chore(deps): bump @angular/common from 20.3.9 to 20.3.14 in /packages/components-angular #6749

dependabot · 2025-11-26T23:45:29Z

Bumps @angular/common from 20.3.9 to 20.3.14.

Release notes

Sourced from @angular/common's releases.

20.3.14

http

Commit Description

prevent XSRF token leakage to protocol-relative URLs

20.3.13

No release notes provided.

20.3.12

No release notes provided.

20.3.11

common

Commit Description

remove placeholder image listeners once view is removed

compiler

Commit Description

support arbitrary nesting in :host-context()

support commas in :host() argument

support complex selectors in :nth-child()

support one additional level of nesting in :host()

core

Commit Description

skip leave animations on view swaps

20.3.10

compiler-cli

Commit Description

make required inputs diagnostic less noisy

migrations

Commit Description

Prevent removal of templates referenced with preceding whitespace characters

Changelog

Sourced from @angular/common's changelog.

20.3.14 (2025-11-25)

http

Commit Type Description

0276479e7d fix prevent XSRF token leakage to protocol-relative URLs

21.0.1 (2025-11-25)

compiler-cli

Commit Type Description

39c577bc36 fix do not type check native controls with ControlValueAccessor

8d3a89a477 fix escape angular control flow in jsdoc

bc34083d34 fix ignore non-existent files

core

Commit Type Description

0ea1e07174 fix apply bootstrap-options migration to platformBrowserDynamic

70507b8c1c fix debug data causing memory leak for root effects

a55482fca3 fix notify profiler events in case of errors

49ad7c6508 fix use injected DOCUMENT for CSP_NONCE

cc1ec09931 perf avoid repeat searches for field directive

forms

Commit Type Description

7d5c7cf99a feat add DI option for classes on Field directive

8acf5d2756 fix allow dynamic type bindings on signal form controls

de5fca94c5 fix run reset as untracked

http

Commit Type Description

3240d856d9 fix prevent XSRF token leakage to protocol-relative URLs

migrations

Commit Type Description

... (truncated)

Commits

0276479 fix(http): prevent XSRF token leakage to protocol-relative URLs
a8c577d docs: add reference to Built-in Pipes in multiple pipe files
8922cae Revert "refactor(http): migrate XSRF classes to use inject() function"
5047849 fix(common): remove placeholder image listeners once view is removed
4c66fe4 refactor(core): mark VERSION as @__PURE__ for better tree-shaking
2ad6b72 refactor(http): migrate XSRF classes to use inject() function
ee578d3 build: format md files
744cd5c refactor(http): simplifies destruction tracking using destroyed property
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

changeset-bot · 2025-11-26T23:45:33Z

⚠️ No Changeset found

Latest commit: 95737b7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

swisspost-bot · 2025-11-28T15:58:06Z

Related Previews

https://preview-6749--swisspost-design-system-next.netlify.app?devModeEnabled=true

oliverschuerch · 2025-12-08T14:50:41Z

@dependabot rebase

dependabot · 2025-12-08T14:50:44Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

oliverschuerch · 2025-12-08T14:51:04Z

@dependabot recreate

oliverschuerch · 2025-12-08T15:40:17Z

@dependabot recreate

Bumps [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) from 20.3.9 to 20.3.14. - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/20.3.14/packages/common) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 20.3.14 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

…angular/angular/common-20.3.14

socket-security · 2025-12-08T17:03:18Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@angular/common@20.3.14 ⏵ 20.3.15
	postcss@8.5.6
	tslib@2.8.1
	prettier@3.6.2

View full report

socket-security · 2025-12-08T17:03:20Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `safer-buffer` is 94.0% likely obfuscated Confidence: 0.94 Location: Package overview From: pnpm-lock.yaml → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

sonarqubecloud · 2025-12-08T17:04:17Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 26, 2025

dependabot bot requested a review from a team as a code owner November 26, 2025 23:45

dependabot bot requested a review from gfellerph November 26, 2025 23:45

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 26, 2025

oliverschuerch requested review from oliverschuerch and removed request for gfellerph December 8, 2025 14:43

dependabot bot force-pushed the dependabot/npm_and_yarn/packages/components-angular/angular/common-20.3.14 branch from 2d132ea to 64612ff Compare December 8, 2025 14:52

dependabot bot force-pushed the dependabot/npm_and_yarn/packages/components-angular/angular/common-20.3.14 branch from 99fdc82 to 444db1b Compare December 8, 2025 15:41

oliverschuerch and others added 3 commits December 8, 2025 17:40

Merge branch 'main' into dependabot/npm_and_yarn/packages/components-…

a1b4193

…angular/angular/common-20.3.14

Merge branch 'main' into dependabot/npm_and_yarn/packages/components-…

7960623

…angular/angular/common-20.3.14

chore: update lock file

95737b7

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump @angular/common from 20.3.9 to 20.3.14 in /packages/components-angular #6749

chore(deps): bump @angular/common from 20.3.9 to 20.3.14 in /packages/components-angular #6749

dependabot bot commented on behalf of github Nov 26, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented Nov 26, 2025 •

edited

Loading

Uh oh!

swisspost-bot commented Nov 28, 2025 •

edited

Loading

Uh oh!

oliverschuerch commented Dec 8, 2025

Uh oh!

dependabot bot commented on behalf of github Dec 8, 2025

Uh oh!

oliverschuerch commented Dec 8, 2025

Uh oh!

oliverschuerch commented Dec 8, 2025

Uh oh!

socket-security bot commented Dec 8, 2025

Uh oh!

socket-security bot commented Dec 8, 2025

Uh oh!

sonarqubecloud bot commented Dec 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Commit	Description
	support arbitrary nesting in :host-context()
	support commas in :host() argument
	support complex selectors in :nth-child()
	support one additional level of nesting in :host()

Commit	Type	Description
39c577bc36	fix	do not type check native controls with ControlValueAccessor
8d3a89a477	fix	escape angular control flow in jsdoc
bc34083d34	fix	ignore non-existent files

Commit	Type	Description
0ea1e07174	fix	apply bootstrap-options migration to `platformBrowserDynamic`
70507b8c1c	fix	debug data causing memory leak for root effects
a55482fca3	fix	notify profiler events in case of errors
49ad7c6508	fix	use injected `DOCUMENT` for `CSP_NONCE`
cc1ec09931	perf	avoid repeat searches for field directive

Commit	Type	Description
7d5c7cf99a	feat	add DI option for classes on `Field` directive
8acf5d2756	fix	allow dynamic `type` bindings on signal form controls
de5fca94c5	fix	run reset as untracked

chore(deps): bump @angular/common from 20.3.9 to 20.3.14 in /packages/components-angular #6749

Are you sure you want to change the base?

chore(deps): bump @angular/common from 20.3.9 to 20.3.14 in /packages/components-angular #6749

Conversation

dependabot bot commented on behalf of github Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

20.3.14

http

20.3.13

20.3.12

20.3.11

common

compiler

core

20.3.10

compiler-cli

migrations

20.3.14 (2025-11-25)

http

21.0.1 (2025-11-25)

compiler-cli

core

forms

http

migrations

Uh oh!

changeset-bot bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

swisspost-bot commented Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oliverschuerch commented Dec 8, 2025

Uh oh!

dependabot bot commented on behalf of github Dec 8, 2025

Uh oh!

oliverschuerch commented Dec 8, 2025

Uh oh!

oliverschuerch commented Dec 8, 2025

Uh oh!

socket-security bot commented Dec 8, 2025

Uh oh!

socket-security bot commented Dec 8, 2025

Uh oh!

sonarqubecloud bot commented Dec 8, 2025

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot bot commented on behalf of github Nov 26, 2025 •

edited

Loading

changeset-bot bot commented Nov 26, 2025 •

edited

Loading

swisspost-bot commented Nov 28, 2025 •

edited

Loading