fix(deps): update angular dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular-devkit/build-angular	20.3.5 → 20.3.22
@angular/animations (source)	20.3.3 → 20.3.18
@angular/build	20.3.5 → 20.3.22
@angular/cdk	20.2.8 → 20.2.14
@angular/cli	20.3.4 → 20.3.22
@angular/compiler-cli (source)	20.3.3 → 20.3.18
@angular/forms (source)	20.3.3 → 20.3.18
@angular/material	20.2.8 → 20.2.14
@angular/platform-browser (source)	20.3.3 → 20.3.18
@angular/platform-browser-dynamic (source)	20.3.3 → 20.3.18
@angular/router (source)	20.3.3 → 20.3.18
ng-packagr	20.3.0 → 20.3.2
zone.js (source, changelog)	0.15.0 → 0.16.1

---

Release Notes

angular/angular-cli (@​angular-devkit/build-angular)

v20.3.22

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
5978eeeff	fix	update picomatch to 4.0.4

@​angular-devkit/core

Commit	Type	Description
6e9b92612	fix	update picomatch to 4.0.4

@​angular/build

Commit	Type	Description
6f209c26d	fix	update picomatch to 4.0.4

v20.3.21

Compare Source

@​angular/ssr

Commit	Type	Description
1dc6992a5	fix	disallow x-forwarded-prefix starting with a backslash
0a2ff0b2b	fix	ensure unique values in redirect response Vary header
cdbac82a8	fix	support custom headers in redirect responses

v20.3.20

Compare Source

@​angular/build

Commit	Type	Description
0fd6823af	fix	pass process environment variables to prerender workers

v20.3.19

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
0299b4d1a	fix	update copy-webpack-plugin to v14.0.0

v20.3.18

Compare Source

@​angular-devkit/core

Commit	Type	Description
39596d529	fix	update ajv to 8.18.0

@​angular/build

Commit	Type	Description
f668e2778	fix	update rollup to 4.59.0

v20.3.17

Compare Source

@​angular/ssr

Commit	Type	Description
8700e18d7	fix	prevent open redirect via X-Forwarded-Prefix header
67582a946	fix	validate host headers to prevent header-based SSRF

v20.3.16

Compare Source

@​angular/cli

Commit	Type	Description
656888a25	fix	update dependency @​modelcontextprotocol/sdk to v1.26.0

v20.3.15

Compare Source

@​angular/cli

Commit	Type	Description
795d65413	fix	update pacote to v21.0.4

@​angular-devkit/build-angular

Commit	Type	Description
ffc72cbc5	fix	update webpack to version 5.104.1

v20.3.14

Compare Source

@​angular/cli

Commit	Type	Description
ff366499e	fix	update dependency @​modelcontextprotocol/sdk to v1.25.2

v20.3.13

Compare Source

@​angular/cli

Commit	Type	Description
cfbb61602	fix	update @modelcontextprotocol/sdk to v1.24.0

v20.3.12

Compare Source

@​angular/build

Commit	Type	Description
25bb7e65c	fix	ensure correct URL joining for prerender routes

@​angular/ssr

Commit	Type	Description
cceb86296	fix	handle X-Forwarded-Prefix and APP_BASE_HREF in redirects
1abe68ad8	fix	prevent redirect loop with encoded query parameters

v20.3.11

Compare Source

@​angular/build

Commit	Type	Description
8053f2d92	fix	ensure ɵgetOrCreateAngularServerApp is always defined after errors

v20.3.10

Compare Source

@​schematics/angular

Commit	Type	Description
c854a719b	fix	correct tsconfig.spec.json include for spec files

@​angular/build

Commit	Type	Description
b3908f68e	fix	do not remove @angular/localize when having external packages (#​31721)

v20.3.9

Compare Source

@​angular/ssr

Commit	Type	Description
08e07e338	fix	improve locale handling in app-engine
683697ebc	fix	improve route matching for wildcard routes

v20.3.8

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
813cba9b9	fix	expand jest and jest-environment-jsdom to allow version 30

@​angular/build

Commit	Type	Description
542973ab0	fix	add adapters to new reporter
f0885691d	fix	ensure locale data plugin runs before other plugins
45e498f95	fix	handle redirects from guards during prerendering

v20.3.7

Compare Source

@​angular-devkit/schematics

Commit	Type	Description
a31533cf4	fix	respect --force option when schematic contains host.create

@​angular/build

Commit	Type	Description
8cdda111c	fix	resolve Angular locale data namespace in esbuild
5847ccc54	fix	update vite to 7.11.1

@​angular/ssr

Commit	Type	Description
3a28fb6a1	fix	correctly handle routes with matrix parameters
5db6d6487	fix	ensure server-side navigation triggers a redirect

v20.3.6

Compare Source

@​angular/ssr

Commit	Type	Description
5271547c8	fix	prevent malicious URL from overriding host

angular/angular (@​angular/animations)

v20.3.18

Compare Source

compiler

Commit	Type	Description
02fbf08890	fix	disallow translations of iframe src

core

Commit	Type	Description
72126f9a08	fix	sanitize translated attribute bindings with interpolations
626bc8bc20	fix	sanitize translated form attributes

v20.3.17

Compare Source

Breaking Changes

core

• Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

  (cherry picked from commit 03da204)

core

Commit	Type	Description
7f9de3c118	fix	block creation of sensitive URI attributes from ICU messages

v20.3.16

Compare Source

core

Commit	Type	Description
c2c2b4aaa8	fix	sanitize sensitive attributes on SVG script elements

v20.3.15

Compare Source

compiler

Commit	Type	Description
d1ca8ae043	fix	prevent XSS via SVG animation attributeName and MathML/SVG URLs

v20.3.14

Compare Source

http

Commit	Type	Description
0276479e7d	fix	prevent XSRF token leakage to protocol-relative URLs

v20.3.13

Compare Source

v20.3.12

Compare Source

v20.3.11

Compare Source

common

Commit	Type	Description
5047849a4a	fix	remove placeholder image listeners once view is removed

compiler

Commit	Type	Description
f9d0818087	fix	support arbitrary nesting in :host-context()
106b9040df	fix	support commas in :host() argument
9419ea348a	fix	support complex selectors in :nth-child()
036c5d2a07	fix	support one additional level of nesting in :host()

core

Commit	Type	Description
dcdd1bcdbb	fix	skip leave animations on view swaps

v20.3.10

Compare Source

compiler-cli

Commit	Description
	make required inputs diagnostic less noisy

migrations

Commit	Description
	Prevent removal of templates referenced with preceding whitespace characters

v20.3.9

Compare Source

v20.3.7

Compare Source

animations

Commit	Type	Description
bd38cd45a5	fix	account for Element.animate exceptions (#​64506)

compiler

Commit	Type	Description
891f180262	fix	correctly compile long numeric HTML entities (#​64297)

compiler-cli

Commit	Type	Description
371274bfc6	fix	missingStructuralDirective diagnostic produces false negatives (#​64470)

core

Commit	Type	Description
4c89a267c3	fix	pass element removal property through in all locations (#​64565)
2fad4d4ab6	fix	prevent duplicate nodes from being retained with fast `animate.leave`` calls (#​64592)

router

Commit	Type	Description
cfd8ed3fff	fix	Fix outlet serialization and parsing with no primary children (#​64505)
182fe78f91	fix	Surface parse errors in Router.parseUrl (#​64503)

v20.3.6

Compare Source

core

Commit	Type	Description
911d6822cb	fix	update animation scheduling (#​64441)

platform-browser

Commit	Type	Description
2ece42866d	fix	DomEventsPlugin should always be the last plugin to be called for supports(). (#​50394)

v20.3.5

Compare Source

compiler-cli

Commit	Type	Description
8dec92ff9f	fix	capture metadata for undecorated fields (#​63957) (#​64317)
c2e817b0ef	perf	fix performance of "interpolated signal not invoked" check (#​64410)

core

Commit	Type	Description
f15cfa4cc4	fix	fixes regression in animate.leave function bindings (#​64413)
d54dd674ca	fix	Prevents early style pruning with leave animations (#​64335)

migrations

Commit	Type	Description
554573e524	fix	migrating input with more than 1 usage in a method (#​64367)
2c79ca0b57	fix	remove error for no matching files in control flow migration (#​64253) (#​64314)

router

Commit	Type	Description
6e4bcc7d22	fix	Scroll restoration should use instant scroll behavior for traversals (#​64299)

v20.3.4

Compare Source

core

Commit	Type	Description
853ed169a8	fix	ensure missing leave animations don't queue leave animations (#​64226)
6fed986b7a	fix	Fixes animations in conjunction with content projection (#​63776)
76fe5599fe	fix	handle undefined CSS time values in parseCssTimeUnitsToMs function (#​64181)
3b959105be	fix	prevent early exit from leave animations when multiple transitions are present (#​64225)

migrations

Commit	Type	Description
65884895ff	fix	preserve component imports when pruning NgModules in standalone migration (#​64186)

angular/components (@​angular/cdk)

v20.2.14

Compare Source

material

Commit	Type	Description
52f00f317	fix	button-toggle: fix typo in clamp-density call
0de537fd7	fix	stepper: fix typo in clamp-density call

v20.2.13

Compare Source

material

Commit	Type	Description
7b63d9560	fix	chips: avatar image stretched in Safari (#​32278)

v20.2.12

Compare Source

v20.2.11

Compare Source

material

Commit	Type	Description
b751456cd9	fix	menu: add filter for trigger icon name (#​32188)

v20.2.10

Compare Source

material

Commit	Type	Description
b2cd596d3	fix	core: differentiate container colors in m2 (#​32076)

v20.2.9

Compare Source

material

Commit	Type	Description
af3b961214	fix	checkbox: use GrayText for disabled colors in high contrast mode (#​32066)
a90abb0a77	fix	snack-bar: add max height for snack bar (#​32000)

ng-packagr/ng-packagr (ng-packagr)

v20.3.2

Compare Source

Bug Fixes

• ensure deterministic ordering of 'exports' field (952ca64), closes #​3175

v20.3.1

Compare Source

Performance

• reduce memory usage for multiple entry-points (non-watch) (e063368), closes #​3168

angular/angular (zone.js)

v0.16.1

Compare Source

• fix(zone.js): support passthrough of Promise.try API (fc557f0), closes #​67057

v0.16.0

Compare Source

• fix(zone.js): Support jasmine v6 (48abe00)
• fix(zone.js): waitForAsync should pass args to the test function (#​61755) (3c216c1), closes #​61755 #​61717 #​61755
• refactor(zone.js): Add internal implementation for auto ticking fakeAsync (#​62135) (0a827f9), closes #​62135 #​62135
• refactor(zone.js): Im

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

File name: package.json

Post-upgrade command 'ng update {{{depName}}} --from={{{fromVersion}}} --to={{{toVersion}}} --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedPostUpgradeCommands

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package.json

Post-upgrade command 'ng update @angular-devkit/build-angular --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/animations --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/build --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/cdk --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/cli --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/compiler-cli --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/forms --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/material --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/platform-browser --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/platform-browser-dynamic --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update @angular/router --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update ng-packagr --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands

File name: package.json

Post-upgrade command 'ng update zone.js --from= --to= --migrateOnly --allowDirty --force' has not been added to the allowed list in allowedCommands