chore(deps): bump @angular/compiler from 20.3.16 to 22.0.1 by dependabot[bot] · Pull Request #1348 · morganstanley/ComposeUI

dependabot · 2026-06-10T20:49:12Z

Bumps @angular/compiler from 20.3.16 to 22.0.1.

Release notes

Sourced from @angular/compiler's releases.

22.0.1

common

Commit Description

escape CSS string-terminating characters in escapeCssUrl

Limits date format string length

prevent prototype pollution in formatDateTime

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

disallow i18n event attributes

more robust logic to check if regex can be optimized

sanitize href/xlink:href attributes of any element of the MathML namespace

sanitize two-way properties

compiler-cli

Commit Description

bind switch exhaustive check expressions

core

Commit Description

disable WebMCP during SSR

Handle synchronous errors in PendingTasks.run function

harden TransferState restoration against DOM clobbering

prevent dangling prevConsumer reference from leaking destroyed views (#68681)

require WebMCP tool descriptions

update comment for Default change detection

use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray

validate lowercase SVG animation attribute names

forms

Commit Description

delay mcp reading the form model by a tick

harden FormGroup control lookups against prototype shadowing

remove animationstart listener on component destroy to prevent memory leak

set additionalProperties: false on generated WebMCP form

http

Commit Description

ensure query parameters are inserted before URL fragments

pass down the reportUploadProgress and reportDownloadProgress on post/patch requests

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit Description

prevent external template inlay hints from appearing in TS files

platform-server

| Commit | Description |

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

22.0.1 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)

common

Commit Type Description

c4b5fa3c92 fix escape CSS string-terminating characters in escapeCssUrl

dfff57ede9 fix Limits date format string length

3c2892c8df fix prevent prototype pollution in formatDateTime

1d87c49f6e fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

1ee224ca30 fix disallow i18n event attributes

a56f1cdf8f fix more robust logic to check if regex can be optimized

5946c18275 fix sanitize href/xlink:href attributes of any element of the MathML namespace

393b84caf8 fix sanitize two-way properties

compiler-cli

Commit Type Description

3d9ca2f173 fix bind switch exhaustive check expressions

core

Commit Type Description

669146b0e7 fix disable WebMCP during SSR

562a566ead fix Handle synchronous errors in PendingTasks.run function

fa546f382d fix harden TransferState restoration against DOM clobbering

29fdb98684 fix prevent dangling prevConsumer reference from leaking destroyed views (#68681)

cdcea80327 fix require WebMCP tool descriptions

4289c4c840 fix update comment for Default change detection

3dd433b39a fix use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray

045bb736b3 fix validate lowercase SVG animation attribute names

forms

Commit Type Description

11836a670a fix delay mcp reading the form model by a tick

85d2d100e3 fix harden FormGroup control lookups against prototype shadowing

e51ad374ea fix remove animationstart listener on component destroy to prevent memory leak

55b7b5a6b6 fix set additionalProperties: false on generated WebMCP form

http

Commit Type Description

ffb06c0514 fix ensure query parameters are inserted before URL fragments

2dd65d21e6 fix pass down the reportUploadProgress and reportDownloadProgress on post/patch requests

4254eb416c fix preserve empty referrer option in HttpRequest

167bd4c162 fix Rejects non-HTTP(S) URLs in JSONP requests

language-service

| Commit | Type | Description |

... (truncated)

Commits

4645850 refactor(compiler): Remove 80 char limit on AbstractEmitterVisitor
1ee224c fix(compiler): disallow i18n event attributes
5946c18 fix(compiler): sanitize href/xlink:href attributes of any element of the ...
393b84c fix(compiler): sanitize two-way properties
3d9ca2f fix(compiler-cli): bind switch exhaustive check expressions
a56f1cd fix(compiler): more robust logic to check if regex can be optimized
2891f7e fix(compiler): move projection attributes into constants
94d520f fix(compiler): prevent namespaced SVG <style> elements from being stripped
d9c38e5 docs: fix typos in source code comments
a08e4fb fix(core): normalize tag names in runtime i18n attribute security context loo...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) from 20.3.16 to 22.0.1. - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.1/packages/compiler) --- updated-dependencies: - dependency-name: "@angular/compiler" dependency-version: 22.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-15T20:56:29Z