Bump the angular group across 1 directory with 19 updates

[dependabot]

Bumps the angular group with 19 updates in the / directory:

Package	From	To
@angular/animations	21.2.6	21.2.13
@angular/cdk	21.2.4	21.2.11
@angular/common	21.2.6	21.2.13
@angular/compiler	21.2.6	21.2.13
@angular/core	21.2.6	21.2.13
@angular/forms	21.2.6	21.2.13
@angular/material	21.2.4	21.2.11
@angular/platform-browser	21.2.6	21.2.13
@angular/platform-browser-dynamic	21.2.6	21.2.13
@angular/router	21.2.6	21.2.13
@angular-devkit/build-angular	21.2.10	21.2.11
@angular-eslint/builder	20.1.1	21.4.0
@angular-eslint/eslint-plugin	20.1.1	21.4.0
@angular-eslint/eslint-plugin-template	20.1.1	21.4.0
@angular-eslint/schematics	20.1.1	21.4.0
@angular-eslint/template-parser	20.1.1	21.4.0
@angular/cli	21.2.5	21.2.11
@angular/compiler-cli	21.2.6	21.2.13
@angular/language-service	21.2.6	21.2.13

Updates @angular/animations from 21.2.6 to 21.2.13

Release notes

Sourced from @​angular/animations's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/animations's changelog.

21.2.13 (2026-05-13)

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit	Type	Description
f584840e2e	fix	add allowedHosts option to renderModule and renderApplication

22.0.0-next.12 (2026-05-08)

core

Commit	Type	Description
8ebae1de33	fix	allow service with factory on abstract classes
6f525245cd	fix	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Type	Description
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-server

| Commit | Type | Description |

... (truncated)

Commits

• See full diff in compare view

Updates @angular/cdk from 21.2.4 to 21.2.11

Release notes

Sourced from @​angular/cdk's releases.

21.2.11

No user facing changes in this release

21.2.10

aria

Commit	Description
	menu: do not set default aria-label (#33202)

21.2.9

material

Commit	Description
	stepper: allow stepper to be labelled (#33137)

cdk

Commit	Description
	tree: enter/space key on child node should not toggle parent node expansion (#33125)

aria

Commit	Description
	menu: use computed for menu item patterns, with trigger on visible (#33118)

21.2.8

No user facing changes in this release

21.2.7

material

Commit	Description
	sort: deprecate MatSortHeaderIntl and hide from docs (#33089)

21.2.6

material

Commit	Description
	select: wrong transform origin when opening upwards inside another overlay (#33032)

21.2.5

material

Commit	Description
	sidenav: not resetting margin if transition does not start (#33001)
	slider: not picking up static direction (#33006)
	tooltip: allow hover detection logic to be customized (#33018)

cdk

Commit	Description
	stepper: linear updates not reflected in the DOM (#33007)

Changelog

Sourced from @​angular/cdk's changelog.

21.2.11 "crystal ball" (2026-05-13)

No user facing changes in this release

22.0.0-next.8 "plastic-wallaby" (2026-05-06)

Breaking Changes

aria

• The legacy combobox and autocomplete implementations have been removed. Use the new standalone combobox instead.

  • feat(aria/combobox): promote simple-combobox to stable un-prefixed combobox
  • Relocates public, private, and example directories to clean combobox entry points.
  • Renames internal layout symbols, selectors, and uppercase tokens (SIMPLE_COMBOBOX_POPUP -> COMBOBOX_POPUP).
  • Establishes full documentation extraction parity with the json_api Bazel rule target.
  • Standardizes the accompanying toolbar component showcase into the clean aria-toolbar path.
  • Re-routes dev-app navigation links and migrates public API golden records.

• SimpleCombobox has been promoted to Combobox. All simple-combobox prefixed symbols, selectors, and tokens have been renamed to use the combobox prefix.

  • refactor(aria/combobox): relocate and restructure autocomplete and toolbar examples Relocate the autocomplete examples to src/components-examples/aria/autocomplete and toolbar examples to src/components-examples/aria/toolbar.
  • Restore naming continuity with the historical codebase by stripping redundant prefixes from example filenames and component selectors.
  • Sync dev-app preview routing layout paths and strict Bazel target dependency links.

cdk

• • CDK_DESCRIBEDBY_HOST_ATTRIBUTE has been removed.
  • CDK_DESCRIBEDBY_ID_PREFIX has been removed.
  • The injector parameter of the ConfigurableFocusTrap and FocusTrap constructors is now required.
  • The boolean parameter of ConfigurableFocusTrapFactory.create has been replaced with a config object.
  • MESSAGES_CONTAINER_ID has been removed.
• • The event parameter of DropListRef.drop is now required.
• • ContextMenuTracker has been renamed to MenuTracker.

material

• • MatListOption.checkboxPosition has been removed. use togglePosition instead.
  • MatListOptionCheckboxPosition has been renamed to MatListOptionTogglePosition.
• • ArrowViewState has been removed.
  • ArrowViewStateTransition has been removed.

google-maps

Commit	Type	Description
b8201edee	fix	deprecate heatmap layer (#33208)

material

Commit	Type	Description
add8f16c0	fix	list: breaking changes for v22
9d73c98b5	fix	menu: missing panelClass getter (#33191)
75718e4fb	fix	sort: breaking changes for v22

cdk

Commit	Type	Description

... (truncated)

Commits

• 1238d15 release: cut the v21.2.11 release
• 583da8a release: cut the v21.2.10 release
• babfbb7 build: update cross-repo angular dependencies (#33205)
• e08fdf2 build: fix failing test (#33212)
• 09e89fa build: lock file maintenance (#33201)
• 4897366 fix(aria/menu): do not set default aria-label (#33202)
• a6c5b72 build: update cross-repo angular dependencies (#33181)
• b7c34e3 build: update cross-repo angular dependencies (#33160)
• 58e29cf build: update dependency bazel_lib to v3.3.1 (#33177)
• e2f16ac build: update pnpm to v10.33.2 (#33165)
• Additional commits viewable in compare view

Updates @angular/common from 21.2.6 to 21.2.13

Release notes

Sourced from @​angular/common's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

21.2.13 (2026-05-13)

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit	Type	Description
f584840e2e	fix	add allowedHosts option to renderModule and renderApplication

22.0.0-next.12 (2026-05-08)

core

Commit	Type	Description
8ebae1de33	fix	allow service with factory on abstract classes
6f525245cd	fix	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Type	Description
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-server

| Commit | Type | Description |

... (truncated)

Commits

• 30cf85f refactor(common): update deprecation message
• 42d57c3 refactor(common): fix viewport tests
• 10ad3c0 fix(common): prevent focus from scrollToAnchor
• 540536c fix(http): add CSP nonce support to JsonpClientBackend
• 8102331 test(http): disable XSRF and mock location in HttpClient tests to avoid Domin...
• 13f050d test: construct local Date objects to fix timezone flakiness
• d0cf299 test: remove unsupported timezone from formatDate tests
• See full diff in compare view

Updates @angular/compiler from 21.2.6 to 21.2.13

Release notes

Sourced from @​angular/compiler's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.13 (2026-05-13)

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit	Type	Description
f584840e2e	fix	add allowedHosts option to renderModule and renderApplication

22.0.0-next.12 (2026-05-08)

core

Commit	Type	Description
8ebae1de33	fix	allow service with factory on abstract classes
6f525245cd	fix	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Type	Description
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-server

| Commit | Type | Description |

... (truncated)

Commits

• baf92da test: remove invalid css that was causing issues with the postcss parser
• 1c6553e fix(core): disallow event attribute bindings in host bindings unconditionally
• 4f5d8a2 fix(compiler): let declaration span not including end character
• a4f3120 refactor(compiler): require a reference in DirectiveMeta
• de533fe refactor(compiler-cli): move ClassPropertyMapping into compiler
• ea1e34c refactor(compiler): move matchSource into base metadata
• e40d378 fix(compiler): handle nested brackets in host object bindings
• d04ddd7 fix(core): prevent binding unsafe attributes on SVG animation elements (#67797)
• fea25d1 fix(compiler): register SVG animation attributes in URL security context (#67...
• See full diff in compare view

Updates @angular/core from 21.2.6 to 21.2.13

Release notes

Sourced from @​angular/core's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

21.2.13 (2026-05-13)

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit	Type	Description
f584840e2e	fix	add allowedHosts option to renderModule and renderApplication

22.0.0-next.12 (2026-05-08)

core

Commit	Type	Description
8ebae1de33	fix	allow service with factory on abstract classes
6f525245cd	fix	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Type	Description
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-server

| Commit | Type | Description |

... (truncated)

Commits

• 1c6553e fix(core): disallow event attribute bindings in host bindings unconditionally
• 9e38ed7 fix(core): sanitizer typings
• 3430251 fix(core): i18n flags leaking on errors
• c37f6ca fix(core): visit ng-let expression value in signal migration schematics
• fe13bb6 fix(core): allow explicit read generic with signal input transforms
• 7a05a9a fix(core): validate security-sensitive attributes in i18n bindings
• 1aeebbe fix(core): respect ngSkipHydration on components with projectable nodes in LC...
• 4900e45 build: update cross-repo angular dependencies
• a40e2ce fix(core): fix ordering of view queries metadata in JIT mode
• 9bcbf37 refactor(core): fix bundling symbol test
• Additional commits viewable in compare view

Updates @angular/forms from 21.2.6 to 21.2.13

Release notes

Sourced from @​angular/forms's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Description has been truncated

[cloudflare-workers-and-pages]

Deploying timelinetools with    Cloudflare Pages

Latest commit:	88e267f
Status:	✅  Deploy successful!
Preview URL:	https://cc09ae6e.timelinetools.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-angu-zcue.timelinetools.pages.dev

View logs