andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-18 05:52:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,518 Commits 2 Branches 0 Tags
d15b4e2da2c1be2bd369c5ed28d7a349c442287f
Commit Graph
4518 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Federico CoppedeGitHubzitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>Copilot Autofix powered by AI
 		d15b4e2da2 docs: create knowledge gap ID 34 (#12388) 
Automatically generated PR resolving Knowledge Gap ID 34.

**Thread ID:** manual-1783339162398
**Action:** CREATE
**New File:** `content/docs/drafts/gap-manual-1783339162398.mdx`

### AI Summary
> Add a user migration guide for firebase to Zitadel

### Human Reviewer Instructions
> Firebase to Zitadel Migration Summary
> The Blocker: Incompatible Password Hashes
> 
> Firebase uses a proprietary, modified scrypt algorithm requiring
project-specific keys.
> 
> Zitadel supports standard algorithms but lacks a verifier for
Firebase's custom format.
> 
> Result: Passwords cannot be directly imported. Firebase hashes must be
discarded.
> 
> Strategy 1: Bulk Import & Password Reset (Standard)
> Requires users to set a new password on their first login.
> 
> Export: Run firebase auth:export users.json --format=json.
> 
> Map: Convert Firebase fields (e.g., localId) to Zitadel's schema.
> 
> Import to Zitadel: Call the Zitadel import API.
> 
> Action: Omit the hashedPassword object entirely.
> 
> Action: Include "passwordChangeRequired": true in the JSON payload to
trigger a reset flow via email or login prompt.
> 
> Strategy 2: Just-In-Time (JIT) Migration (Seamless)
> Migrates users transparently behind the scenes during an active grace
period.
> 
> Intercept Login: Your backend captures the plain-text password during
login.
> 
> Verify: Backend POSTs credentials to Firebase Auth REST API:
> 
>
https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=[WEB_API_KEY]
> 
> Migrate to Zitadel:
> 
> If Valid (200 OK): Create the user in Zitadel immediately using the
plain-text password (Zitadel will natively hash it).
> 
> If Invalid (400): Reject login or check if the user is already in
Zitadel.
> 
> Sunset: After the grace period ends, migrate remaining inactive users
using Strategy 1.
> (Note: Do not log plain-text passwords and strictly enforce HTTPS
during this phase).

---
🤖 **Need adjustments?**
Leave a comment below and tag **@zitadel-knowledge-bot** with your
requested changes, and I will automatically update the files and push a
new commit!

---------

Co-authored-by: zitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-07-07 12:43:28 +00:00
Gayathri VijayanGitHubCopilot Autofix powered by AILivio Spring
 		942607e0e9 feat: implement UpdateZitadelProvider in ManagementService (#12384) 
# Which Problems Are Solved

This PR adds support for updating ZITADEL identity provider (IDP)
templates.

# How the Problems Are Solved

- Implements `UpdateZitadelProvider` in the Management gRPC server plus
converter
- Introduces an org-scoped `ZitadelIDPChanged` event and registers its
event mapper.
- Adds command-side support to update org Zitadel providers and appends
the new event to the org write model.
- Extends the IDP template projection reducer to accept org change
events.

# Additional Changes
N/A

# Additional Context
Closes https://github.com/zitadel/zitadel/issues/11922
Follow up for PRs:

- https://github.com/zitadel/zitadel/pull/12018
- https://github.com/zitadel/zitadel/pull/12020
- https://github.com/zitadel/zitadel/pull/12055
- https://github.com/zitadel/zitadel/pull/12056
- https://github.com/zitadel/zitadel/pull/12371
- https://github.com/zitadel/zitadel/pull/12378

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
 2026-07-07 04:32:18 +00:00
Max PeintnerGitHubLivio Spring
 		bc9333aef9 chore: update npm dependencies (#12375) 
# Which Problems Are Solved

- npm dependencies across the monorepo are behind current patch/minor
releases.
- Transitive dependencies are pinned to older versions by parent
packages (karma, nx, @changesets/cli, etc.).
- Console build fails after the Angular toolchain update because
`angular.json` references assets outside the workspace root.

# How the Problems Are Solved

- Bumps `@angular/*` to `^21.2.17` in console.
- Bumps `js-yaml` to `^4.2.0` in docs.
- Bumps `concurrently` to `^10.0.3` in login.
- Adds pnpm overrides for transitive deps that cannot be bumped directly
(ws, undici, minimatch, esbuild, dompurify, qs, and others).

# Additional Changes

- Removes 10 overrides that are no longer needed after parent packages
resolve to newer versions.
- Updates 4 existing overrides (`tar`, `js-yaml`, `dompurify`,
`brace-expansion`) to match current upstream ranges.
- 2 low-severity findings remain via the abandoned `raw-loader` package
in docs (peer dep resolution; no upstream fix without replacing
`raw-loader`).
- Fixes console build: replaced the `angular.json` asset glob
`../apps/docs/public/img/tech` with a `prebuild` script that copies tech
images into `src/assets/docs/img/tech`. **Verify at runtime that tech
images on project grant / integration pages still load.**

# Additional Context

- Overrides remain where parent packages still pin older transitive
versions.
- The `angular.json` asset path issue predates this PR (not introduced
by the Angular bump).

---------

Co-authored-by: Livio Spring <[email protected]>
 2026-07-06 14:18:51 +00:00
Gayathri VijayanGitHubCopilot Autofix powered by AI
 		653a968d91 feat: implement instance-level UpdateZitadelProvider (#12378) 
# Which Problems Are Solved

This PR implements the instance-level `UpdateZitadelProvider` endpoint,
enabling updates to existing instance Zitadel IdP templates.

# How the Problems Are Solved

- Added `AdminService.UpdateZitadelProvider` handler, converter
- Added the command-layer implementation to update a ZitadelProvider and
push `instance.idp.zitadel.changed` event
- Added projection-layer implementation to persist Zitadel provider
updates into `projections.idp_templates6_zitadel`
- Added unit and integration tests


# Additional Changes
N/A

# Additional Context
Related to https://github.com/zitadel/zitadel/issues/11922
Follow-up for PRs:
- https://github.com/zitadel/zitadel/pull/12018
- https://github.com/zitadel/zitadel/pull/12020
- https://github.com/zitadel/zitadel/pull/12055
- https://github.com/zitadel/zitadel/pull/12056
- https://github.com/zitadel/zitadel/pull/12371

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-07-06 10:18:35 +02:00
Max PeintnerGitHubLivio Spring
 		1beabed8cf fix(login): preserve org domain suffix through account chooser navigation (#12304) 
Closes #12024

# Which Problems Are Solved

When the login flow is started with an
`urn:zitadel:iam:org:domain:primary:{domain}` scope, the resolved domain
suffix is lost if the user navigates through the account chooser (e.g.
clicking "Use another account"). This causes the login to fail with
"User not found" because the organization can no longer be resolved.

Additionally, the `hideLoginNameSuffix` branding setting was never
respected by the login app.

# How the Problems Are Solved

- Forward the `orgDomain` parameter through `gotoAccounts()` and the
`/accounts` page, so it survives navigation to `/loginname` — the same
way `organization` and `requestId` are already forwarded.
- Respect `BrandingSettings.hideLoginNameSuffix`: when enabled, the
`@domain.com` suffix is hidden from the input UI but still used
internally for user search.

---------

Co-authored-by: Livio Spring <[email protected]>
 2026-07-03 16:25:20 +02:00
elinashokoGitHubElina SokolovskaClaude Sonnet 4.6Fabienne Bühler
 		6b629c2290 docs: update roadmap and remove release cycle page (#12373) 
Removes the release cycle page and sidebar entry. Replaces the roadmap
page with updated strategic roadmap content and renames its sidebar
label to Roadmap.

---------

Co-authored-by: Elina Sokolovska <[email protected]>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: Fabienne Bühler <[email protected]>
 2026-07-03 21:06:22 +07:00
Gayathri VijayanGitHubCopilot Autofix powered by AI
 		5dcce9abdb feat: add api definition to update Zitadel IdP (#12371) 
# Which Problems Are Solved

Enabling updates on the Zitadel Identity Provider

# How the Problems Are Solved

This PR adds API definitions to update Zitadel provider at instance and
organization levels.

# Additional Changes
N/A

# Additional Context
- Related to https://github.com/zitadel/zitadel/issues/11922
- Follow-up for PRs: 
   - https://github.com/zitadel/zitadel/pull/12018
   - https://github.com/zitadel/zitadel/pull/12020
   - https://github.com/zitadel/zitadel/pull/12055
   - https://github.com/zitadel/zitadel/pull/12056

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-07-03 12:52:26 +00:00
Max PeintnerGitHubLivio Spring
 		e6aaea563e fix(login): migrate legacy Tailwind v4 opacity utilities and fix checkbox contrast color (#12360) 
# Which Problems Are Solved

1. **Secondary button hover effect** was rendering a solid white/gray
background instead of a subtle transparent overlay. The legacy
`bg-opacity-*` utility (e.g. `hover:bg-gray-500 hover:bg-opacity-20`)
doesn't compose with `bg-*` in Tailwind v4 — the opacity is ignored,
leaving a solid color. The same issue affected `ring-opacity-*` and
`border-opacity-*` across other components.

2. **Checkbox checkmark color** was hardcoded to white (`fill='white'`
in the SVG), ignoring the theme's primary contrast color. On themes with
a light primary color, the white checkmark was invisible.

# How the Problems Are Solved


1. Migrated all legacy opacity utilities to the Tailwind v4 slash
syntax:
   - `hover:bg-gray-500 hover:bg-opacity-20` → `hover:bg-gray-500/20`
- `ring-primary-light-500 ring-opacity-60` → `ring-primary-light-500/60`
- `focus:ring-opacity-50` + `focus:ring-indigo-200` →
`focus:ring-indigo-200/50`
- Removed redundant `border-opacity-20` where `border-black/10` was
already applied

2. Replaced the static `background-image` checkbox SVG with a
`mask-image` + `::after` pseudo-element approach. The checkmark color
now uses `var(--theme-light-primary-contrast-500)` /
`var(--theme-dark-primary-contrast-500)`, so it dynamically follows the
theme's contrast color.

---------

Co-authored-by: Livio Spring <[email protected]>
 2026-07-03 12:39:09 +00:00
Max PeintnerandGitHub 92ea32a34d fix(login): use correct requestId with oidc_ prefix in Prompt.LOGIN + loginHint flow (#12376) 
Closes #11946

# Which Problems Are Solved

- OIDC redirect is broken when `Prompt.LOGIN` + `loginHint` is used —
the user lands on `/signedin` instead of being redirected to the OIDC
client's callback URL (fixes #11946)

# How the Problems Are Solved

- In `handleOIDCFlowInitiation`, the `Prompt.LOGIN` + `loginHint` code
path was passing `authRequest.id` (raw ID without `oidc_` prefix) to
`sendLoginname`. Without the prefix, `completeFlowOrGetUrl` does not
recognize the flow as OIDC and falls through to the "Regular flow" path,
redirecting to `/signedin` instead of calling `createCallback`. Fixed by
using the `requestId` parameter which already carries the `oidc_`
prefix.

# Additional Changes

- Standardized all request ID references in `handleOIDCFlowInitiation`
to consistently use the `requestId` parameter instead of reconstructing
it with `` `oidc_${authRequest.id}` ``. This eliminates the
inconsistency that caused the bug and prevents similar issues in the
future.
- Removed a redundant `if (authRequest.id)` guard in the LDAP redirect
path, since `requestId` is always present as a required parameter.
- Added regression tests verifying that `sendLoginname` receives the
`requestId` with the `oidc_` prefix in the `Prompt.LOGIN` + `loginHint`
code path.
 2026-07-03 14:18:01 +02:00
Max PeintnerGitHubCopilot Autofix powered by AI
 		f32acbfd24 fix(login): redirect to loginname instead of empty accounts page when org scope filters all sessions (#12346) 
Closes #11914

# Which Problems Are Solved

When an OIDC auth request includes an organization scope
(`urn:zitadel:iam:org:id:{id}` or
`urn:zitadel:iam:org:domain:primary:{domain}`), users with existing
browser sessions from *other* organizations were shown an empty Account
Selection page with no selectable accounts. The only option was to click
"Add another account", adding a confusing and unnecessary extra step.

This happened because the `/login` route checked `sessions.length` (all
browser sessions, unfiltered) to decide whether to enter the "reuse
existing session" branch. Inside that branch, `findValidSession`
correctly filtered by organization and returned no match — but the
fallback redirected to `/accounts`, which also filters by org and
rendered empty.

# How the Problems Are Solved

Before deciding to redirect to `/accounts`, pre-filter sessions by the
requested organization using the same logic already used by the accounts
page and `findValidSession`. If no sessions are eligible for the target
organization, redirect directly to `/loginname` instead.

This applies to both the **default prompt** and
**`prompt=select_account`** branches. For `select_account`, this matches
the behavior of major OIDC providers like Google and Microsoft, which
skip the account chooser and go straight to the login input when there
are no sessions to select from. The OIDC spec describes `select_account`
as enabling selection "amongst multiple accounts that they might have
current sessions for" — showing an empty picker serves no purpose.

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-07-02 07:18:43 +00:00
Rajat SinghGitHubRajat Singh
 		b4e205c601 docs: add IdP claim mapping troubleshooting to Actions V2 response manipulation guide (#12339) 
# Which Problems Are Solved

- The documentation had no guidance for debugging auto-user-creation
failures caused by unexpected or missing claims from an external IdP,
leaving users without a path forward when they see a
`SetHumanProfile.GivenName` validation error during OIDC login.

# How the Problems Are Solved

- Adds a troubleshooting section to the Actions V2 response manipulation
guide explaining how to use the `RetrieveIdentityProviderIntent` webhook
to inspect `rawInformation` and identify claim key mismatches from the
external IdP.

# Additional Changes

- None

Signed-off-by: Rajat Singh <[email protected]>
Co-authored-by: Rajat Singh <[email protected]>
 2026-07-01 09:35:06 -03:00
Tim MöhlmannGitHubLivio Spring
 		f275c2ffee chore: replace deprecated labels with issue types in templates (#12355) 
# Which Problems Are Solved

The org is migrating from label-based issue classification to GitHub
Issue Types. Issue templates that hardcode `labels:` silently re-add
those labels every time an issue is opened, which blocks the label
cleanup. The `docs` label is also being renamed to `area/docs`, and a
couple of Dependabot labels are being aligned with the new naming
scheme.

# How the Problems Are Solved

Issue templates (these already declare a `type:`, so the deprecated
label is simply removed rather than duplicating the type):

- `.github/ISSUE_TEMPLATE/BUG_REPORT.yaml` — removed `labels: ["bug"]`
(keeps existing `type: Bug`)
- `.github/ISSUE_TEMPLATE/enhancement.yaml` — removed `labels:
["enhancement"]` (keeps existing `type: enhancement`)
- `.github/ISSUE_TEMPLATE/docs.yaml` — `labels: ["docs"]` → `labels:
["area/docs"]`

# Additional Changes

`.github/dependabot.yml` — renamed deprecated label strings in the
`labels:` blocks (the `package-ecosystem` identifiers are left
unchanged):

- `"npm"` → `"javascript"`
- `"gomod"` → `"go"`
- `"documentation"` → `"area/docs"`

# Additional Context

Part of the org-wide migration from label-based issue classification to
GitHub Issue Types.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---
_Generated by [Claude
Code](https://claude.ai/code/session_01MA7kgVw1fjMW32K7FyPASQ)_

Co-authored-by: Livio Spring <[email protected]>
 2026-07-01 07:33:00 +00:00
Livio SpringandGitHub 1e0b810dca feat: allow managing invite code in secret generators (#12109) 
# Which Problems Are Solved

Zitadel exposes the secrets generator configuration through its admin
api. This allows instance admins to manage them on their own and they
can create overwrite the system / runtime defaults (incl. expiration).
This very much needed in multi-instance scenarios such as zitadel.cloud.
Currently the invite code configuration was not manageable through the
API, but only runtime config.

# How the Problems Are Solved

- added the `invite_code` type to the API allowing it to be set and
retrieved.
- added the type to console's management list
- added the type to be stored on instance setup
- change the `GetSecretGenerator` endpoint to fall back to the runtime
config if no config is stored on the instance itself
- ensure the `length` and at least one charset is enabled, return an
error otherwise
- expiry is not enforced, so 0 allows codes with no expiry (current
state)

# Additional Changes

None

# Additional Context

- closes https://github.com/zitadel/zitadel/issues/10474
 2026-07-01 04:53:16 +00:00
Max PeintnerandGitHub 782133dbc7 fix(login): improve error handling for user registration (#12338) 
# Which Problems Are Solved

When the registerUser server action failed during registration, all
errors from addHumanUser, createSessionWithRetry, and getUserByID
propagated as uncaught exceptions to the client component's generic
catch block, which always showed the same "Could not register user"
message. This made it impossible to distinguish between user creation
failures, session creation failures, and user lookup failures — both for
end users and in server logs.

# How the Problems Are Solved

Added .catch() handlers on the three gRPC calls in registerUser that log
the actual error and return null, allowing the existing null-check guard
clauses to return step-specific error messages (couldNotCreateUser,
couldNotCreateSession, userNotFound) through handleServerActionResponse.
This gives users more specific feedback and provides server-side logging
to narrow down the root cause of flaky signup failures.
 2026-06-30 13:35:10 +00:00
Livio SpringGitHubMax Peintner
 		4dc89b499f fix(login): allow custom protocols for native apps again (#12332) 
# Which Problems Are Solved

- Native apps (mobile/desktop) use custom protocol schemes (e.g.
`myapp://callback`, `io.zitadel.app://auth`) as OAuth/OIDC redirect
URIs. The previous redirect-safety check in the login UI only allowed
`http:`/`https:` absolute URLs, so these custom-scheme callbacks were
wrongly rejected and native app login flows were broken.
- Even for valid external redirects, `router.push()` triggers an RSC
prefetch `fetch()` that is blocked by the CSP `connect-src 'self'`
directive for non-same-origin URLs, so navigation to
external/custom-protocol targets failed.
- SAML and OIDC callback URLs returned from the backend were not
consistently validated before being used for redirects/POSTs across the
various flow entry points.

# How the Problems Are Solved

- Reworked `isSafeRedirectUri` to use `@braintree/sanitize-url` instead
of a strict `http/https`-only allowlist. Custom protocol schemes are now
permitted, while dangerous schemes (`javascript:`, `data:`, plus an
explicit block of `file:`, `blob:`, `about:`) are still rejected.
- Added `isExternalUrl` helper to distinguish internal relative paths
(`/...`) from external/custom-protocol targets.
- In `handleServerActionResponse`, external/custom-protocol redirects
now navigate via `window.location.href` (full navigation) instead of
`router.push()`, avoiding the CSP-blocked RSC prefetch. Internal paths
continue to use `router.push()`.
- Added consistent redirect-URI validation for SAML and OIDC callbacks
across all relevant entry points (`oidc.ts`, `saml.ts`,
`server/flow-initiation.ts` including the `prompt=none` path, and the
SAML `samlData` POST case), blocking unsafe URLs with a clear warning
and error response.

# Additional Changes

- Added `@braintree/sanitize-url` (`^7.1.2`) dependency to `apps/login`
(`package.json` / `pnpm-lock.yaml`).
- Added unit tests for `isExternalUrl` covering relative paths, absolute
HTTP/HTTPS URLs, custom protocol schemes, and protocol-relative URLs.
- Annotated the intentional `window.location.href` navigation with a
CodeQL suppression comment, documenting that the URL is validated by
`isSafeRedirectUri` beforehand.
- Minor formatting cleanup in `console` JWT provider component.

# Additional Context

- This restores behavior that previously worked for native apps but
regressed when redirect validation was tightened to `http`/`https` only.

---------

Co-authored-by: Max Peintner <[email protected]>
 2026-06-30 13:19:40 +00:00
SilvanGitHubMarco A.Livio Spring
 		f9995ee39c fix: increase performance of ListUser by login name ignore case (#12350) 
# Which Problems Are Solved

Login v2 uses the `users.v2.ListUsers`-endpoint to get a user by login
name. This query had an inefficient `WHERE`-clause.

# How the Problems Are Solved

Update the view and use a specific clause for this query.

# Additional information

Added in https://github.com/zitadel/zitadel/pull/10475

---------

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
 2026-06-30 11:20:21 +00:00
zitadel-knowledge-bot[bot]GitHubzitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>
 		561da54ff7 docs: update knowledge gap from thread 1517531035175354430 (#12352) 
Automatically generated PR targeting 1 files.

**Thread ID:** 1517531035175354430
**Action:** UPDATE

**AI Summary:**
> Documentation does not explain what happens when users bookmark the
login page or access ZITADEL without an OIDC flow, particularly
regarding redirect behavior and the purpose of organization Default
Redirect URI settings.

Co-authored-by: zitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>
 2026-06-30 07:33:25 -03:00
Max PeintnerandGitHub 3a18cef281 fix: prevent double triggering of verification emails (#11995) 
# Which Problems Are Solved

This fixes a critical bug where initial verification emails (or invite
codes) were occasionally sent twice, invalidating the first code and
confusing users.

Previously, the initial verification email was triggered via a
`send=true` URL parameter executing inside a frontend useEffect exactly
when the `/verify` page mounted. This was fragile and prone to race
conditions caused by component remounts or partial hydration.

# How the Problems Are Solved

- Removed `send=true` from URL state and ripped out the doSend effect in
`VerifyForm.tsx`.
- Shifted execution strictly to the Next.js server. The email is now
automatically dispatched via await `initialSendVerification(...)` during
the POST requests (acting over `sendLoginname`, `register`, `password`,
`passkeys`, and `idp`).
- The login flow is now idempotent and robust against unintended
frontend re-renders.
- Refactored `checkEmailVerification()` to be async and updated the
associated unit-test coverage (all tests passing).
 2026-06-29 11:42:45 +03:00
Max PeintnerGitHubDavid SkewisFlorian Forster
 		14874d6546 fix(login): Prevent IDP auto-creation failure when name fields are missing (#11070) 
# Which Problems Are Solved

When using IDP auto-creation, the addHuman() call would fail if the IDP
didn't provide required profile fields (givenName or familyName),
resulting in a poor user experience.

# How the Problems Are Solved

Added validation before auto-creation to check if required profile
fields are present. If givenName or familyName is missing, users are now
redirected to the complete-registration page where they can manually
provide the missing information.

- Added profile field validation in CASE 4 (auto-creation) of
processIDPCallback
- Redirect to /idp/{provider}/complete-registration when required fields
are missing
- Pre-fill any available user data in the registration form

---------

Co-authored-by: David Skewis <[email protected]>
Co-authored-by: Florian Forster <[email protected]>
 2026-06-26 08:01:09 +00:00
Federico CoppedeandGitHub f96080a4c1 docs: update applications image (#12331) 2026-06-24 14:25:32 -03:00
zitadel-knowledge-bot[bot]GitHubzitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>fcoppede
 		9ccafca12b docs: update knowledge gap from thread 1512031509387673610 (#12328) 
Automatically generated PR targeting 1 files.

**Thread ID:** 1512031509387673610
**Action:** UPDATE

**AI Summary:**
> The documentation lacks clear explanation of how the 'Use new login
UI' checkbox and 'Custom base URL for the new Login UI' field work
together, including step-by-step configuration and troubleshooting
guidance.

---------

Co-authored-by: zitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>
Co-authored-by: fcoppede <[email protected]>
 2026-06-24 15:32:38 +00:00
Matías RacedoGitHubMax PeintnerMax Peintner
 		2397247925 fix(login): improve contrast of IDP processing message (#12309) 
# Which Problems Are Solved

This improves the contrast of the “Processing authentication...” message
shown while Login V2 processes the IDP authentication flow.

The previous style used text-gray-600 without a dark-mode variant. This
color is hard-coded in the component and is not affected by the branding
colors, so users may see low contrast depending on the active
theme/background.

This PR updates the message text to use a higher-contrast light/dark
color pair.

---------

Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
 2026-06-24 10:30:44 +00:00
zitadel-knowledge-bot[bot]GitHubzitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>
 		64b1a7d42b docs: update knowledge gap from thread manual-1782237446658 (#12323) 
Automatically generated PR targeting 1 files.

**Thread ID:** manual-1782237446658
**Action:** UPDATE

**AI Summary:**
> Need to add a note on this page to encourage users with active
subscriptions to link their github and Discord account because that will
help github issues get higher priority and discord threads as well

Co-authored-by: zitadel-knowledge-bot[bot] <296006658+zitadel-knowledge-bot[bot]@users.noreply.github.com>
 2026-06-23 18:19:29 -03:00
Wim Van LaerandGitHub 2399513643 Merge commit from fork 
* fix: added client and scope validation for token exchange

Verify that the token exchange is not cross client

Only yield scopes which were already on the initial token

* comments

* added test
 2026-06-22 11:38:49 +02:00
Livio SpringandGitHub 76fd6d859d Merge commit from fork 
* fix: ensure external user's email is verified before auto-linking

* fix linking
 2026-06-22 11:38:21 +02:00
Max PeintnerandGitHub 239620f112 fix(login): center text for generic IDP buttons without icons (#12211) 
Closes #12182

# Which Problems Are Solved

Generic IDP buttons (OIDC, SAML, LDAP, JWT) used pl-20 to approximate
icon offset alignment, but since they have no icon, the text appeared
misaligned compared to branded IDPs (Google, Microsoft, Apple).

# How the Problems Are Solved

Replaced the left-padding hack with centered text so generic IDP names
display cleanly within the button.

before:

<img width="392" height="290" alt="Screenshot 2026-05-28 at 12 03 21"
src="https://github.com/user-attachments/assets/64c4e8eb-caec-4742-b61c-e3b0c5093dd7"
/>

after:

<img width="392" height="289" alt="Screenshot 2026-05-28 at 12 07 27"
src="https://github.com/user-attachments/assets/d1faf1f4-0aab-475f-8801-15b461e15da4"
/>
 2026-06-22 08:57:18 +00:00
Max PeintnerandGitHub f691851d32 Merge commit from fork 2026-06-22 10:34:26 +02:00
SilvanGitHubLivio Spring
 		10087e7389 fix: connection handling in setup after migration steps 40, 64 and 70 (#12293) 
# Which Problems Are Solved

During the setup step we saw rare cases which caused setup to fail after
executing steps 40, 64 and 70.

# How the Problems Are Solved

Close currently open database connections so that they fetch the correct
type mapping for the `eventstore.command2` database type.

# Additional Changes

Ensure correct order of setup steps 64 and 70.

# Additional Context

None

---------

Co-authored-by: Livio Spring <[email protected]>
 2026-06-16 15:09:00 +00:00
Livio SpringandGitHub dbb0da71af fix: remove unnecessary entry from default denylist (#12294) 
# Which Problems Are Solved

The updated default denylist added an entry for IPv4-mapped IPv6
addresses to prevent IPv6 encapsulation bypasses.
This is not necessary since the IP already gets resolved into v4 and now
blocks them all.

# How the Problems Are Solved

Removed the entry.

# Additional Changes

None

# Additional Context

None
 2026-06-16 16:52:26 +02:00
Gayathri VijayanandGitHub 0973b074b4 Merge commit from fork 
* fix: client_id verification during code exchange and refresh token flows

* add clientID check for device token flow

* Trigger Build
 2026-06-16 15:19:56 +02:00
Tim MöhlmannandGitHub e94d4c3986 feat(crypto): FIPS 140-3 compliant build and runtime checks (#12233) 
# Which Problems Are Solved

Enable FIPS 140-3 compliant build.

# How the Problems Are Solved

- Add runtime config validation, if the FIPS flag is enabled fail the
application when a non-compliant hasher is used, or throw a warning when
a legacy verifier is used
- Add a build matrix for FIPS certified build:
  - Go binary is built with `GOFIPS140=certified`
- Login container uses a separate base:
[ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e)
from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS
stack)
- Non-FIPS images where already pushed to both Github Container Registry
and Google Artifact Repository (GAR). Fips images are only pushed to the
GAR.
- Tag versions are suffixed `-fips`. So on release the following images
will be additionally available:

```
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips
```
  
# Other changes

- Bumb Go toolchain. At least v1.25.10 is required for a
GOFIPS140=certified setting.
 
# Additional Context

- Closes https://github.com/zitadel/zitadel/issues/4335
- Build [test
run](https://github.com/zitadel/zitadel/actions/runs/27253916052)
pushing FIPS and non-FIPS images
 2026-06-16 10:16:49 +02:00
Max PeintnerandGitHub fdafb95a63 fix(login): load custom font from branding settings and allow in CSP (#12279) 
Closes #11200

# Which Problems Are Solved

Custom fonts uploaded via the branding/label policy were not supported.

# How the Problems Are Solved

- The login now correctly applies the branding settings, based on the
organization context
- Use the absolute `fontUrl` from the branding API directly in the
`@font-face` `src`, matching how logo and icon assets are already loaded
via absolute URLs.
- Add the Zitadel service URL to the `font-src` CSP directive so the
browser permits loading the cross-origin font.

# Additional Changes

- Updated CSP tests to reflect the new `font-src` behavior.
 2026-06-15 14:33:54 +00:00
Marco A.GitHubLivio Spring
 		8e82ec1cb9 Merge commit from fork 
* Add DenyLists parsing

* Remove unneeded returned error

* Plug global denylist into Command

* app creation: apply denylist to backchannel logout URI

* Inject denylist to backchannel logout worker

* webhook config: validate against blocked URLs

* Add notificationsWebhook denylist target

* command: Add SMTP endpoint validation against blocklist

* command: Add SMS endpoint validation against blocklist

* Validate webhook endpoint against denylist on channel notification

* Remove unused tests

* handle deprecated denylists

* remove unintended denylist entry in deprecated list

* use single http client

* fix tests

* update comments

* fixes

* cleanup

* address comments

* fix merge

---------

Co-authored-by: Livio Spring <[email protected]>
 2026-06-15 15:36:14 +02:00
Livio SpringandGitHub d184e976fc Merge commit from fork 
* feat(jwt idp): manage and validate audience

* translations

* fix tests

* address comments

* update migration version

* fix merge
 2026-06-15 15:27:47 +02:00
Livio SpringandGitHub fad02c6d9f Merge commit from fork 2026-06-15 14:29:08 +02:00
SilvanGitHubabhishek kumar gupta
 		6082e59d47 fix(eventstore): allow overwriting resource owner of events (#12261) 
# Which Problems Are Solved

- The eventstore did not support intentionally overwriting the resource
owner when creating events for aggregates that may be reused across
owners.
- Resource owner handling was implicit and could not be controlled per
command/event type.
- We needed a safe way to distinguish between:
  - keeping the existing aggregate owner, and
  - explicitly setting a new owner for specific create-like events.

# How the Problems Are Solved

- Introduced a new eventstore command type with an explicit
enforce_owner flag.
- Updated eventstore.commands_to_events and eventstore.push so owner
assignment is now explicit:
  - if enforce_owner is true, the command owner is written
- if enforce_owner is false, the existing aggregate owner is retained
when present
- Added EnforceResourceOwnerCommand and wiring so command types can opt
in to enforced owner behavior.
- Wired the new behavior through the v3 eventstore push path, including
compatibility fallback for older command type mapping.
- Added migration/setup changes to register and use the new command type
and SQL functions.
- Added and updated tests for owner overwrite and aggregate ID reuse
scenarios.

# Additional Changes

- Added small migration/setup robustness improvements related to
eventstore setup ordering and helper reuse.
- Added focused test coverage for enforced owner behavior and
sequencing.
- Events that currently allow owner changes (implement
EnforceResourceOwner) are:
  - AddedEvent (action)
  - GroupAddedEvent
  - StartedEvent (idp intent)
  - ProjectAddedEvent
  - HumanAddedEvent
  - HumanRegisteredEvent
  - MachineAddedEvent
  - CreatedEvent (schema user)

# Additional Context

- Follow-up for eventstore owner-handling correctness in create flows
and aggregate ID reuse cases.
- No additional issue link was attached for this change.

---------

Co-authored-by: abhishek kumar gupta <[email protected]>
 2026-06-15 11:24:37 +02:00
Max PeintnerandGitHub 4459a1380c fix(login): accept IDP sessions on passkey registration (#12275) 
# Which Problems Are Solved

The local `isSessionValid` in `passkeys.ts` only checked `password` and
`webAuthN` factors, so sessions authenticated via an external IDP
(`intent` factor) were treated as invalid. This caused a "You have to
authenticate" error when redirecting to `/passkey/set` after IDP login.

# How the Problems Are Solved

Added `session.factors.intent.verifiedAt` to the validity check,
consistent with the canonical `isSessionValid` in `session.ts`.
 2026-06-12 12:17:37 +00:00
EvanandGitHub cf4554b82c fix(idp): apply PKCE when building OAuth and OIDC providers (#12247) 
# Which Problems Are Solved

- IDP intent authorization redirects used by Login v2 ignored the
configured `UsePKCE` setting for Generic OAuth providers
- This caused providers such as X/Twitter OAuth2 to receive
authorization requests without `code_challenge` and
`code_challenge_method`
- OIDC provider construction had the same gap, even though PKCE is
already part of the provider configuration model
- Existing IDP intent redirect tests expected non-PKCE OAuth URLs and
failed once PKCE was applied correctly

# How the Problems Are Solved

- Updated `OAuthIDPWriteModel.ToProvider` in
internal/command/idp_model.go to pass `rp.WithPKCE(nil)` when `UsePKCE`
is enabled
- Updated `OIDCIDPWriteModel.ToProvider` to apply the same PKCE
relying-party option for OIDC providers

# Additional Changes

- Added focused provider-construction tests covering:
    - OAuth provider redirects include code_challenge
    - OIDC provider redirects include code_challenge
    - both providers use code_challenge_method=S256
    - both persist the generated codeVerifier for token exchange
- Updated `TestCommands_AuthFromProvider` in
internal/command/idp_intent_test.go so OAuth redirect assertions verify
PKCE structurally instead of hard-coding the generated challenge value

# Additional Context

- Reproduced with X/Twitter OAuth2 where the generated authorization URL
was missing PKCE parameters despite `usePkce: true`
- Verified both the focused PKCE tests and the full unit test suite run
successfully with the fix
- Closes #12036 
- Closes/supersedes #12054:
  - Tests are included
  - No slice re-allocation on `opts` append
  
# Result

### Before

`authUrl` in `StartIdentityProviderIntent` response is missing
`code_challenge` and `code_challenge_method` for Generic OAuth IDP with
PKCE enabled:
```json
{
    "details": {
        "sequence": "1",
        "changeDate": "2026-06-07T18:48:16.921317Z",
        "resourceOwner": "376298239768395779"
    },
    "authUrl": "https://x.com/i/oauth2/authorize?client_id=<REDACTED>&prompt=select_account&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fidps%2Fcallback&response_type=code&scope=tweet.read+users.email+users.read+offline.access&state=376417136207200259"
}
```

### After

`code_challenge` and `code_challenge_method` are correctly included into
`authUrl`:

```json
{
    "details": {
        "sequence": "1",
        "changeDate": "2026-06-07T18:49:39.488941Z",
        "resourceOwner": "376298239768395779"
    },
    "authUrl": "https://x.com/i/oauth2/authorize?client_id=<REDACTED>&code_challenge=8G4vN8QNgSsbvGSHKwYPEc2qUYU2BK5L0fsr992duTA&code_challenge_method=S256&prompt=select_account&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fidps%2Fcallback&response_type=code&scope=tweet.read+users.email+users.read+offline.access&state=376417274736672771"
}
```
 2026-06-11 19:52:11 +02:00
MaximilianandGitHub c5463b51ff docs: Update security.md (#12267) 
We introduce a common vulnerabiltiy policy and a from for reporting
vulnerabilties.
 2026-06-10 11:53:26 +00:00
MaximilianGitHubCopilot Autofix powered by AI
 		385c5ae54b docs: Update restrict console guide (#12262) 
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

The projects setting texts and sceenshot where outdated. 

# How the Problems Are Solved

Update the text and screenshot.

# Additional Changes

* Rewording
* Lockout warning component

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-06-10 10:38:37 +00:00
Max PeintnerandGitHub b27fdfc28c chore: update dependencies (#12242) 
# Which Problems Are Solved

Fixes multiple high-severity Dependabot alerts for transitive
dependencies (axios, protobufjs, systeminformation, tmp, fast-uri,
@babel/plugin-transform-modules-systemjs).
 
# How the Problems Are Solved

**Direct dependency updates:**
- `@opentelemetry/*` 0.217 → 0.218 in login (new otlp-transformer
dropped protobufjs as direct dep)
- `posthog-js` 1.374 → 1.380 in console (dropped the
OpenTelemetry/protobufjs chain entirely)

**pnpm overrides** for remaining transitive deps that can't be updated
via their parents (all pulled by the gRPC stack, Cypress, karma, nx, or
ajv):
- `axios` → ≥1.17.0 (prototype pollution, proxy bypass)
- `protobufjs` → ≥7.5.7 / ≥8.0.2 (code injection, prototype pollution,
DoS)
- `systeminformation` → ≥5.31.6 (command injection)
- `tmp` → ≥0.2.6 (path traversal)
- `fast-uri` → ≥3.1.2 (path traversal, host confusion)

**Benchmark:** refreshed `package-lock.json` to resolve @babel and
fast-uri alerts.
 2026-06-09 16:27:12 +02:00
Marco A.andGitHub ed09b3df7f Merge commit from fork 2026-06-08 16:41:08 +02:00
Tim MöhlmannGitHubcopilot-swe-agent[bot] <[email protected]>Livio Spring
 		25e263394e chore: update passwap v0.12.1 and align hash validation defaults/errors (#12179) 
# Which Problems Are Solved

- Upgrading to `zitadel/passwap` v0.12.1 introduced new encoded-hash
validation paths that still had review feedback open.
- Secret hasher defaults were internally inconsistent (`Hasher.Cost: 4`
vs `Limits.Bcrypt.MinCost: 10`), which could reject hashes created by
the configured hasher.
- New validation error IDs/messages and test coverage needed to be
aligned with project conventions and expected behavior branches.

# How the Problems Are Solved

- Kept the dependency upgrade to `zitadel/passwap` v0.12.1 and completed
the validation integration.
- Updated `ValidateEncodedHash` error handling in
`internal/crypto/passwap.go` to:
  - use unique random-style error IDs,
  - return `Errors.Hash.NotSupported` for no-verifier cases,
  - keep invalid-hash branches mapped to invalid argument errors.
- Expanded `TestHasher_ValidateEncodedHash` in
`internal/crypto/passwap_test.go` to cover and assert:
  - bounds error branch,
  - no-verifier branch,
  - generic invalid-hash branch,
  - expected ZITADEL error IDs/messages.
- Restored lost inline verifier-context comments for argon2 and md5plain
verifier entries.

# Additional Changes

- Added the missing explanatory `Limits` comment for `SecretHasher` in
`cmd/defaults.yaml`.
- Corrected `SecretHasher.Limits.Bcrypt.MinCost` from `10` to `4` to
match the configured default bcrypt cost and avoid configuration
footguns.

# Additional Context

- Follow-up for PR review feedback in
https://github.com/zitadel/zitadel/pull/12179#pullrequestreview-4313121965

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
 2026-06-05 14:48:35 +02:00
Tim MöhlmannGitHubLivio SpringCopilot Autofix powered by AI
 		f85a2373c5 chore(test): streamline integration tests for instance management (#12243) 
- Removed redundant relational instance handling in integration tests
for adding and removing custom domains.
- Simplified test cases by consolidating instance creation and context
management.
- Enhanced clarity and maintainability of test logic by reducing
complexity in test structures.

# Which Problems Are Solved

`backed/v3` tests are flaky, but the code is not productive. Development
is paused for the moment. Disabling flaky tests helps us to maintain the
product easier.

# How the Problems Are Solved

- Removed redundant relational instance handling in integration tests
for adding and removing custom domains.
- Simplified test cases by consolidating instance creation and context
management.
- Enhanced clarity and maintainability of test logic by reducing
complexity in test structures.newly introduced terms).

# Additional Context

- related to https://github.com/zitadel/zitadel/pull/12241

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-06-05 11:36:45 +00:00
Tim MöhlmannandGitHub 7019a03ec4 chore(test): disable event_testing in backend/v3 (#12241) 
# Which Problems Are Solved

`backed/v3` tests are flaky, but the code is not productive. Development
is paused for the moment. Disabling flaky tests helps us to maintain the
product easier.

# How the Problems Are Solved


- Removed 'events_testing' from the integration test command in both
`CONTRIBUTING.md` and `apps/api/project.json` to streamline the testing
process.
- Adjusted the command to ensure it only includes relevant integration
tests, improving clarity and focus for contributors.
 2026-06-05 10:46:49 +02:00
Max PeintnerGitHubconblemLivio Spring
 		cdc6c43d09 fix: update dependencies (#12216) 
# Which Problems Are Solved

Fixes open vulnerabilities

# How the Problems Are Solved

Updated npm/js dependencies across console, new login v2, and docs
Based on https://github.com/zitadel/zitadel/pull/12164

---------

Co-authored-by: conblem <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
 2026-06-04 14:33:04 +02:00
Max PeintnerGitHubLivio SpringCopilot Autofix powered by AI
 		fc6e2a0f05 fix(login): retry logic for session creation after registration on NotFound (#12189) 
After user registration, the backend projections may not be up to date
yet when the Login UI immediately tries to create a session. This
results in a `QUERY-Dfbg2` ("User could not be found") error even though
the user was created successfully.

This adds retry logic with backoff (500ms/1s/2s, up to 3 attempts)
around `createSessionAndUpdateCookie` in the registration flow. Only
`NotFound` errors are retried — other errors are thrown immediately.

Closes #12173

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-06-01 16:49:07 +02:00
Florian ForsterGitHubClaude Opus 4.7
 		f4f43f5248 docs: fix broken GitHub code-reference blocks after fumadocs migration (#12213) 
# Which Problems Are Solved

Pages in `apps/docs` that embed source from GitHub via the Docusaurus
convention

````
```js reference

https://github.com/zitadel/actions/blob/main/examples/org_metadata_claim.js
```
````

stopped working after the migration from Docusaurus to fumadocs. The old
`docusaurus-theme-github-codeblock` plugin used to fetch the file and
render it; fumadocs has no support for that meta, so the page rendered
the raw URL as plain code-block text. Visible at
`/docs/apis/actions/code-examples` and 16 other pages.

# How the Problems Are Solved

- Converted every ```` ```<lang> reference\n<URL>\n``` ```` block (46
total across 17 `.mdx` files) to the native fumadocs JSX form:
`<GithubCodeBlock url="<URL>" />`. The existing `<details>`/`<summary>`
collapsibles around blocks are kept — they're an authoring choice, not
part of the rendering bug.
- Updated `apps/docs/components/github-code-block.tsx` to render via
`DynamicCodeBlock` from `fumadocs-ui/components/dynamic-codeblock`
(proper shiki highlighting) instead of raw `CodeBlock` + `Pre` (which
produced unhighlighted output). Also fixed language detection so a URL
hash like `#L10-L20` no longer pollutes the language token.
- Registered `GithubCodeBlock` globally in
`apps/docs/mdx-components.tsx`, matching how every other shared
component (`APIPage`, `Callout`, `Tab/Tabs`, `Step/Steps`, `Admonition`,
`TerminologyUpdate`) is exposed. MDX files no longer need a local
`import`.

# Additional Changes

- Normalized the two MDX files that were already using the JSX form
(`examples/secure-api/python-django.mdx`,
`examples/secure-api/java-spring.mdx`): removed their now-redundant
local `import { GithubCodeBlock }` and rewrote 9 long-form
`<GithubCodeBlock url="..."></GithubCodeBlock>` tags to self-closing for
consistency.

# Additional Context

Verified locally with `pnpm --filter @zitadel/docs dev`:

- `/docs/apis/actions/code-examples` — 20 shiki-highlighted code blocks
rendered inside the `<details>` collapsibles (was 0).
- `/docs/apis/openidoauth/claims` — line-range hashes (`#L9-L11`)
honored.
- `/docs/examples/login/flutter` — mixed languages (xml/dart/html)
detected and highlighted.
- `/docs/guides/integrate/external-audit-log` — edge case of fenced
reference indented inside a numbered list also converted and rendered.

Greps:
- `^[ \t]*\`\`\`[a-zA-Z0-9]+ reference` in `apps/docs/content/**/*.mdx`
→ 0 matches.
- `<GithubCodeBlock url="` in `apps/docs/content/**/*.mdx` → 55 matches.
- `from '@/components/github-code-block'` in
`apps/docs/content/**/*.mdx` → 0 matches.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>
 2026-05-28 11:02:44 -07:00
Marco A.andGitHub c73e58489b chore(deps): Update go-ntlmssp (#12193) 
# Which Problems Are Solved

Dependabot signalling that go-ntlmssp requires an update

# How the Problems Are Solved

`go get -u`
 2026-05-26 09:32:11 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Marco A.
 		349451b028 chore(deps): bump the console group across 1 directory with 31 updates (#12183) 
Bumps the console group with 31 updates in the /console directory:

| Package | From | To |
| --- | --- | --- |
|
[@angular/animations](https://github.com/angular/angular/tree/HEAD/packages/animations)
| `21.2.10` | `21.2.13` |
| [@angular/cdk](https://github.com/angular/components) | `21.2.8` |
`21.2.11` |
|
[@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common)
| `21.2.10` | `21.2.13` |
|
[@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler)
| `21.2.10` | `21.2.13` |
|
[@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core)
| `21.2.10` | `21.2.13` |
|
[@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms)
| `21.2.10` | `21.2.13` |
| [@angular/material](https://github.com/angular/components) | `21.2.8`
| `21.2.11` |
|
[@angular/material-moment-adapter](https://github.com/angular/components)
| `21.2.8` | `21.2.11` |
|
[@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser)
| `21.2.10` | `21.2.13` |
|
[@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic)
| `21.2.10` | `21.2.13` |
|
[@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router)
| `21.2.10` | `21.2.13` |
|
[@angular/service-worker](https://github.com/angular/angular/tree/HEAD/packages/service-worker)
| `21.2.10` | `21.2.13` |
|
[@tanstack/angular-query-experimental](https://github.com/TanStack/query/tree/HEAD/packages/angular-query-experimental)
| `5.100.5` | `5.100.11` |
|
[libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js)
| `1.12.42` | `1.13.2` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.372.3` |
`1.374.2` |
|
[zone.js](https://github.com/angular/angular/tree/HEAD/packages/zone.js)
| `0.16.1` | `0.16.2` |
|
[@angular-eslint/eslint-plugin](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin)
| `21.3.1` | `21.4.0` |
|
[@angular-eslint/eslint-plugin-template](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin-template)
| `21.3.1` | `21.4.0` |
|
[@angular-eslint/template-parser](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/template-parser)
| `21.3.1` | `21.4.0` |
| [@angular/build](https://github.com/angular/angular-cli) | `21.2.8` |
`21.2.11` |
| [@angular/cli](https://github.com/angular/angular-cli) | `21.2.8` |
`21.2.11` |
|
[@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli)
| `21.2.10` | `21.2.13` |
|
[@angular/language-service](https://github.com/angular/angular/tree/HEAD/packages/language-service)
| `21.2.10` | `21.2.13` |
|
[@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss)
| `4.2.4` | `4.3.0` |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `25.6.0` | `25.9.1` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin)
| `8.59.1` | `8.59.4` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)
| `8.59.1` | `8.59.4` |
| [eslint](https://github.com/eslint/eslint) | `10.2.1` | `10.4.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.5.0` |
`17.6.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.15` |
|
[tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss)
| `4.2.4` | `4.3.0` |


Updates `@angular/animations` from 21.2.10 to 21.2.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/animations's
releases</a>.</em></p>
<blockquote>
<h2>21.2.13</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img
src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix -
1c6553e97d" /></a></td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img
src="https://img.shields.io/badge/629905d537-fix-green" alt="fix -
629905d537" /></a></td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img
src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix -
0b7192f441" /></a></td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<h2>21.2.12</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img
src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix -
fe13bb669d" /></a></td>
<td>allow explicit read generic with signal input transforms</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img
src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix -
3430251fef" /></a></td>
<td>i18n flags leaking on errors</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img
src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix -
1aeebbe304" /></a></td>
<td>respect ngSkipHydration on components with projectable nodes in
LContainers</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img
src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix -
9e38ed7d57" /></a></td>
<td>sanitizer typings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img
src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix -
7a05a9a71a" /></a></td>
<td>validate security-sensitive attributes in i18n bindings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img
src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix -
c37f6ca42f" /></a></td>
<td>visit ng-let expression value in signal migration schematics</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img
src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix -
03ad53863b" /></a></td>
<td>prohibit concurrent submits in signal forms</td>
</tr>
</tbody>
</table>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/animations's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.13 (2026-05-13)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td>
<td>fix</td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>19.2.22 (2026-05-12)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings unconditionally
(<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td>
<td>fix</td>
<td>validate security-sensitive attributes in i18n bindings (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>20.3.21 (2026-05-12)</h1>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.12 (2026-05-08)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td>
<td>fix</td>
<td>allow service with factory on abstract classes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td>
<td>fix</td>
<td>remove compiler import from safe optional chaining migration</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v21.2.13/packages/animations">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/cdk` from 21.2.8 to 21.2.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/components/releases">@​angular/cdk's
releases</a>.</em></p>
<blockquote>
<h2>21.2.11</h2>
<p>No user facing changes in this release</p>
<h2>21.2.10</h2>
<h3>aria</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><img
src="https://img.shields.io/badge/48973661e-fix-green" alt="fix -
48973661e" /></a></td>
<td><strong>menu:</strong> do not set default aria-label (<a
href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</td>
</tr>
</tbody>
</table>
<h2>21.2.9</h2>
<h3>material</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/components/commit/51271c6194a9b55ee847c566a8960c9be5ec7cce"><img
src="https://img.shields.io/badge/51271c619-fix-green" alt="fix -
51271c619" /></a></td>
<td><strong>stepper:</strong> allow stepper to be labelled (<a
href="https://redirect.github.com/angular/components/issues/33137">#33137</a>)</td>
</tr>
</tbody>
</table>
<h3>cdk</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/components/commit/3a3852d45a4bbcfb23b46ca00e0eba1d70081ba3"><img
src="https://img.shields.io/badge/3a3852d45-fix-green" alt="fix -
3a3852d45" /></a></td>
<td><strong>tree:</strong> enter/space key on child node should not
toggle parent node expansion (<a
href="https://redirect.github.com/angular/components/issues/33125">#33125</a>)</td>
</tr>
</tbody>
</table>
<h3>aria</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/components/commit/bf14cc9d9fd349974cba853d4747b6859b3aae5b"><img
src="https://img.shields.io/badge/bf14cc9d9-fix-green" alt="fix -
bf14cc9d9" /></a></td>
<td><strong>menu:</strong> use computed for menu item patterns, with
trigger on visible (<a
href="https://redirect.github.com/angular/components/issues/33118">#33118</a>)</td>
</tr>
</tbody>
</table>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/components/blob/main/CHANGELOG.md">@​angular/cdk's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.11 &quot;crystal ball&quot; (2026-05-13)</h1>
<p>No user facing changes in this release</p>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.8 &quot;plastic-wallaby&quot; (2026-05-06)</h1>
<h2>Breaking Changes</h2>
<h3>aria</h3>
<ul>
<li>
<p>The legacy combobox and autocomplete implementations have been
removed. Use the new standalone combobox instead.</p>
<ul>
<li>feat(aria/combobox): promote simple-combobox to stable un-prefixed
combobox</li>
</ul>
<ul>
<li>Relocates public, private, and example directories to clean
<code>combobox</code> entry points.</li>
<li>Renames internal layout symbols, selectors, and uppercase tokens
(<code>SIMPLE_COMBOBOX_POPUP</code> -&gt;
<code>COMBOBOX_POPUP</code>).</li>
<li>Establishes full documentation extraction parity with the
<code>json_api</code> Bazel rule target.</li>
<li>Standardizes the accompanying toolbar component showcase into the
clean <code>aria-toolbar</code> path.</li>
<li>Re-routes dev-app navigation links and migrates public API golden
records.</li>
</ul>
</li>
<li>
<p><code>SimpleCombobox</code> has been promoted to
<code>Combobox</code>. All <code>simple-combobox</code> prefixed
symbols, selectors, and tokens have been renamed to use the
<code>combobox</code> prefix.</p>
<ul>
<li>refactor(aria/combobox): relocate and restructure autocomplete and
toolbar examples
Relocate the autocomplete examples to
<code>src/components-examples/aria/autocomplete</code> and toolbar
examples to <code>src/components-examples/aria/toolbar</code>.</li>
</ul>
<ul>
<li>Restore naming continuity with the historical codebase by stripping
redundant prefixes from example filenames and component selectors.</li>
<li>Sync dev-app preview routing layout paths and strict Bazel target
dependency links.</li>
</ul>
</li>
</ul>
<h3>cdk</h3>
<ul>
<li>
<ul>
<li><code>CDK_DESCRIBEDBY_HOST_ATTRIBUTE</code> has been removed.</li>
<li><code>CDK_DESCRIBEDBY_ID_PREFIX</code> has been removed.</li>
<li>The <code>injector</code> parameter of the
<code>ConfigurableFocusTrap</code> and <code>FocusTrap</code>
constructors is now required.</li>
<li>The boolean parameter of
<code>ConfigurableFocusTrapFactory.create</code> has been replaced with
a config object.</li>
<li><code>MESSAGES_CONTAINER_ID</code> has been removed.</li>
</ul>
</li>
<li>
<ul>
<li>The <code>event</code> parameter of <code>DropListRef.drop</code> is
now required.</li>
</ul>
</li>
<li>
<ul>
<li><code>ContextMenuTracker</code> has been renamed to
<code>MenuTracker</code>.</li>
</ul>
</li>
</ul>
<h3>material</h3>
<ul>
<li>
<ul>
<li><code>MatListOption.checkboxPosition</code> has been removed. use
<code>togglePosition</code> instead.</li>
<li><code>MatListOptionCheckboxPosition</code> has been renamed to
<code>MatListOptionTogglePosition</code>.</li>
</ul>
</li>
<li>
<ul>
<li><code>ArrowViewState</code> has been removed.</li>
<li><code>ArrowViewStateTransition</code> has been removed.</li>
</ul>
</li>
</ul>
<h3>google-maps</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/components/commit/b8201edeef62258c3d1e1ebeaf8ee14766918c22">b8201edee</a></td>
<td>fix</td>
<td>deprecate heatmap layer (<a
href="https://redirect.github.com/angular/components/pull/33208">#33208</a>)</td>
</tr>
</tbody>
</table>
<h3>material</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/components/commit/add8f16c01ad683b9e2ab9e1bf5ad3a984dd9921">add8f16c0</a></td>
<td>fix</td>
<td><strong>list:</strong> breaking changes for v22</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/components/commit/9d73c98b57d46454d51344bbd59055bc06dabc6b">9d73c98b5</a></td>
<td>fix</td>
<td><strong>menu:</strong> missing panelClass getter (<a
href="https://redirect.github.com/angular/components/pull/33191">#33191</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/components/commit/75718e4fbebce2a7f8aa30550a12d58a5a6f9b93">75718e4fb</a></td>
<td>fix</td>
<td><strong>sort:</strong> breaking changes for v22</td>
</tr>
</tbody>
</table>
<h3>cdk</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/components/commit/1238d1573e706cbf0a2cabcc97e59d28a9499ecb"><code>1238d15</code></a>
release: cut the v21.2.11 release</li>
<li><a
href="https://github.com/angular/components/commit/583da8a564dcb667cb8928e79d286eadee0a5013"><code>583da8a</code></a>
release: cut the v21.2.10 release</li>
<li><a
href="https://github.com/angular/components/commit/babfbb7430547d5f4558174aec1a07ce6c67a26f"><code>babfbb7</code></a>
build: update cross-repo angular dependencies (<a
href="https://redirect.github.com/angular/components/issues/33205">#33205</a>)</li>
<li><a
href="https://github.com/angular/components/commit/e08fdf2a6a120078b512043bf5804bc3c7f9716a"><code>e08fdf2</code></a>
build: fix failing test (<a
href="https://redirect.github.com/angular/components/issues/33212">#33212</a>)</li>
<li><a
href="https://github.com/angular/components/commit/09e89fa188f157c0892019a461459cd9a252a673"><code>09e89fa</code></a>
build: lock file maintenance (<a
href="https://redirect.github.com/angular/components/issues/33201">#33201</a>)</li>
<li><a
href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><code>4897366</code></a>
fix(aria/menu): do not set default aria-label (<a
href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</li>
<li><a
href="https://github.com/angular/components/commit/a6c5b72562b9d46ea3c10a2ecb668e013b46a103"><code>a6c5b72</code></a>
build: update cross-repo angular dependencies (<a
href="https://redirect.github.com/angular/components/issues/33181">#33181</a>)</li>
<li><a
href="https://github.com/angular/components/commit/b7c34e306539716a1222468907ad4af5fb6b1aee"><code>b7c34e3</code></a>
build: update cross-repo angular dependencies (<a
href="https://redirect.github.com/angular/components/issues/33160">#33160</a>)</li>
<li><a
href="https://github.com/angular/components/commit/58e29cf1aa8265d6041350c716c5fbfa9e25b738"><code>58e29cf</code></a>
build: update dependency bazel_lib to v3.3.1 (<a
href="https://redirect.github.com/angular/components/issues/33177">#33177</a>)</li>
<li><a
href="https://github.com/angular/components/commit/e2f16ac34e93e69b1ef960ba70c517de799d05cc"><code>e2f16ac</code></a>
build: update pnpm to v10.33.2 (<a
href="https://redirect.github.com/angular/components/issues/33165">#33165</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/angular/components/compare/v21.2.8...v21.2.11">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/common` from 21.2.10 to 21.2.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/common's
releases</a>.</em></p>
<blockquote>
<h2>21.2.13</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img
src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix -
1c6553e97d" /></a></td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img
src="https://img.shields.io/badge/629905d537-fix-green" alt="fix -
629905d537" /></a></td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img
src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix -
0b7192f441" /></a></td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<h2>21.2.12</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img
src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix -
fe13bb669d" /></a></td>
<td>allow explicit read generic with signal input transforms</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img
src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix -
3430251fef" /></a></td>
<td>i18n flags leaking on errors</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img
src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix -
1aeebbe304" /></a></td>
<td>respect ngSkipHydration on components with projectable nodes in
LContainers</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img
src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix -
9e38ed7d57" /></a></td>
<td>sanitizer typings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img
src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix -
7a05a9a71a" /></a></td>
<td>validate security-sensitive attributes in i18n bindings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img
src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix -
c37f6ca42f" /></a></td>
<td>visit ng-let expression value in signal migration schematics</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img
src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix -
03ad53863b" /></a></td>
<td>prohibit concurrent submits in signal forms</td>
</tr>
</tbody>
</table>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/common's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.13 (2026-05-13)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td>
<td>fix</td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>19.2.22 (2026-05-12)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings unconditionally
(<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td>
<td>fix</td>
<td>validate security-sensitive attributes in i18n bindings (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>20.3.21 (2026-05-12)</h1>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.12 (2026-05-08)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td>
<td>fix</td>
<td>allow service with factory on abstract classes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td>
<td>fix</td>
<td>remove compiler import from safe optional chaining migration</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/30cf85f71c52683016200ecf6d68b4418084ee6e"><code>30cf85f</code></a>
refactor(common): update deprecation message</li>
<li><a
href="https://github.com/angular/angular/commit/42d57c35781fb65fc4d44df59b6a85287664216a"><code>42d57c3</code></a>
refactor(common): fix viewport tests</li>
<li><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><code>10ad3c0</code></a>
fix(common): prevent focus from scrollToAnchor</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v21.2.13/packages/common">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/compiler` from 21.2.10 to 21.2.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/compiler's
releases</a>.</em></p>
<blockquote>
<h2>21.2.13</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img
src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix -
1c6553e97d" /></a></td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img
src="https://img.shields.io/badge/629905d537-fix-green" alt="fix -
629905d537" /></a></td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img
src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix -
0b7192f441" /></a></td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<h2>21.2.12</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img
src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix -
fe13bb669d" /></a></td>
<td>allow explicit read generic with signal input transforms</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img
src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix -
3430251fef" /></a></td>
<td>i18n flags leaking on errors</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img
src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix -
1aeebbe304" /></a></td>
<td>respect ngSkipHydration on components with projectable nodes in
LContainers</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img
src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix -
9e38ed7d57" /></a></td>
<td>sanitizer typings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img
src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix -
7a05a9a71a" /></a></td>
<td>validate security-sensitive attributes in i18n bindings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img
src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix -
c37f6ca42f" /></a></td>
<td>visit ng-let expression value in signal migration schematics</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img
src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix -
03ad53863b" /></a></td>
<td>prohibit concurrent submits in signal forms</td>
</tr>
</tbody>
</table>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/compiler's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.13 (2026-05-13)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td>
<td>fix</td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>19.2.22 (2026-05-12)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings unconditionally
(<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td>
<td>fix</td>
<td>validate security-sensitive attributes in i18n bindings (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>20.3.21 (2026-05-12)</h1>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.12 (2026-05-08)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td>
<td>fix</td>
<td>allow service with factory on abstract classes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td>
<td>fix</td>
<td>remove compiler import from safe optional chaining migration</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/baf92da96ed73a0f4748edf05d3c0702cab219da"><code>baf92da</code></a>
test: remove invalid css that was causing issues with the postcss
parser</li>
<li><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a>
fix(core): disallow event attribute bindings in host bindings
unconditionally</li>
<li><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><code>4f5d8a2</code></a>
fix(compiler): let declaration span not including end character</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v21.2.13/packages/compiler">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/core` from 21.2.10 to 21.2.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/core's
releases</a>.</em></p>
<blockquote>
<h2>21.2.13</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img
src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix -
1c6553e97d" /></a></td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img
src="https://img.shields.io/badge/629905d537-fix-green" alt="fix -
629905d537" /></a></td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img
src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix -
0b7192f441" /></a></td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<h2>21.2.12</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img
src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix -
fe13bb669d" /></a></td>
<td>allow explicit read generic with signal input transforms</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img
src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix -
3430251fef" /></a></td>
<td>i18n flags leaking on errors</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img
src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix -
1aeebbe304" /></a></td>
<td>respect ngSkipHydration on components with projectable nodes in
LContainers</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img
src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix -
9e38ed7d57" /></a></td>
<td>sanitizer typings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img
src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix -
7a05a9a71a" /></a></td>
<td>validate security-sensitive attributes in i18n bindings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img
src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix -
c37f6ca42f" /></a></td>
<td>visit ng-let expression value in signal migration schematics</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img
src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix -
03ad53863b" /></a></td>
<td>prohibit concurrent submits in signal forms</td>
</tr>
</tbody>
</table>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/core's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.13 (2026-05-13)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td>
<td>fix</td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>19.2.22 (2026-05-12)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings unconditionally
(<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td>
<td>fix</td>
<td>validate security-sensitive attributes in i18n bindings (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>20.3.21 (2026-05-12)</h1>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.12 (2026-05-08)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td>
<td>fix</td>
<td>allow service with factory on abstract classes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td>
<td>fix</td>
<td>remove compiler import from safe optional chaining migration</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a>
fix(core): disallow event attribute bindings in host bindings
unconditionally</li>
<li><a
href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><code>9e38ed7</code></a>
fix(core): sanitizer typings</li>
<li><a
href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><code>3430251</code></a>
fix(core): i18n flags leaking on errors</li>
<li><a
href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><code>c37f6ca</code></a>
fix(core): visit ng-let expression value in signal migration
schematics</li>
<li><a
href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><code>fe13bb6</code></a>
fix(core): allow explicit read generic with signal input transforms</li>
<li><a
href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><code>7a05a9a</code></a>
fix(core): validate security-sensitive attributes in i18n bindings</li>
<li><a
href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><code>1aeebbe</code></a>
fix(core): respect ngSkipHydration on components with projectable nodes
in LC...</li>
<li><a
href="https://github.com/angular/angular/commit/4900e453e1a2e9351ad2672a804d876ff5a62968"><code>4900e45</code></a>
build: update cross-repo angular dependencies</li>
<li><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><code>a40e2ce</code></a>
fix(core): fix ordering of view queries metadata in JIT mode</li>
<li><a
href="https://github.com/angular/angular/commit/9bcbf376413632590ef1fb1cebe68d049d9bd45b"><code>9bcbf37</code></a>
refactor(core): fix bundling symbol test</li>
<li>Additional commits viewable in <a
href="https://github.com/angular/angular/commits/v21.2.13/packages/core">compare
view</a></li>
</ul>
</details>
<br />

Updates `@angular/forms` from 21.2.10 to 21.2.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/forms's
releases</a>.</em></p>
<blockquote>
<h2>21.2.13</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img
src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix -
1c6553e97d" /></a></td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img
src="https://img.shields.io/badge/629905d537-fix-green" alt="fix -
629905d537" /></a></td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img
src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix -
0b7192f441" /></a></td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<h2>21.2.12</h2>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img
src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix -
fe13bb669d" /></a></td>
<td>allow explicit read generic with signal input transforms</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img
src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix -
3430251fef" /></a></td>
<td>i18n flags leaking on errors</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img
src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix -
1aeebbe304" /></a></td>
<td>respect ngSkipHydration on components with projectable nodes in
LContainers</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img
src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix -
9e38ed7d57" /></a></td>
<td>sanitizer typings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img
src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix -
7a05a9a71a" /></a></td>
<td>validate security-sensitive attributes in i18n bindings</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img
src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix -
c37f6ca42f" /></a></td>
<td>visit ng-let expression value in signal migration schematics</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img
src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix -
03ad53863b" /></a></td>
<td>prohibit concurrent submits in signal forms</td>
</tr>
</tbody>
</table>
<h2>21.2.11</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img
src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix -
10ad3c0692" /></a></td>
<td>prevent focus from scrollToAnchor</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img
src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix -
4f5d8a2c0b" /></a></td>
<td>let declaration span not including end character</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img
src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix -
a40e2cebc8" /></a></td>
<td>fix ordering of view queries metadata in JIT mode</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img
src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix -
885a1a1d97" /></a></td>
<td>guard against non-object events and avoid listener wrapper identity
mismatch</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img
src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix -
7a64aff9b5" /></a></td>
<td>prevent event replay double-invocation when element hydrates before
app stability</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img
src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix -
be1f80a253" /></a></td>
<td>ensure origin has a trailing slash when parsing url</td>
</tr>
</tbody>
</table>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/forms's
changelog</a>.</em></p>
<blockquote>
<h1>21.2.13 (2026-05-13)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td>
<td>fix</td>
<td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>19.2.22 (2026-05-12)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings unconditionally
(<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td>
<td>fix</td>
<td>validate security-sensitive attributes in i18n bindings (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td>
<td>fix</td>
<td>ensure origin has a trailing slash when parsing url (<a
href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>20.3.21 (2026-05-12)</h1>
<h3>platform-server</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td>
<td>fix</td>
<td>add <code>allowedHosts</code> option to <code>renderModule</code>
and <code>renderApplication</code></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
<p><!-- raw HTML omitted --><!-- raw HTML omitted --></p>
<h1>22.0.0-next.12 (2026-05-08)</h1>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td>
<td>fix</td>
<td>allow service with factory on abstract classes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td>
<td>fix</td>
<td>disallow event attribute bindings in host bindings
unconditionally</td>
</tr>
</tbody>
</table>
<h3>migrations</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a href="https:...

_Description has been truncated_

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco A. <[email protected]>
 2026-05-25 11:14:11 +02:00