mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
dbb0da71afdbda4e2ae1fbf9b838cd71e65f4df3
4490
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  Livio SpringandGitHub
|
dbb0da71af |
fix: remove unnecessary entry from default denylist (#12294)
# Which Problems Are Solved The updated default denylist added an entry for IPv4-mapped IPv6 addresses to prevent IPv6 encapsulation bypasses. This is not necessary since the IP already gets resolved into v4 and now blocks them all. # How the Problems Are Solved Removed the entry. # Additional Changes None # Additional Context None |
||
 Gayathri VijayanandGitHub
|
0973b074b4 |
Merge commit from fork
* fix: client_id verification during code exchange and refresh token flows * add clientID check for device token flow * Trigger Build |
||
 Tim MöhlmannandGitHub
|
e94d4c3986 |
feat(crypto): FIPS 140-3 compliant build and runtime checks (#12233)
# Which Problems Are Solved Enable FIPS 140-3 compliant build. # How the Problems Are Solved - Add runtime config validation, if the FIPS flag is enabled fail the application when a non-compliant hasher is used, or throw a warning when a legacy verifier is used - Add a build matrix for FIPS certified build: - Go binary is built with `GOFIPS140=certified` - Login container uses a separate base: [ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e) from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS stack) - Non-FIPS images where already pushed to both Github Container Registry and Google Artifact Repository (GAR). Fips images are only pushed to the GAR. - Tag versions are suffixed `-fips`. So on release the following images will be additionally available: ``` europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips ``` # Other changes - Bumb Go toolchain. At least v1.25.10 is required for a GOFIPS140=certified setting. # Additional Context - Closes https://github.com/zitadel/zitadel/issues/4335 - Build [test run](https://github.com/zitadel/zitadel/actions/runs/27253916052) pushing FIPS and non-FIPS images |
||
 Max PeintnerandGitHub
|
fdafb95a63 |
fix(login): load custom font from branding settings and allow in CSP (#12279)
Closes #11200 # Which Problems Are Solved Custom fonts uploaded via the branding/label policy were not supported. # How the Problems Are Solved - The login now correctly applies the branding settings, based on the organization context - Use the absolute `fontUrl` from the branding API directly in the `@font-face` `src`, matching how logo and icon assets are already loaded via absolute URLs. - Add the Zitadel service URL to the `font-src` CSP directive so the browser permits loading the cross-origin font. # Additional Changes - Updated CSP tests to reflect the new `font-src` behavior. |
||
|
8e82ec1cb9 |
Merge commit from fork
* Add DenyLists parsing * Remove unneeded returned error * Plug global denylist into Command * app creation: apply denylist to backchannel logout URI * Inject denylist to backchannel logout worker * webhook config: validate against blocked URLs * Add notificationsWebhook denylist target * command: Add SMTP endpoint validation against blocklist * command: Add SMS endpoint validation against blocklist * Validate webhook endpoint against denylist on channel notification * Remove unused tests * handle deprecated denylists * remove unintended denylist entry in deprecated list * use single http client * fix tests * update comments * fixes * cleanup * address comments * fix merge --------- Co-authored-by: Livio Spring <[email protected]> |
||
|
Livio SpringandGitHub
|
d184e976fc |
Merge commit from fork
* feat(jwt idp): manage and validate audience * translations * fix tests * address comments * update migration version * fix merge |
||
|
Livio SpringandGitHub
|
fad02c6d9f | Merge commit from fork | ||
 
|
6082e59d47 |
fix(eventstore): allow overwriting resource owner of events (#12261)
# Which Problems Are Solved - The eventstore did not support intentionally overwriting the resource owner when creating events for aggregates that may be reused across owners. - Resource owner handling was implicit and could not be controlled per command/event type. - We needed a safe way to distinguish between: - keeping the existing aggregate owner, and - explicitly setting a new owner for specific create-like events. # How the Problems Are Solved - Introduced a new eventstore command type with an explicit enforce_owner flag. - Updated eventstore.commands_to_events and eventstore.push so owner assignment is now explicit: - if enforce_owner is true, the command owner is written - if enforce_owner is false, the existing aggregate owner is retained when present - Added EnforceResourceOwnerCommand and wiring so command types can opt in to enforced owner behavior. - Wired the new behavior through the v3 eventstore push path, including compatibility fallback for older command type mapping. - Added migration/setup changes to register and use the new command type and SQL functions. - Added and updated tests for owner overwrite and aggregate ID reuse scenarios. # Additional Changes - Added small migration/setup robustness improvements related to eventstore setup ordering and helper reuse. - Added focused test coverage for enforced owner behavior and sequencing. - Events that currently allow owner changes (implement EnforceResourceOwner) are: - AddedEvent (action) - GroupAddedEvent - StartedEvent (idp intent) - ProjectAddedEvent - HumanAddedEvent - HumanRegisteredEvent - MachineAddedEvent - CreatedEvent (schema user) # Additional Context - Follow-up for eventstore owner-handling correctness in create flows and aggregate ID reuse cases. - No additional issue link was attached for this change. --------- Co-authored-by: abhishek kumar gupta <[email protected]> |
||
|
Max PeintnerandGitHub
|
4459a1380c |
fix(login): accept IDP sessions on passkey registration (#12275)
# Which Problems Are Solved The local `isSessionValid` in `passkeys.ts` only checked `password` and `webAuthN` factors, so sessions authenticated via an external IDP (`intent` factor) were treated as invalid. This caused a "You have to authenticate" error when redirecting to `/passkey/set` after IDP login. # How the Problems Are Solved Added `session.factors.intent.verifiedAt` to the validity check, consistent with the canonical `isSessionValid` in `session.ts`. |
||
 EvanandGitHub
|
cf4554b82c |
fix(idp): apply PKCE when building OAuth and OIDC providers (#12247)
# Which Problems Are Solved
- IDP intent authorization redirects used by Login v2 ignored the
configured `UsePKCE` setting for Generic OAuth providers
- This caused providers such as X/Twitter OAuth2 to receive
authorization requests without `code_challenge` and
`code_challenge_method`
- OIDC provider construction had the same gap, even though PKCE is
already part of the provider configuration model
- Existing IDP intent redirect tests expected non-PKCE OAuth URLs and
failed once PKCE was applied correctly
# How the Problems Are Solved
- Updated `OAuthIDPWriteModel.ToProvider` in
internal/command/idp_model.go to pass `rp.WithPKCE(nil)` when `UsePKCE`
is enabled
- Updated `OIDCIDPWriteModel.ToProvider` to apply the same PKCE
relying-party option for OIDC providers
# Additional Changes
- Added focused provider-construction tests covering:
- OAuth provider redirects include code_challenge
- OIDC provider redirects include code_challenge
- both providers use code_challenge_method=S256
- both persist the generated codeVerifier for token exchange
- Updated `TestCommands_AuthFromProvider` in
internal/command/idp_intent_test.go so OAuth redirect assertions verify
PKCE structurally instead of hard-coding the generated challenge value
# Additional Context
- Reproduced with X/Twitter OAuth2 where the generated authorization URL
was missing PKCE parameters despite `usePkce: true`
- Verified both the focused PKCE tests and the full unit test suite run
successfully with the fix
- Closes #12036
- Closes/supersedes #12054:
- Tests are included
- No slice re-allocation on `opts` append
# Result
### Before
`authUrl` in `StartIdentityProviderIntent` response is missing
`code_challenge` and `code_challenge_method` for Generic OAuth IDP with
PKCE enabled:
```json
{
"details": {
"sequence": "1",
"changeDate": "2026-06-07T18:48:16.921317Z",
"resourceOwner": "376298239768395779"
},
"authUrl": "https://x.com/i/oauth2/authorize?client_id=<REDACTED>&prompt=select_account&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fidps%2Fcallback&response_type=code&scope=tweet.read+users.email+users.read+offline.access&state=376417136207200259"
}
```
### After
`code_challenge` and `code_challenge_method` are correctly included into
`authUrl`:
```json
{
"details": {
"sequence": "1",
"changeDate": "2026-06-07T18:49:39.488941Z",
"resourceOwner": "376298239768395779"
},
"authUrl": "https://x.com/i/oauth2/authorize?client_id=<REDACTED>&code_challenge=8G4vN8QNgSsbvGSHKwYPEc2qUYU2BK5L0fsr992duTA&code_challenge_method=S256&prompt=select_account&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fidps%2Fcallback&response_type=code&scope=tweet.read+users.email+users.read+offline.access&state=376417274736672771"
}
```
|
||
 MaximilianandGitHub
|
c5463b51ff |
docs: Update security.md (#12267)
We introduce a common vulnerabiltiy policy and a from for reporting vulnerabilties. |
||
|
385c5ae54b |
docs: Update restrict console guide (#12262)
<!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved The projects setting texts and sceenshot where outdated. # How the Problems Are Solved Update the text and screenshot. # Additional Changes * Rewording * Lockout warning component --------- Co-authored-by: Copilot Autofix powered by AI <[email protected]> |
||
|
Max PeintnerandGitHub
|
b27fdfc28c |
chore: update dependencies (#12242)
# Which Problems Are Solved Fixes multiple high-severity Dependabot alerts for transitive dependencies (axios, protobufjs, systeminformation, tmp, fast-uri, @babel/plugin-transform-modules-systemjs). # How the Problems Are Solved **Direct dependency updates:** - `@opentelemetry/*` 0.217 → 0.218 in login (new otlp-transformer dropped protobufjs as direct dep) - `posthog-js` 1.374 → 1.380 in console (dropped the OpenTelemetry/protobufjs chain entirely) **pnpm overrides** for remaining transitive deps that can't be updated via their parents (all pulled by the gRPC stack, Cypress, karma, nx, or ajv): - `axios` → ≥1.17.0 (prototype pollution, proxy bypass) - `protobufjs` → ≥7.5.7 / ≥8.0.2 (code injection, prototype pollution, DoS) - `systeminformation` → ≥5.31.6 (command injection) - `tmp` → ≥0.2.6 (path traversal) - `fast-uri` → ≥3.1.2 (path traversal, host confusion) **Benchmark:** refreshed `package-lock.json` to resolve @babel and fast-uri alerts. |
||
|
Marco A.andGitHub
|
ed09b3df7f | Merge commit from fork | ||
 |
25e263394e |
chore: update passwap v0.12.1 and align hash validation defaults/errors (#12179)
# Which Problems Are Solved - Upgrading to `zitadel/passwap` v0.12.1 introduced new encoded-hash validation paths that still had review feedback open. - Secret hasher defaults were internally inconsistent (`Hasher.Cost: 4` vs `Limits.Bcrypt.MinCost: 10`), which could reject hashes created by the configured hasher. - New validation error IDs/messages and test coverage needed to be aligned with project conventions and expected behavior branches. # How the Problems Are Solved - Kept the dependency upgrade to `zitadel/passwap` v0.12.1 and completed the validation integration. - Updated `ValidateEncodedHash` error handling in `internal/crypto/passwap.go` to: - use unique random-style error IDs, - return `Errors.Hash.NotSupported` for no-verifier cases, - keep invalid-hash branches mapped to invalid argument errors. - Expanded `TestHasher_ValidateEncodedHash` in `internal/crypto/passwap_test.go` to cover and assert: - bounds error branch, - no-verifier branch, - generic invalid-hash branch, - expected ZITADEL error IDs/messages. - Restored lost inline verifier-context comments for argon2 and md5plain verifier entries. # Additional Changes - Added the missing explanatory `Limits` comment for `SecretHasher` in `cmd/defaults.yaml`. - Corrected `SecretHasher.Limits.Bcrypt.MinCost` from `10` to `4` to match the configured default bcrypt cost and avoid configuration footguns. # Additional Context - Follow-up for PR review feedback in https://github.com/zitadel/zitadel/pull/12179#pullrequestreview-4313121965 --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Livio Spring <[email protected]> |
||
|
|
f85a2373c5 |
chore(test): streamline integration tests for instance management (#12243)
- Removed redundant relational instance handling in integration tests for adding and removing custom domains. - Simplified test cases by consolidating instance creation and context management. - Enhanced clarity and maintainability of test logic by reducing complexity in test structures. # Which Problems Are Solved `backed/v3` tests are flaky, but the code is not productive. Development is paused for the moment. Disabling flaky tests helps us to maintain the product easier. # How the Problems Are Solved - Removed redundant relational instance handling in integration tests for adding and removing custom domains. - Simplified test cases by consolidating instance creation and context management. - Enhanced clarity and maintainability of test logic by reducing complexity in test structures.newly introduced terms). # Additional Context - related to https://github.com/zitadel/zitadel/pull/12241 --------- Co-authored-by: Livio Spring <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> |
||
|
Tim MöhlmannandGitHub
|
7019a03ec4 |
chore(test): disable event_testing in backend/v3 (#12241)
# Which Problems Are Solved `backed/v3` tests are flaky, but the code is not productive. Development is paused for the moment. Disabling flaky tests helps us to maintain the product easier. # How the Problems Are Solved - Removed 'events_testing' from the integration test command in both `CONTRIBUTING.md` and `apps/api/project.json` to streamline the testing process. - Adjusted the command to ensure it only includes relevant integration tests, improving clarity and focus for contributors. |
||
|
cdc6c43d09 |
fix: update dependencies (#12216)
# Which Problems Are Solved Fixes open vulnerabilities # How the Problems Are Solved Updated npm/js dependencies across console, new login v2, and docs Based on https://github.com/zitadel/zitadel/pull/12164 --------- Co-authored-by: conblem <[email protected]> Co-authored-by: Livio Spring <[email protected]> |
||
|
|
fc6e2a0f05 |
fix(login): retry logic for session creation after registration on NotFound (#12189)
After user registration, the backend projections may not be up to date
yet when the Login UI immediately tries to create a session. This
results in a `QUERY-Dfbg2` ("User could not be found") error even though
the user was created successfully.
This adds retry logic with backoff (500ms/1s/2s, up to 3 attempts)
around `createSessionAndUpdateCookie` in the registration flow. Only
`NotFound` errors are retried — other errors are thrown immediately.
Closes #12173
---------
Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
|
||
 
|
f4f43f5248 |
docs: fix broken GitHub code-reference blocks after fumadocs migration (#12213)
# Which Problems Are Solved Pages in `apps/docs` that embed source from GitHub via the Docusaurus convention ```` ```js reference https://github.com/zitadel/actions/blob/main/examples/org_metadata_claim.js ``` ```` stopped working after the migration from Docusaurus to fumadocs. The old `docusaurus-theme-github-codeblock` plugin used to fetch the file and render it; fumadocs has no support for that meta, so the page rendered the raw URL as plain code-block text. Visible at `/docs/apis/actions/code-examples` and 16 other pages. # How the Problems Are Solved - Converted every ```` ```<lang> reference\n<URL>\n``` ```` block (46 total across 17 `.mdx` files) to the native fumadocs JSX form: `<GithubCodeBlock url="<URL>" />`. The existing `<details>`/`<summary>` collapsibles around blocks are kept — they're an authoring choice, not part of the rendering bug. - Updated `apps/docs/components/github-code-block.tsx` to render via `DynamicCodeBlock` from `fumadocs-ui/components/dynamic-codeblock` (proper shiki highlighting) instead of raw `CodeBlock` + `Pre` (which produced unhighlighted output). Also fixed language detection so a URL hash like `#L10-L20` no longer pollutes the language token. - Registered `GithubCodeBlock` globally in `apps/docs/mdx-components.tsx`, matching how every other shared component (`APIPage`, `Callout`, `Tab/Tabs`, `Step/Steps`, `Admonition`, `TerminologyUpdate`) is exposed. MDX files no longer need a local `import`. # Additional Changes - Normalized the two MDX files that were already using the JSX form (`examples/secure-api/python-django.mdx`, `examples/secure-api/java-spring.mdx`): removed their now-redundant local `import { GithubCodeBlock }` and rewrote 9 long-form `<GithubCodeBlock url="..."></GithubCodeBlock>` tags to self-closing for consistency. # Additional Context Verified locally with `pnpm --filter @zitadel/docs dev`: - `/docs/apis/actions/code-examples` — 20 shiki-highlighted code blocks rendered inside the `<details>` collapsibles (was 0). - `/docs/apis/openidoauth/claims` — line-range hashes (`#L9-L11`) honored. - `/docs/examples/login/flutter` — mixed languages (xml/dart/html) detected and highlighted. - `/docs/guides/integrate/external-audit-log` — edge case of fenced reference indented inside a numbered list also converted and rendered. Greps: - `^[ \t]*\`\`\`[a-zA-Z0-9]+ reference` in `apps/docs/content/**/*.mdx` → 0 matches. - `<GithubCodeBlock url="` in `apps/docs/content/**/*.mdx` → 55 matches. - `from '@/components/github-code-block'` in `apps/docs/content/**/*.mdx` → 0 matches. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> |
||
|
Marco A.andGitHub
|
c73e58489b |
chore(deps): Update go-ntlmssp (#12193)
# Which Problems Are Solved Dependabot signalling that go-ntlmssp requires an update # How the Problems Are Solved `go get -u` |
||
 |
349451b028 |
chore(deps): bump the console group across 1 directory with 31 updates (#12183)
Bumps the console group with 31 updates in the /console directory: | Package | From | To | | --- | --- | --- | | [@angular/animations](https://github.com/angular/angular/tree/HEAD/packages/animations) | `21.2.10` | `21.2.13` | | [@angular/cdk](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.10` | `21.2.13` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.10` | `21.2.13` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.10` | `21.2.13` | | [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `21.2.10` | `21.2.13` | | [@angular/material](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/material-moment-adapter](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `21.2.10` | `21.2.13` | | [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) | `21.2.10` | `21.2.13` | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `21.2.10` | `21.2.13` | | [@angular/service-worker](https://github.com/angular/angular/tree/HEAD/packages/service-worker) | `21.2.10` | `21.2.13` | | [@tanstack/angular-query-experimental](https://github.com/TanStack/query/tree/HEAD/packages/angular-query-experimental) | `5.100.5` | `5.100.11` | | [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) | `1.12.42` | `1.13.2` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.372.3` | `1.374.2` | | [zone.js](https://github.com/angular/angular/tree/HEAD/packages/zone.js) | `0.16.1` | `0.16.2` | | [@angular-eslint/eslint-plugin](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin) | `21.3.1` | `21.4.0` | | [@angular-eslint/eslint-plugin-template](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin-template) | `21.3.1` | `21.4.0` | | [@angular-eslint/template-parser](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/template-parser) | `21.3.1` | `21.4.0` | | [@angular/build](https://github.com/angular/angular-cli) | `21.2.8` | `21.2.11` | | [@angular/cli](https://github.com/angular/angular-cli) | `21.2.8` | `21.2.11` | | [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `21.2.10` | `21.2.13` | | [@angular/language-service](https://github.com/angular/angular/tree/HEAD/packages/language-service) | `21.2.10` | `21.2.13` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.4` | `4.3.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.9.1` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.59.1` | `8.59.4` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.59.1` | `8.59.4` | | [eslint](https://github.com/eslint/eslint) | `10.2.1` | `10.4.0` | | [globals](https://github.com/sindresorhus/globals) | `17.5.0` | `17.6.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.15` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.4` | `4.3.0` | Updates `@angular/animations` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/animations's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/animations's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/animations">compare view</a></li> </ul> </details> <br /> Updates `@angular/cdk` from 21.2.8 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/components/releases">@angular/cdk's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <p>No user facing changes in this release</p> <h2>21.2.10</h2> <h3>aria</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><img src="https://img.shields.io/badge/48973661e-fix-green" alt="fix - 48973661e" /></a></td> <td><strong>menu:</strong> do not set default aria-label (<a href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>material</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/51271c6194a9b55ee847c566a8960c9be5ec7cce"><img src="https://img.shields.io/badge/51271c619-fix-green" alt="fix - 51271c619" /></a></td> <td><strong>stepper:</strong> allow stepper to be labelled (<a href="https://redirect.github.com/angular/components/issues/33137">#33137</a>)</td> </tr> </tbody> </table> <h3>cdk</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/3a3852d45a4bbcfb23b46ca00e0eba1d70081ba3"><img src="https://img.shields.io/badge/3a3852d45-fix-green" alt="fix - 3a3852d45" /></a></td> <td><strong>tree:</strong> enter/space key on child node should not toggle parent node expansion (<a href="https://redirect.github.com/angular/components/issues/33125">#33125</a>)</td> </tr> </tbody> </table> <h3>aria</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/bf14cc9d9fd349974cba853d4747b6859b3aae5b"><img src="https://img.shields.io/badge/bf14cc9d9-fix-green" alt="fix - bf14cc9d9" /></a></td> <td><strong>menu:</strong> use computed for menu item patterns, with trigger on visible (<a href="https://redirect.github.com/angular/components/issues/33118">#33118</a>)</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/components/blob/main/CHANGELOG.md">@angular/cdk's changelog</a>.</em></p> <blockquote> <h1>21.2.11 "crystal ball" (2026-05-13)</h1> <p>No user facing changes in this release</p> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.8 "plastic-wallaby" (2026-05-06)</h1> <h2>Breaking Changes</h2> <h3>aria</h3> <ul> <li> <p>The legacy combobox and autocomplete implementations have been removed. Use the new standalone combobox instead.</p> <ul> <li>feat(aria/combobox): promote simple-combobox to stable un-prefixed combobox</li> </ul> <ul> <li>Relocates public, private, and example directories to clean <code>combobox</code> entry points.</li> <li>Renames internal layout symbols, selectors, and uppercase tokens (<code>SIMPLE_COMBOBOX_POPUP</code> -> <code>COMBOBOX_POPUP</code>).</li> <li>Establishes full documentation extraction parity with the <code>json_api</code> Bazel rule target.</li> <li>Standardizes the accompanying toolbar component showcase into the clean <code>aria-toolbar</code> path.</li> <li>Re-routes dev-app navigation links and migrates public API golden records.</li> </ul> </li> <li> <p><code>SimpleCombobox</code> has been promoted to <code>Combobox</code>. All <code>simple-combobox</code> prefixed symbols, selectors, and tokens have been renamed to use the <code>combobox</code> prefix.</p> <ul> <li>refactor(aria/combobox): relocate and restructure autocomplete and toolbar examples Relocate the autocomplete examples to <code>src/components-examples/aria/autocomplete</code> and toolbar examples to <code>src/components-examples/aria/toolbar</code>.</li> </ul> <ul> <li>Restore naming continuity with the historical codebase by stripping redundant prefixes from example filenames and component selectors.</li> <li>Sync dev-app preview routing layout paths and strict Bazel target dependency links.</li> </ul> </li> </ul> <h3>cdk</h3> <ul> <li> <ul> <li><code>CDK_DESCRIBEDBY_HOST_ATTRIBUTE</code> has been removed.</li> <li><code>CDK_DESCRIBEDBY_ID_PREFIX</code> has been removed.</li> <li>The <code>injector</code> parameter of the <code>ConfigurableFocusTrap</code> and <code>FocusTrap</code> constructors is now required.</li> <li>The boolean parameter of <code>ConfigurableFocusTrapFactory.create</code> has been replaced with a config object.</li> <li><code>MESSAGES_CONTAINER_ID</code> has been removed.</li> </ul> </li> <li> <ul> <li>The <code>event</code> parameter of <code>DropListRef.drop</code> is now required.</li> </ul> </li> <li> <ul> <li><code>ContextMenuTracker</code> has been renamed to <code>MenuTracker</code>.</li> </ul> </li> </ul> <h3>material</h3> <ul> <li> <ul> <li><code>MatListOption.checkboxPosition</code> has been removed. use <code>togglePosition</code> instead.</li> <li><code>MatListOptionCheckboxPosition</code> has been renamed to <code>MatListOptionTogglePosition</code>.</li> </ul> </li> <li> <ul> <li><code>ArrowViewState</code> has been removed.</li> <li><code>ArrowViewStateTransition</code> has been removed.</li> </ul> </li> </ul> <h3>google-maps</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/b8201edeef62258c3d1e1ebeaf8ee14766918c22">b8201edee</a></td> <td>fix</td> <td>deprecate heatmap layer (<a href="https://redirect.github.com/angular/components/pull/33208">#33208</a>)</td> </tr> </tbody> </table> <h3>material</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/add8f16c01ad683b9e2ab9e1bf5ad3a984dd9921">add8f16c0</a></td> <td>fix</td> <td><strong>list:</strong> breaking changes for v22</td> </tr> <tr> <td><a href="https://github.com/angular/components/commit/9d73c98b57d46454d51344bbd59055bc06dabc6b">9d73c98b5</a></td> <td>fix</td> <td><strong>menu:</strong> missing panelClass getter (<a href="https://redirect.github.com/angular/components/pull/33191">#33191</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/components/commit/75718e4fbebce2a7f8aa30550a12d58a5a6f9b93">75718e4fb</a></td> <td>fix</td> <td><strong>sort:</strong> breaking changes for v22</td> </tr> </tbody> </table> <h3>cdk</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/components/commit/1238d1573e706cbf0a2cabcc97e59d28a9499ecb"><code>1238d15</code></a> release: cut the v21.2.11 release</li> <li><a href="https://github.com/angular/components/commit/583da8a564dcb667cb8928e79d286eadee0a5013"><code>583da8a</code></a> release: cut the v21.2.10 release</li> <li><a href="https://github.com/angular/components/commit/babfbb7430547d5f4558174aec1a07ce6c67a26f"><code>babfbb7</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33205">#33205</a>)</li> <li><a href="https://github.com/angular/components/commit/e08fdf2a6a120078b512043bf5804bc3c7f9716a"><code>e08fdf2</code></a> build: fix failing test (<a href="https://redirect.github.com/angular/components/issues/33212">#33212</a>)</li> <li><a href="https://github.com/angular/components/commit/09e89fa188f157c0892019a461459cd9a252a673"><code>09e89fa</code></a> build: lock file maintenance (<a href="https://redirect.github.com/angular/components/issues/33201">#33201</a>)</li> <li><a href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><code>4897366</code></a> fix(aria/menu): do not set default aria-label (<a href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</li> <li><a href="https://github.com/angular/components/commit/a6c5b72562b9d46ea3c10a2ecb668e013b46a103"><code>a6c5b72</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33181">#33181</a>)</li> <li><a href="https://github.com/angular/components/commit/b7c34e306539716a1222468907ad4af5fb6b1aee"><code>b7c34e3</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33160">#33160</a>)</li> <li><a href="https://github.com/angular/components/commit/58e29cf1aa8265d6041350c716c5fbfa9e25b738"><code>58e29cf</code></a> build: update dependency bazel_lib to v3.3.1 (<a href="https://redirect.github.com/angular/components/issues/33177">#33177</a>)</li> <li><a href="https://github.com/angular/components/commit/e2f16ac34e93e69b1ef960ba70c517de799d05cc"><code>e2f16ac</code></a> build: update pnpm to v10.33.2 (<a href="https://redirect.github.com/angular/components/issues/33165">#33165</a>)</li> <li>Additional commits viewable in <a href="https://github.com/angular/components/compare/v21.2.8...v21.2.11">compare view</a></li> </ul> </details> <br /> Updates `@angular/common` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/common's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/common's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/30cf85f71c52683016200ecf6d68b4418084ee6e"><code>30cf85f</code></a> refactor(common): update deprecation message</li> <li><a href="https://github.com/angular/angular/commit/42d57c35781fb65fc4d44df59b6a85287664216a"><code>42d57c3</code></a> refactor(common): fix viewport tests</li> <li><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><code>10ad3c0</code></a> fix(common): prevent focus from scrollToAnchor</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/common">compare view</a></li> </ul> </details> <br /> Updates `@angular/compiler` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/compiler's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/compiler's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/baf92da96ed73a0f4748edf05d3c0702cab219da"><code>baf92da</code></a> test: remove invalid css that was causing issues with the postcss parser</li> <li><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a> fix(core): disallow event attribute bindings in host bindings unconditionally</li> <li><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><code>4f5d8a2</code></a> fix(compiler): let declaration span not including end character</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/compiler">compare view</a></li> </ul> </details> <br /> Updates `@angular/core` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/core's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/core's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a> fix(core): disallow event attribute bindings in host bindings unconditionally</li> <li><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><code>9e38ed7</code></a> fix(core): sanitizer typings</li> <li><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><code>3430251</code></a> fix(core): i18n flags leaking on errors</li> <li><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><code>c37f6ca</code></a> fix(core): visit ng-let expression value in signal migration schematics</li> <li><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><code>fe13bb6</code></a> fix(core): allow explicit read generic with signal input transforms</li> <li><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><code>7a05a9a</code></a> fix(core): validate security-sensitive attributes in i18n bindings</li> <li><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><code>1aeebbe</code></a> fix(core): respect ngSkipHydration on components with projectable nodes in LC...</li> <li><a href="https://github.com/angular/angular/commit/4900e453e1a2e9351ad2672a804d876ff5a62968"><code>4900e45</code></a> build: update cross-repo angular dependencies</li> <li><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><code>a40e2ce</code></a> fix(core): fix ordering of view queries metadata in JIT mode</li> <li><a href="https://github.com/angular/angular/commit/9bcbf376413632590ef1fb1cebe68d049d9bd45b"><code>9bcbf37</code></a> refactor(core): fix bundling symbol test</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/core">compare view</a></li> </ul> </details> <br /> Updates `@angular/forms` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/forms's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/forms's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https:... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marco A. <[email protected]> |
||
|
404c23834a |
fix(login): redirect to email verification when forced MFA has no visible factors (#12060)
# Which Problems Are Solved When MFA is enforced with only Email OTP as a second factor, new users hit a dead end on the MFA setup screen. The `ChooseSecondFactorToSetup` component hides Email OTP when `emailVerified` is `false`, and if email verification was skipped earlier in the flow (e.g. `EMAIL_VERIFICATION` env not set to `"true"`), no MFA options are visible and the user cannot proceed. # How the Problems Are Solved In the MFA setup server component (`mfa/set/page.tsx`), before rendering, detect when forced MFA has no visible second factors because all configured factors require verification the user hasn't completed. When Email OTP is configured but the user's email is unverified, redirect to `/verify` with `send=true` so a verification code is sent immediately. After the user verifies their email, the existing flow in `verify.ts` calls `checkMFAFactors` which redirects back to `/mfa/set` — where Email OTP is now visible since `emailVerified` is `true`. The redirect pattern follows the existing precedent in `authenticator/set/page.tsx`. # Additional Changes None # Additional Context - Closes #11536 --------- Co-authored-by: Max Peintner <[email protected]> |
||
 Federico CoppedeandGitHub
|
b4f2da2171 |
docs: Add Gateway API routing to Kubernetes deployment guide (#12168)
## Description This PR updates the Kubernetes deployment documentation to address user feedback regarding our routing instructions. A user noted that standard `Ingress` is becoming outdated and requested configuration examples for the modern Gateway API. To support both existing and modern clusters, I have updated the guide to provide two clear pathways for exposing ZITADEL. ## Changes Included * **Prerequisites updated:** Mentioned Gateway API controllers alongside standard Ingress controllers. * **Refactored Stage 2 (Production):** Split the routing configuration into "Option A: Standard Ingress" and "Option B: Gateway API". * **Added YAML example:** Provided a sample `HTTPRoute` resource to route traffic to the `zitadel` and `zitadel-login` backend services. * **Terminology updates:** Broadened terms like "Ingress" to "Routing" or "Routing controller" where applicable. |
||
|
Federico CoppedeandGitHub
|
ecfe72b509 |
docs: update vue repo url (#12160)
fix broken vue repo url |
||
|
|
96b3f3dd35 |
fix(login): apply custom request headers from environment variable in proxy (#12144)
Closes #12125 # Which Problems Are Solved The proxy middleware (proxy.ts) did not apply `CUSTOM_REQUEST_HEADERS` to rewritten requests (/.well-known/*, /oauth/*, /oidc/*, etc.). When `ZITADEL_API_URL` points to an internal service name, the Host header on proxied requests remained the internal name instead of the configured public domain, causing Errors.Instance.NotFound. # How the Problems Are Solved The other two outgoing request paths — the connectRPC transport and the security-settings fetch — already applied these headers. This adds the same applyCustomHeaders() call to the proxy path. Co-authored-by: Ramon <[email protected]> |
||
|
Federico CoppedeandGitHub
|
1b8b0ac410 |
docs: move customer portal docs to knowledge base (#12147)
Moved the Customer Portal Documentation to the knowledge base (help.zitadel.com) |
||
|
Livio SpringandGitHub
|
08007da70e | Merge commit from fork | ||
|
|
64737bfedf |
chore: deps update (#12114)
<!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved Outdated depdencies # How the Problems Are Solved This PR mostly just updates our NPM depdencies to the newest feature releases. The UUID package was update to version 14, the changelog only includes changes to the supported node version. # Additional Changes Replace tsx for some scripts in the docs. --------- Co-authored-by: Livio Spring <[email protected]> Co-authored-by: Max Peintner <[email protected]> |
||
 
|
942c959d09 |
fix(login): resolve localized legal links in signup (#11913)
# Which Problems Are Solved
- Login V2 signup does not resolve the `{{.Lang}}` placeholder in ToS,
Privacy Policy, and help links.
- Clicking those links on the registration page can open URL-encoded
placeholders like `%7B%7B.Lang%7D%7D` instead of the active
language-specific page.
# How the Problems Are Solved
- Adds a small login utility to resolve `{{.Lang}}` placeholders against
the active Login V2 locale.
- Updates the signup legal acceptance component to use the resolved
links before rendering them.
- Applies the same resolution to the optional help link shown alongside
the legal acceptance text.
# Additional Changes
- Adds unit tests for the link placeholder resolver.
- Adds a component test covering localized ToS, Privacy Policy, and help
links on the signup page.
# Additional Context
- Closes #11907
---------
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
|
||
|
|
b1c8781516 |
fix(login): lru-cache compatibility, improve session error handling (#12099)
# Which Problems Are Solved - Logo and heading overlap on login pages due to a -mb-4 negative margin on the logo container - The /login route returns a 500 when `listSessions` fails (e.g. stale session cookies), because loadSessions has no error handling. - The proxy logs `"fetch() returned undefined"` because `fetchIframeOrigins` returns undefined, which lru-cache's forceFetch treats as a fetch failure. # How the Problems Are Solved - Remove `-mb-4` from the logo container in DynamicTheme. - Wrap `loadSessions` in a try/catch — failures fall through as empty sessions instead of crashing. - Return `null` instead of `undefined` from `fetchIframeOrigins` so lru-cache caches it normally. --------- Co-authored-by: Livio Spring <[email protected]> Co-authored-by: conblem <[email protected]> |
||
|
|
13f8ba4215 |
fix(console): delete role assignment in admin profile #10376 (#11867)
# Which Problems Are Solved Currently it's not possible to delete role assignments in the user profile. <img width="1026" height="516" alt="CleanShot 2026-03-18 at 10 50 01" src="https://github.com/user-attachments/assets/7b8eb316-852b-4c16-9f4b-4c041215e410" /> # How the Problems Are Solved Switched the removal of role assignments to the newer [Delete Authorization call](https://zitadel.com/docs/reference/api/authorization/zitadel.authorization.v2.AuthorizationService.DeleteAuthorization). # Additional Changes Correctly pass the role assignment id based on the context of the call. # Additional Context - Closes: #10376 --------- Co-authored-by: Max Peintner <[email protected]> Co-authored-by: Max Peintner <[email protected]> |
||
|
|
2c8d63bb71 |
feat(console): improve client details dialog ux #11834 (#11836)
# Which Problems Are Solved The console provided conflicting warnings when creating a pkce based project. # How the Problems Are Solved <img width="1026" height="432" alt="grafik" src="https://github.com/user-attachments/assets/d6609d2d-1438-42bd-9bc4-2e896c3e47d9" /> Removed the `keep your client secret at a safe place...` warning when a auth-method without a client secret is used. Changed the dialog title to `Client Details` instead of `Client Secret` # Additional Changes - Improves type safety for data passed to the `AppSecretDialogComponent`. - Updates the `AppSecretDialogComponent` to use modern Angular features, improving readability and maintainability. # Additional Context - Closes #11834 --------- Co-authored-by: Max Peintner <[email protected]> |
||
|
RamonandGitHub
|
83919d82b4 |
fix(console): display actions v1 with correct permissions #12001 (#12068)
# Which Problems Are Solved - Users needed broader IAM read permissions to access the Actions V1 page in the console. # How the Problems Are Solved - Updates the console route configuration for `/actions` to require `org.action.read`. # Additional Context - Closes #12001 |
||
|
Florian ForsterandGitHub
|
24d0f34f39 |
perf: optimize docs static generation cost (#12108)
## Summary - Switch the docs catch-all route to full static generation and prebuild both latest and versioned docs paths. - Prebuild OG images for all docs pages, make sitemap and LLM export static, and remove nondeterministic sitemap timestamps. - Reduce build-time overhead by memoizing docs sidebar trees and skipping processed markdown generation for versioned docs. ## Testing - `pnpm nx run @zitadel/docs:build` - `pnpm nx run @zitadel/docs:lint` - `pnpm nx run @zitadel/docs:check-types` - Verified the prerender manifest contains 8,816 prerendered routes, 3,293 versioned docs routes, 4,406 OG routes, and zero revalidating docs routes. |
||
|
Federico CoppedeandGitHub
|
f96a9c54ac |
docs: clarify exp and iat claim precedence for private key JWTs (#12110)
This PR updates the "Private Key JWT Auth for Service Accounts" documentation to explicitly clarify the relationship between the exp (expiration) and iat (issued at) claims. Previously, the documentation didn't make it clear what happens if a developer sets an exp claim far into the future. This update clarifies that while the exp value is strictly enforced, the iat claim takes precedence if the exp is set to more than 1 hour in the future (i.e., ZITADEL will reject the JWT once the iat is older than 1 hour, regardless of the exp time). **Changes included:** Updated the description of the exp claim in the JWT payload section to highlight the 1-hour iat limit enforcement. |
||
|
|
314b1b50dd |
docs: eliminate runtime ISR writes via full SSG (#12103)
# Which Problems Are Solved The Vercel `docs` project generated ~64M ISR writes over 30 days (99.5% of ISR writes across all projects, ~\$258/month). Root causes in the Next.js 16 docs app: - `apps/docs/app/[[...slug]]/page.tsx` had `dynamicParams = true` + `revalidate = 3600`. Bot traffic hitting unknown URLs (`/docs/wp-admin`, `/docs/.env`, fuzzed paths) got rendered via \`notFound()\`, and the 404 response was cached as an ISR entry — 1 write per unique bad URL. Known pages were also rewritten hourly for no reason since content only changes on deploy. - `apps/docs/app/og/docs/[...slug]/route.tsx` had `revalidate = false` + empty `generateStaticParams()` + implicit `dynamicParams = true`. Every unique OG URL (including bot probes) was cached forever — writes accumulated permanently. # How the Problems Are Solved Switch the docs routes to pure SSG (content is static and only changes on deploy, so ISR provides no value): - `app/[[...slug]]/page.tsx`: `dynamicParams = false`, `revalidate = false`, `dynamic = 'force-static'`. Unknown URLs now return a static 404 at the CDN — no function invocation, no ISR write. All 390 pages from `source.generateParams()` are still pre-rendered. - `app/og/docs/[...slug]/route.tsx`: `generateStaticParams()` now returns all 390 pages via the existing `getPageImage(page).segments` helper, so every OG image is pre-built as a static asset. `dynamicParams = false` + `dynamic = 'force-static'` locks it down. - `app/llms-full.txt/route.ts`: added `dynamic = 'force-static'` as a safety net (already `revalidate = false`, single URL). The tradeoff is longer CI builds (~40s–2min for 390 OG image generations, paid on every preview deploy) in exchange for eliminating ~\$258/month in ISR writes plus associated function invocations and CPU time. # Additional Changes None. # Additional Context - No changes to `next.config.mjs`, `vercel.json`, or redirects. - Existing `apps/docs/redirects.json` (3,261 entries) covers legacy URLs so `dynamicParams = false` won't 404 moved pages linked from elsewhere. - Versioned routes: `content/versions.json` and `v*/` folders don't exist yet. When versioning is activated, `generateStaticParams()` in both files must also include `versionSource.generateParams()` — otherwise versioned URLs will 404 under `dynamicParams = false`. ## Test plan - [ ] CI build succeeds (expect modest build-time increase for OG pre-generation) - [ ] Inspect `apps/docs/.next/prerender-manifest.json` — all 390 doc routes + 390 OG routes listed with `initialRevalidateSeconds: false` - [ ] Local smoke: `/docs` → 200, `/docs/wp-admin` → 404 (static, no function), `/docs/og/docs/guides/start/image.png` → PNG, `/docs/og/docs/bogus/image.png` → 404 - [ ] Post-deploy: Vercel **ISR Writes** metric drops to near-zero within 24h - [ ] Post-deploy: Vercel **Function Invocations** for `/og/docs/*` drop to zero - [ ] Verify no legitimate docs pages 404 (cross-check logs against `apps/docs/app/sitemap.ts`) --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> |
||
|
Livio SpringandGitHub
|
cc74a36b65 |
chore(deps): update go dependencies (#12094)
This PR updates all (possible) go dependencies and requires a backport to v4.x |
||
|
Max PeintnerandGitHub
|
de98c6edb8 |
fix(login): ClassifiedConnectError breaking ConnectError instanceof checks (#12022)
# Which Problems Are Solved 1. SSL/TLS handshake failures on Cloud Run (middleware self-loopback) PR #11903 changed the middleware (proxy.ts) to fetch security settings via fetch(origin + "/security") on every request, including non-proxy routes like /login. On Cloud Run, this self-loopback goes through the Google Front End (GFE) load balancer, causing intermittent SSL routines::record layer failure errors that were tenant-consistent. 2. The ClassifiedConnectError introduced in #11926 set this.name = "ClassifiedConnectError", which broke ConnectError's custom Symbol.hasInstance duck-typing check (v.name === "ConnectError"). This caused ConnectError.from() inside the connectRPC transport's abort handler to re-wrap classified errors as new ConnectError instances with Code.Unknown — losing the original gRPC error code and all classification metadata. # How the Problems Are Solved Middleware: eliminate self-loopback fetch: - Replaced the fetch(origin + "/security") self-loopback with a direct fetch to ZITADEL_API_URL using the Connect protocol (POST + JSON), bypassing the load balancer entirely - Security settings are cached in-memory with a 1-hour TTL per instance host - Extracted the fetching/caching logic into src/lib/server/security-settings.ts Removed the now-unused /security API route (src/app/security/route.ts) - CSP headers with iframe origins are now applied to all routes without any loopback Error classification interceptor: fixed - Keep this.name = "ConnectError" in ClassifiedConnectError so the duck-typing Symbol.hasInstance check passes - The branded Symbol.for check via isClassifiedError() still correctly distinguishes the subclass - Remove redundant Object.setPrototypeOf call (the super constructor already handles it via new.target) - Replace remaining instanceof ConnectError checks with isClassifiedError() in setUserPassword and checkSessionAndSetPassword |
||
|
|
dd9dcf9f72 |
feat(console): improve org search performance in create project grant page #11121 (#12057)
<!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved When creating a new Project Grant in the Zitadel console, the UI becomes extremely sluggish/unusable. The issue appears tied to the organization search dropdown attempting to load a very large dataset. # How the Problems Are Solved The refactored `SearchOrgAutocompleteComponent` uses server side filtering and ondemand loading using infinite scrolling. This makes sure on a subset of organizations is ever loaded on the client. # Additional Changes - Added tailwindcss for easier styling - Removed build warnings - Removed some of the SCSS syntax warnings # Additional Context - Closes #11121 --------- Co-authored-by: Max Peintner <[email protected]> |
||
|
RamonandGitHub
|
bfffd69d60 |
fix(console): normalize empty OIDC redirect uri updates #12053 (#12067)
# Which Problems Are Solved - Clearing OIDC redirect URI lists in the console does not persist correctly resulting in no changes error. # How the Problems Are Solved - Normalizes empty OIDC URI list updates to [""] before sending the save request. - Uses the application v2 update call for the affected OIDC config save path. # References - Closes #12053 |
||
|
c0f7bfffdb |
docs(api): remove incorrect note on CreateInviteCode endpoint (#12073)
# Which Problems Are Solved The CreateInviteCode endpoint wrongly stated that a new code can only be issued if the old had expired or was invalidated due to too many attempts, which is not true. # How the Problems Are Solved Removed the note from the proto / API documentation. # Additional Changes None # Additional Context - noticed by a customer - requires backport to v4.x --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Matías Racedo <[email protected]> |
||
|
Marco A.andGitHub
|
14acc60edd |
feat: ListSessions to relational (#11987)
# Which Problems Are Solved This PR introduces the possibility of using the relational DB when calling the ListSession gRPC endpoint. # How the Problems Are Solved - Implement the Querier interface for ListSession: - Create a `domain` model for the Session object to be able to map the gRPC session into it. - Match the permission filters on ES side to be sure the same sessions are returned - Implement converter methods to go from `gRPC` to `domain` models (both ways) - Fix the session sql relational migration: rework the trigger to update the `expiration` field to perform the update only when the input `lifetime` has a non-zero value. - Link the Querier implementation with the gRPC endpoint - Run the same integration tests against the relational DB, making sure the outcome is the same. ⚠️ Due to missing permission checks, some divergence is expected. Hence, specific code to circumvent the differences has been put in place # Additional Context - Closes #11039 |
||
|
Tim MöhlmannandGitHub
|
177589a0a8 |
fix(grpc): increase MaxSendMsgSize (#12066)
# Which Problems Are Solved Users exporting larger orgsanizations were facing grpc message size limits of 4 MiB, while trying to export 6.3 MiB of data. Other export methods like S3 aren't implemented. # How the Problems Are Solved Set MaxSendMsgSize to 10 MiB (allow some overhead). This is not a long-term solution and we should investigate better ways of export. # Additional Changes - none # Additional Context - Support ticket |
||
|
Gayathri VijayanandGitHub
|
e19bb7a173 |
feat: implement AddZitadelProvider in ManagementService (#12056)
# Which Problems Are Solved This PR adds implementation to add a Zitadel IdP at the organization-level. # How the Problems Are Solved - Added handling/converters for the `AddZitadelProvider` endpoint in `ManagementService` in the server layer - Registered a new `org.idp.zitadel.added` event for org-level Zitadel providers - Added `AddOrgZitadelProvider` command to validate the request and push `org.idp.zitadel.added` event to the eventstore - Added the `org.idp.zitadel.added` event to the projection reducer - Added unit and integration tests # Additional Changes added more tests for the ZitadelProvider in AdminService # Additional Context - Closes https://github.com/zitadel/zitadel/issues/11823 - Follow-up for PRs https://github.com/zitadel/zitadel/pull/12018, https://github.com/zitadel/zitadel/pull/12020, https://github.com/zitadel/zitadel/pull/12055 |
||
|
Gayathri VijayanandGitHub
|
55a9acf3bf |
feat: projection layer implementation to add Zitadel provider (#12055)
# Which Problems Are Solved Persisting instance-level Zitadel provider in the projections. # How the Problems Are Solved - Defining a new projection table `projections.idp_templates6_zitadel` and columns for the Zitadel provider - Adding a reducer `reduceZitadelIDPAdded` to process instance-level `ZitadelIDPAddedEvent` - Unit tests # Additional Changes N/A # Additional Context - Related to https://github.com/zitadel/zitadel/issues/11823 - Follow-up for PRs https://github.com/zitadel/zitadel/pull/12018, https://github.com/zitadel/zitadel/pull/12020 |
||
|
|
7b9d2b7d17 |
feat: add administrator role permission table (#11817)
This update introduces a new table for managing administrator role permissions, along with the necessary repository and projection logic to handle adding and removing permissions. It also includes tests to ensure the correct functionality of the permission management system. closes https://github.com/zitadel/zitadel/issues/10219 --------- Co-authored-by: Marco Ardizzone <[email protected]> |
||
|
|
bb3b52dda3 |
feat: command layer implementation for AddZitadelProvider (#12020)
# Which Problems Are Solved This PR contains the command-layer implementation to add an instance IDP of the type `ZitadelProvider` # How the Problems Are Solved - Implementing `AddZitadelProvider` in AdminService - Adding the command-layer to create a `ZitadelProvider` and push `ZitadelIDPAddedEvent` # Additional Changes N/A # Additional Context - Related to https://github.com/zitadel/zitadel/issues/11823 - Follow-up for PR https://github.com/zitadel/zitadel/pull/12018 --------- Co-authored-by: Copilot <[email protected]> |
||
 |
01fe34a526 |
fix(oidc): use authenticated encryption for opaque tokens (#12017)
# Which Problems Are Solved Opaque tokens now use authenticated encryption. # How the Problems Are Solved - Upgrade zitadel/oidc to v3.47 - Copy crypto implementation for refresh and session tokens (internal to zitadel) - Added config that allows validating old tokens for gradual roll-out # Additional Changes - Set NX cache for `integration-test-build` to `false`, working on a seperate fix. # Additional Context - closes #11315 --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: muhlemmer <[email protected]> |
||
 Mridang AgarwallaandGitHub
|
a28ee63b02 | feat(login): add ZITADEL_API_AWAITINITIALCONN support (#12032) |