</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/f3fbc2f60cbe2c718364feb8c3fc0452c0df3c56"><code>f3fbc2f</code></a> chore: set <code>@eslint/js</code> version to 10.0.0 to skip releasing it (<a href="https://redirect.github.com/eslint/eslint/issues/20466">#20466</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/e978ddaab7e6a3c38b4a2afa721148a6ef38f29a"><code>e978dda</code></a> docs: Update README</li> <li><a href="https://github.com/eslint/eslint/commit/4cecf8393ae9af18c4cfd50621115eb23b3d0cb6"><code>4cecf83</code></a> docs: Update README</li> <li><a href="https://github.com/eslint/eslint/commit/c79f0ab2e2d242a93b08ff2f6a0712e2ef60b7b8"><code>c79f0ab</code></a> docs: Update README</li> <li><a href="https://github.com/eslint/eslint/commit/afc06817bbd0625c7b0a46bdc81c38dab0c99441"><code>afc0681</code></a> chore: remove scopeManager.addGlobals patch for typescript-eslint parser (<a href="https://redirect.github.com/eslint/eslint/issues/20">#20</a>...</li> <li>Additional commits viewable in <a href="https://github.com/eslint/eslint/compare/v8.57.1...v10.0.0">compare view</a></li> </ul> </details> <br /> Updates `glob` from 11.0.3 to 13.0.2 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/isaacs/node-glob/blob/main/changelog.md">glob's changelog</a>.</em></p> <blockquote> <h1>changeglob</h1> <h2>13</h2> <ul> <li>Move the CLI program out to a separate package, <code>glob-bin</code>. Install that if you'd like to continue using glob from the command line.</li> </ul> <h2>12</h2> <ul> <li>Remove the unsafe <code>--shell</code> option. The <code>--shell</code> option is now ONLY supported on known shells where the behavior can be implemented safely.</li> </ul> <h2>11.1</h2> <p><a href="https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2">GHSA-5j98-mcp5-4vw2</a></p> <ul> <li>Add the <code>--shell</code> option for the command line, with a warning that this is unsafe. (It will be removed in v12.)</li> <li>Add the <code>--cmd-arg</code>/<code>-g</code> as a way to <em>safely</em> add positional arguments to the command provided to the CLI tool.</li> <li>Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding <code>shell:true</code> execution.</li> </ul> <h2>11.0</h2> <ul> <li>Drop support for node before v20</li> </ul> <h2>10.4</h2> <ul> <li>Add <code>includeChildMatches: false</code> option</li> <li>Export the <code>Ignore</code> class</li> </ul> <h2>10.3</h2> <ul> <li>Add <code>--default -p</code> flag to provide a default pattern</li> <li>exclude symbolic links to directories when <code>follow</code> and <code>nodir</code> are both set</li> </ul> <h2>10.2</h2> <ul> <li>Add glob cli</li> </ul> <h2>10.1</h2> <ul> <li>Return <code>'.'</code> instead of the empty string <code>''</code> when the current working directory is returned as a match.</li> <li>Add <code>posix: true</code> option to return <code>/</code> delimited paths, even on</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/node-glob/commit/2135b0c3580caf6330e28dedb2d57cea75f15154"><code>2135b0c</code></a> 13.0.2</li> <li><a href="https://github.com/isaacs/node-glob/commit/52544940ddddead912084a436ac08604592c5a81"><code>5254494</code></a> ship minified by default, update deps</li> <li><a href="https://github.com/isaacs/node-glob/commit/0a603fe1857105aedf4a1f80a75375fc3e4c0385"><code>0a603fe</code></a> remove unused tshy config</li> <li><a href="https://github.com/isaacs/node-glob/commit/c759f03302b7b2ab76747cfe2cadf4a51b113082"><code>c759f03</code></a> 13.0.1</li> <li><a href="https://github.com/isaacs/node-glob/commit/8354a188e58d66e015f7ad50845260abba8bdd9e"><code>8354a18</code></a> update deps</li> <li><a href="https://github.com/isaacs/node-glob/commit/ff6e0f541ac0fca999fc7803a2774cf1d94f4f47"><code>ff6e0f5</code></a> ci: update action versions</li> <li><a href="https://github.com/isaacs/node-glob/commit/14692860a3d266cae5d0fcc119953a13351f6a10"><code>1469286</code></a> update workflows and formatting/docs</li> <li><a href="https://github.com/isaacs/node-glob/commit/3bfb9604fabcd372fd13bbacef90339d10d1aa92"><code>3bfb960</code></a> 13.0.0</li> <li><a href="https://github.com/isaacs/node-glob/commit/db31a63edaffa88b6361199267f155112f49f4fe"><code>db31a63</code></a> Split the CLI out from the main project</li> <li><a href="https://github.com/isaacs/node-glob/commit/54934586bc33b3f90fde6c13c1ca5b719801ee78"><code>5493458</code></a> ci: remove node 20</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/node-glob/compare/v11.0.3...v13.0.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~isaacs">isaacs</a>, a new releaser for glob since your current version.</p> </details> <br /> Updates `globals` from 17.2.0 to 17.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/globals/releases">globals's releases</a>.</em></p> <blockquote> <h2>v17.3.0</h2> <ul> <li>Update globals (2026-02-01) (<a href="https://redirect.github.com/sindresorhus/globals/issues/336">#336</a>) 295fba9</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/globals/compare/v17.2.0...v17.3.0">https://github.com/sindresorhus/globals/compare/v17.2.0...v17.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/globals/commit/5edc6020698a76964b0fa17cb604f4484451143b"><code>5edc602</code></a> 17.3.0</li> <li><a href="https://github.com/sindresorhus/globals/commit/295fba929adf8b44f945688233778a57ff754368"><code>295fba9</code></a> Update globals (2026-02-01) (<a href="https://redirect.github.com/sindresorhus/globals/issues/336">#336</a>)</li> <li>See full diff in <a href="https://github.com/sindresorhus/globals/compare/v17.2.0...v17.3.0">compare view</a></li> </ul> </details> <br /> Updates `next-validate-link` from 1.6.3 to 1.6.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fuma-nama/next-validate-link/releases">next-validate-link's releases</a>.</em></p> <blockquote> <h2>[email protected]</h2> <h3>Patch Changes</h3> <ul> <li>e8b1df1: Improve error message format to support editor jumping</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/fuma-nama/next-validate-link/blob/dev/CHANGELOG.md">next-validate-link's changelog</a>.</em></p> <blockquote> <h2>1.6.4</h2> <h3>Patch Changes</h3> <ul> <li>e8b1df1: Improve error message format to support editor jumping</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fuma-nama/next-validate-link/commit/875c724f5a3ef1498d9071e94851f98e9226492a"><code>875c724</code></a> Merge pull request <a href="https://redirect.github.com/fuma-nama/next-validate-link/issues/96">#96</a> from fuma-nama/changeset-release/dev</li> <li><a href="https://github.com/fuma-nama/next-validate-link/commit/abb9795c43fc13cf8506413cfb35ea29168dacd7"><code>abb9795</code></a> run lint</li> <li><a href="https://github.com/fuma-nama/next-validate-link/commit/e7cd386893492172d98c67a8b5dbac99fa4d814f"><code>e7cd386</code></a> update example</li> <li><a href="https://github.com/fuma-nama/next-validate-link/commit/e8b1df10f58fb8bf1e4651fe931880859d201be1"><code>e8b1df1</code></a> feat: Improve error message format to support editor jumping</li> <li>See full diff in <a href="https://github.com/fuma-nama/next-validate-link/compare/[email protected]@1.6.4">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by [GitHub Actions](<a href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a> Actions), a new releaser for next-validate-link since your current version.</p> </details> <br /> Updates `semver` from 7.7.3 to 7.7.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/npm/node-semver/releases">semver's releases</a>.</em></p> <blockquote> <h2>v7.7.4</h2> <h2><a href="https://github.com/npm/node-semver/compare/v7.7.3...v7.7.4">7.7.4</a> (2026-01-16)</h2> <h3>Bug Fixes</h3> <ul> <li><a href="https://github.com/npm/node-semver/commit/a29faa5f3309a01c8e5aeb965fb5c02c4c4e80e2"><code>a29faa5</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/835">#835</a> cli: pass options to semver.valid() for loose version validation (<a href="https://redirect.github.com/npm/node-semver/issues/835">#835</a>) (<a href="https://github.com/mldangelo"><code>@​mldangelo</code></a>)</li> </ul> <h3>Documentation</h3> <ul> <li><a href="https://github.com/npm/node-semver/commit/1d28d5e82de16163daf721a7c76fff93e0d333ab"><code>1d28d5e</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/836">#836</a> fix typos and update -n CLI option documentation (<a href="https://redirect.github.com/npm/node-semver/issues/836">#836</a>) (<a href="https://github.com/mldangelo"><code>@​mldangelo</code></a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/npm/node-semver/commit/120968b76760cb0db85a72bde2adedd0e9628793"><code>120968b</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/840">#840</a> <code>@npmcli/[email protected].0</code> (<a href="https://redirect.github.com/npm/node-semver/issues/840">#840</a>)</li> </ul> <h3>Chores</h3> <ul> <li><a href="https://github.com/npm/node-semver/commit/44d7130c60cedd3703048aa671bb1d659b79ab07"><code>44d7130</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/824">#824</a> bump <code>@​npmcli/eslint-config</code> from 5.1.0 to 6.0.0 (<a href="https://redirect.github.com/npm/node-semver/issues/824">#824</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li> <li><a href="https://github.com/npm/node-semver/commit/70735767b68a1775eb67ac816b183b4a422101f4"><code>7073576</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/820">#820</a> reorder parameters in invalid-versions.js test (<a href="https://redirect.github.com/npm/node-semver/issues/820">#820</a>) (<a href="https://github.com/reggi"><code>@​reggi</code></a>)</li> <li><a href="https://github.com/npm/node-semver/commit/5816d4cfd6d85169527a2bc22fbd5bf4c64f34e3"><code>5816d4c</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/829">#829</a> bump <code>@​npmcli/template-oss</code> from 4.28.0 to 4.28.1 (<a href="https://redirect.github.com/npm/node-semver/issues/829">#829</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot], <a href="https://github.com/npm-cli-bot"><code>@​... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Copilot <[email protected]> Co-authored-by: fforootd <[email protected]> Co-authored-by: Florian Forster <[email protected]>	2026-02-17 16:37:20 -08:00
Florian ForsterandGitHub	d17e954f26	docs: update fumadocs dependencies (#11594) ... This PR upgrade Fuma docs and alings some code snippets since shiki 3.22.0 does no longer include defaults for `curl`.	2026-02-17 21:41:48 +01:00
Mridang AgarwallaandGitHub	61756af7f7	feat(login): use OpenSSL CA store for TLS certificate validation (#11562)	2026-02-16 23:25:50 +00:00
RamonandGitHub	a24e3f03b9	chore: update npm deps (#11427) ... # Which Problems Are Solved Outdated NPM dependencies # How the Problems Are Solved Updated the depdendencies # Additional Changes # Additional Context	2026-02-11 11:00:11 +01:00
3 people	9492c12c09	fix(login): refactor SAML Post Flow to bypass cookie limits, fix SAML SP post (#11170) ... Closes #10816 Closes #10759 # Which Problems Are Solved This PR refactors the SAML Post binding flow to address issues with payloads exceeding browser cookie size limits (typically ~4KB). Previously, the SAML form data was serialized into a cookie, and the user was redirected to an intermediate /saml-post page to render the form. This approach failed for large SAML assertions. # How the Problems Are Solved The new implementation bypasses cookies entirely for the payload transfer. Server actions now return the form data directly to the client, which immediately renders and submits the form. - Direct Data Transfer: Updated `startIdentityProviderFlow` to return an object { url, fields } instead of a redirect URL when the next step is formData. - Server Actions: Updated redirectToIdp, sendLoginname, and completeAuthFlow to propagate this samlData object to the client. - Client-Side Auto-Submission: Added a new AutoSubmitForm component that renders a hidden form with the provided fields and automatically submits it to the IdP on mount. --------- Co-authored-by: conblem <[email protected]>	2026-02-09 13:46:30 +01:00
Florian ForsterandGitHub	2700286ae7	docs: fix sidebar (#11479) ... This pull request primarily updates dependencies in the documentation app and the root package to keep them current and introduce new features or bug fixes. The most notable changes are version bumps for several core and UI-related packages, as well as the addition of new packages related to syntax highlighting. Dependency updates and additions: * Updated `fumadocs-core`, `fumadocs-mdx`, and `fumadocs-ui` to version `16.4.11`, `14.2.6`, and `16.4.11` respectively, and bumped `fumadocs-openapi` to `^10.2.4` in `apps/docs/package.json` for improved documentation features and bug fixes. * Updated `next` and `eslint-config-next` to version `16.1.6` in `apps/docs/package.json` for framework and linting improvements. [[1]](diffhunk://#diff-d03d2ce97fad5059ad6248fca5f5919994b09bca360f883318c03f1f817ae677R27-R44) [[2]](diffhunk://#diff-d03d2ce97fad5059ad6248fca5f5919994b09bca360f883318c03f1f817ae677L60-R62) * Bumped `shiki` to `^3.21.0` in both `apps/docs/package.json` and the root `package.json` for enhanced syntax highlighting. [[1]](diffhunk://#diff-d03d2ce97fad5059ad6248fca5f5919994b09bca360f883318c03f1f817ae677R27-R44) [[2]](diffhunk://#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R19) New package additions for syntax highlighting: * Added `@shikijs/rehype` and `@shikijs/types` at version `^3.21.0` in `apps/docs/package.json` to support advanced code highlighting in documentation.	2026-01-30 18:11:12 +00:00
Florian ForsterandGitHub	f7277b8641	docs: fix links from console and update nextjs (#11465)	2026-01-29 10:09:29 -08:00
3 people	d8ea041c56	docs: introduce versioned docs and migrate to fuma (#11166) ... ## Todos for release - [x] Configure Env in docs project on vercel - [x] Configure Root Path in the docs project on vercel - [ ] Remove old CSP https://github.com/zitadel/website/pull/1592 ## What we did This pull request migrates the project documentation from the old `docs/` directory to the new `apps/docs/` directory, introduces a new documentation system built with Next.js and Fumadocs, and updates all relevant references, configuration files, and documentation to reflect this change. It also adds new configuration and ignore files for the new documentation app, updates CI and linting to exclude the new docs from certain checks, and revises the contributing guidelines accordingly. **Documentation System Migration and New Docs App** * Migrated all documentation from `docs/` to `apps/docs/`, and updated all references in `README.md`, `CONTRIBUTING.md`, and other files to point to the new location. [[1]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L585-L640) [[2]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L660-R607) [[3]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L740-R687) [[4]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L2-R3) [[5]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L30-R30) * Added a new Next.js/Fumadocs-based documentation app under `apps/docs/`, including core app files, layouts, routing, search API, and a comprehensive `README.md` with development and contribution instructions. [[1]](diffhunk://#diff-5a1b07344a2c1b4d3f37b23ff1388b62cd9f57dea3c1cd23d8a0412b7602b132R1-R74) [[2]](diffhunk://#diff-462b9ad1eabbb7d1c29bb9c36e4931eb180fd7190900e6d2babf8f4d66ad1c28R1-R39) [[3]](diffhunk://#diff-e16ae25660ded787b10ac35dea96d5ecaacf895dae0afc8a9bd4382dc79a8c87R1-R7) [apps/docs/app/[[...slug]]/layout.tsxR1-R81](diffhunk://#diff-59e08acde4e805b7aeccef1dcf98f1d71dfc550777e6b9402085cee0e9fa4e0aR1-R81), [apps/docs/app/[[...slug]]/page.tsxR1-R79](diffhunk://#diff-e5df3f80d0fa01e12d63d81f29c57a9d14e846c78fd3beabb2ef768e38fd9580R1-R79), [[4]](diffhunk://#diff-389b34918e040cacaa87cd7201ffa462cc2b0b716736f537e3d3c660ac69353bR1-R7) [[5]](diffhunk://#diff-d3b03416d1c457b19f1c27b26f2db741412df841b875c26ccadc36e4522247f4R1-R29) [[6]](diffhunk://#diff-c8fb8339570a5305809be7c618e14705fd86390dc278e6ce8ba224a7bc8b0c3cR1-R25) **Configuration and Tooling Updates** * Updated `.github/workflows/codeql.yml`, `.golangci.yaml`, and `.github/dependabot.yml` to properly handle the new docs app: excluded `apps/docs` from certain checks, added npm dependency updates for the docs app, and excluded generated content. [[1]](diffhunk://#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27L8-R14) [[2]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R5-R6) [[3]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R126-R129) [[4]](diffhunk://#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28R89-R106) * Updated `.devcontainer/devcontainer.json` to use the latest Go 1.25.3 version for consistency. **Licensing and Miscellaneous** * Added `apps/docs/` to the list of licensed directories in `LICENSING.md`. These changes ensure the documentation is now maintained in a modern, scalable system and all project tooling is updated to support the new structure. --------- Co-authored-by: Federico Coppede <[email protected]>	2026-01-29 08:38:36 -08:00
RamonandGitHub	7b6395c348	fix: improve NX caching (#11434) ... # Which Problems Are Solved This PR improves our NX caching, especially for the console and api. It makes sure that if the console is changed the api is also rebuilt and if the api is changed the functional-ui tests are rerun. It is important to note this only fixes a subset of our problems. # How the Problems Are Solved NX ignores .gitignored files even if they are explicitly added to the inputs of an NX target. To counteract this one can add these files to a .nxignore file with a negated pattern. https://nx.dev/docs/reference/inputs#token-behavior-with-nested-projects . This solution is not documented per se but can be find in this Github issue: https://github.com/nrwl/nx/issues/6821 . Further more nx calculates the hashes of inputs at the start and does not recalculate them even if a dependency of a target changes. To solve this problem one needs to use https://nx.dev/docs/reference/inputs#outputs-of-dependent-tasks . This comment of an NX developer helped me further to understand the actual behaviour of NX: https://github.com/nrwl/nx/issues/33379#issuecomment-3657929455 . # Additional Changes Because the functional-ui tests now correctly run again they had to be fixed. This pr unifies the field names in the user create v1 and v2 ui. # Additional Context To document this somewhere, this proposed fix does not work: https://github.com/nrwl/nx/issues/6821#issuecomment-1309475504 . In my local testing NX runtime inputs also get executed at the beginning of the NX loop and ignore subsequent changes by targets. While testing this fix and browsing through NX code I found this, which could be helpful in the future and isn't documented: https://github.com/nrwl/nx/pull/31428	2026-01-29 14:42:52 +01:00
4 people	09f67a931a	docs: Overhauled Quickstart guide to improve developer experience (#11366) ... # Which Problems Are Solved - Outdated Quickstart, with old screenshots - Quickstart was too long - Quickstart had lots of prose text, which wasn't really developer focused # How the Problems Are Solved - Replaced outdated screenshots with the latest UI. - Streamlined long-form prose into actionable, developer-focused steps. - Shortened the overall length to help developers reach "Success" faster. --------- Co-authored-by: Florian Forster <[email protected]> Co-authored-by: Livio Spring <[email protected]>	2026-01-21 17:53:17 +01:00
RamonandGitHub	e401da3cfa	fix(console): remove rehauled navigation #10863 (#10912) ... # Which Problems Are Solved The new breadcrumbs were causing problems with some more advanced Zitadel setups. This pr removes the new breadcrumbs to revert to the old navigation behaviour. # How the Problems Are Solved Most of the changes could be kept but those specific to the navigation where mostly reverted. # Additional Changes Updated some dependencies. # Additional Context - Closes #10863	2026-01-16 08:30:09 +01:00
3 people	26f8238499	fix(login): correctly redirect to /password when ignoreUnknownUsername is set (#11130) ... Closes #11006 # Which Problems Are Solved This PR addresses an issue where the ignoreUnknownUsernames setting was not being respected in certain scenarios during the login flow. Specifically: - When a user was found but rejected due to login settings (e.g., disableLoginWithEmail), the system would return a "User not found" error instead of redirecting to the password page as dictated by ignoreUnknownUsernames. - When a user was not found, and the flow fell through the registration checks (e.g., IDP redirect failed), it would also return "User not found" without checking ignoreUnknownUsernames. # How the Problems Are Solved - Introduced a helper function `handleUserNotFound` in `apps/login/src/lib/server/loginname.ts` to centralize the logic for checking ignoreUnknownUsernames and redirecting to the password page. - Updated the user validation logic to call handleUserNotFound when a user is found but rejected by policy. - Updated the registration fallback logic to call handleUserNotFound instead of directly returning an error. - Added new test cases in `apps/login/src/lib/server/loginname.test.ts` to verify the fix and ensure no regressions. # Additional Changes - Fixed inconsistency in translation files --------- Co-authored-by: Livio Spring <[email protected]>	2026-01-14 08:24:48 +00:00
RamonandGitHub	4b5d6e39e1	chore: update js-yaml (#11300) ... # Which Problems Are Solved Fixes [Dependency Security Alert](https://github.com/zitadel/zitadel/security/dependabot/379) # How the Problems Are Solved This PR adds a pnpm override to force `js-yaml@^4` to resolve to `>=4.1.1`, which contains the fix for the prototype pollution vulnerability. The override only affects the 4.x line, leaving 3.x versions unchanged. # Additional Context - Closes https://github.com/zitadel/zitadel/security/dependabot/379	2026-01-07 10:20:01 +00:00
RamonandGitHub	20b6c9869a	chore: update deps (#11273) ... # Which Problems Are Solved Fix failing compliance alert because of old depedencies. # How the Problems Are Solved Updated our npm dependencies # Additional Changes - Updated Docusaurus to React 19 to unify our react versions - Fixed flaky e2e test	2026-01-07 09:48:30 +01:00
Max PeintnerandGitHub	7963cdd713	fix(login): enable explicit IDP linking using existing session id (#11225) ... Closes #11191 # Which Problems Are Solved This PR fixes the IDP linking for accounts with no authentication method. We strictly validate session ownership and generate a hash of the sessionId + the user's fingerprintId cookie. This hash is passed to the IDP as linkFingerprint. This PR addtionally addresses TypeScript errors regarding unknown types in catch blocks within the IDP intent processing logic. It ensures that errors occurring during IDP linking are safely handled, and that meaningful error messages are propagated to the client-side redirect URLs. # How the Problems Are Solved - Safely handle unknown errors: Updated catch blocks in `processIDPCallback` to check if the caught object is an instance of Error before accessing error.message. - Fix "IDP Taken" check: Implemented a safe check for the gRPC error code 6 (Already Exists) by casting the error, resolving the Property 'code' does not exist on type 'unknown' build error. - Error Propagation: The specific error message is now passed to the linking-failed page params, allowing for better user feedback instead of generic errors.	2025-12-30 14:32:37 +00:00
3 people	5a7136fe67	docs: Disable emoji rendering (#10994) ... # Which Problems Are Solved We had to wrap reserved scopes like `urn:zitadel:iam:org:id:178204173316174381` in a code block, because Docusaurus was rendering 🆔 as emoji. # How the Problems Are Solved Update Docusaurus to 3.9.2. and disable the emoji rendering in markdown files. # Additional Changes # Additional Context Co-authored-by: Florian Forster <[email protected]>	2025-12-16 18:55:26 +00:00
Max PeintnerandGitHub	9bbf0096b6	fix: update pnpm, react, react-dom (#11197) ... Closes #11192 # Which Problems Are Solved Update pnpm, react and react-dom to the latest version # How the Problems Are Solved the version references are updated as part of the package.json files	2025-12-16 15:04:31 +00:00
3 people	2221b5ef74	fix(login): CVE-2025-55184 and CVE-2025-55183, update next (#11179) ... # Which Problems Are Solved Updates `next` to version `15.5.9` to address the following security vulnerabilities: - **CVE-2025-55184** - **CVE-2025-55183** # How the Problems Are Solved - Bump `next` from `15.5.7` to `15.5.9` in `apps/login/package.json` --------- Co-authored-by: PhenixH <[email protected]>	2025-12-12 13:01:05 +01:00
3 people	aafc15b8c3	fix: [CVE-2025-55182] [CVE-2025-66478] Quick update react and Nextjs for #11140 (#11143) ... # Which Problems Are Solved Temporary update of nextjs and react to fix major CVE (described #11140) Build passing and force dependency for old deps, but we will need to update packages (I update qrcode-react, minimal impact, not feasible for react-hook-form which needs more work). # How the Problems Are Solved Upgrade dependencies to patched version of the same major and minor, remove experimental flag dynamicIO and added flag useCache (used in code) # Additional Changes # Additional Context - https://nextjs.org/blog/CVE-2025-66478 - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components Co-authored-by: Max Peintner <[email protected]>	2025-12-12 10:30:49 +00:00
4 people	94f9ef966f	docs: Dynamic Manager Permission Table (#11120) ... <!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved Permissions for each manager role are stored in a .yaml file and can't be easily searched in our docs. # How the Problems Are Solved We reference anyways the defaults.yaml file in our docs. The script parses the yaml and produces a markdown table containing all manager roles by manager permissions. # Additional Changes * Updated README with correct production build command # Additional Context --------- Co-authored-by: Florian Forster <[email protected]> Co-authored-by: Livio Spring <[email protected]>	2025-12-09 14:05:04 +02:00
3 people	df75be96ff	Merge commit from fork ... * fix: Improve host header handling and deployment mode detection * ZITADEL_CLOUD env * refactor service config * service config * cleanup * cleanup * util for original and public host * instanceHost, publicHost * cleanup constructUrl * cleanup middleware * add x-zitadel-forward-host as fallback for current cloud setup * fix build * fix: lint * fix: update test mocks * fix: provide basepath to unit tests * host handling * unit tests * imports * fix: getPublicHost instead of getInstanceHost * unit tests * update nextjs, implement jwt verify for logout_token * pass logout information in jwt to login v2 * handle hosts in jwks url * point idp callbacks to the api and not the login UI * logout_hint out of logout token, typecheck * rm unused imports * fix oidc integration test --------- Co-authored-by: Livio Spring <[email protected]>	2025-12-08 10:01:49 +01:00
5 people	f69a6ed4f3	chore: rehaul DevX (#10571) ... # Which Problems Are Solved Replaces Turbo by Nx and lays the foundation for the next CI improvements. It enables using Nx Cloud to speed the up the pipelines that affect any node package. It streamlines the dev experience for frontend and backend developers by providing the following commands: | Task | Command | Notes | |------|---------|--------| | **Production** | `nx run PROJECT:prod` | Production server | | **Develop** | `nx run PROJECT:dev` | Hot reloading development server | | **Test** | `nx run PROJECT:test` | Run all tests | | **Lint** | `nx run PROJECT:lint` | Check code style | | **Lint Fix** | `nx run PROJECT:lint-fix` | Auto-fix style issues | The following values can be used for PROJECT: - @zitadel/zitadel (root commands) - @zitadel/api, - @zitadel/login, - @zitadel/console, - @zitadel/docs, - @zitadel/client - @zitadel/proto The project names and folders are streamlined: | Old Folder | New Folder | | --- | --- | | ./e2e | ./tests/functional-ui | | ./load-test | ./benchmark | | ./build/zitadel | ./apps/api | | ./console | ./apps/console (postponed so the PR is reviewable) | Also, all references to the TypeScript repo are removed so we can archive it. # How the Problems Are Solved - Ran `npx nx@latest init` - Replaced all turbo.json by project.json and fixed the target configs - Removed Turbo dependency - All JavaScript related code affected by a PRs changes is quality-checked using the `nx affected` command - We move PR checks that are runnable using Nx into the `check` workflow. For workflows where we don't use Nx, yet, we restore previously built dependency artifacts from Nx. - We only use a single and easy to understand dev container - The CONTRIBUTING.md is streamlined - The setup with a generated client pat is orchestrated with Nx - Everything related to the TypeScript repo is updated or removed. A **Deploy with Vercel** button is added to the docs and the CONTRIBUTING.md. # Additional Changes - NPM package names have a consistent pattern. - Docker bake is removed. The login container is built and released like the core container. - The integration tests build the login container before running, so they don't rely on the login container action anymore. This fixes consistently failing checks on PRs from forks. - The docs build in GitHub actions is removed, as we already build on Vercel. # Additional Context - Internal discussion: https://zitadel.slack.com/archives/C087ADF8LRX/p1756277884928169 - Workflow dispatch test: https://github.com/zitadel/zitadel/actions/runs/17760122959 --------- Co-authored-by: Florian Forster <[email protected]> Co-authored-by: Tim Möhlmann <[email protected]> Co-authored-by: Copilot <[email protected]>	2025-10-08 10:27:02 +02:00
RamonandGitHub	e47acaeef2	chore(console): Angular 20 #10690 (#10768) ... # Which Problems Are Solved # How the Problems Are Solved # Additional Changes # Additional Context - Closes #10690	2025-10-08 07:10:50 +00:00
Max PeintnerandGitHub	1a42e99329	chore(login): Remove Vercel Analytics from login application (#10701) ... This PR removes the Vercel Analytics integration from the login application to reduce external dependencies and improve privacy. # Which Problems Are Solved cleaner csp # How the Problems Are Solved - Removed dependency: Uninstalled @vercel/analytics package from package.json - Updated layout component: Removed Analytics import and component usage from layout.tsx - Updated Content Security Policy: Removed Vercel domains (https://va.vercel-scripts.com and https://vercel.com) from CSP configuration in csp.js	2025-09-11 12:10:09 +00:00
RamonandGitHub	5517fe234f	fix(console): Improve default org selection method in new breadcrumbs (#10612) ... # Which Problems Are Solved e2e tests work again in chrome and all other browsers # How the Problems Are Solved If the user has no org selected we have to choose a default org to select. The logic for this was faulty if a new organization was created as the breadcrumb wasn't aware of the new org so it defaulted back to the ZITADEL org. # Additional changes Improved the @zitadel/client package readme so the example code would compile.	2025-09-01 15:06:35 +00:00
5 people	f963ea9f86	feat(console): rehauled navigation for instances including breadcrumb (#10283) ... This PR significantly improves user navigation by introducing a new instance-level navigation bar. This new bar, positioned above the existing organization navigation, provides quick access to key sections: Home, Organizations, Actions, and Settings. Additionally, the breadcrumb component has been refined for more consistent behavior, reintroducing intuitive breadcrumb buttons to easily navigate up the hierarchy. These changes also include design improvements for a cleaner and more streamlined appearance across the interface. <img width="423" height="138" alt="Screenshot 2025-07-17 at 14 55 46" src="https://github.com/user-attachments/assets/ba9e40a1-1077-4cb6-8735-ac7ab637abe7" /> <img width="562" height="132" alt="Screenshot 2025-07-17 at 14 56 41" src="https://github.com/user-attachments/assets/d85dc673-0df8-4677-9d2b-dc031dde42c3" /> <img width="545" height="254" alt="Screenshot 2025-07-17 at 14 56 10" src="https://github.com/user-attachments/assets/eaf10117-079e-4181-8dbb-60c89b24556a" /> <img width="689" height="261" alt="Screenshot 2025-07-17 at 14 56 20" src="https://github.com/user-attachments/assets/510ad550-1d9a-4c6a-8af1-66cb0b23619c" /> --------- Co-authored-by: conblem <[email protected]> Co-authored-by: Stefan Benz <[email protected]> Co-authored-by: Florian Forster <[email protected]>	2025-08-28 11:23:14 +02:00
Max PeintnerandGitHub	cf02c4231a	fix(console): pin buf gen versions (#10542) ... Fix: Pin buf protoc plugin versions to resolve runtime protobuf compatibility issues # Which Problems Are Solved The console application was experiencing a runtime error "requireUtf8 is not a function" when the authentication service attempted to deserialize protobuf messages. This error started occurring recently due to automatic updates of buf protoc plugins. # How the Problems Are Solved pinning of the versions in buf.gen.yml and package.json	2025-08-21 17:32:15 +02:00