chore(deps): bump the npm_and_yarn group across 8 directories with 24 updates

[dependabot]

Bumps the npm_and_yarn group with 22 updates in the / directory:

Package	From	To
js-yaml	4.1.1	4.3.1
immutable	5.1.5	5.1.8
esbuild	0.28.0	0.28.1
@angular/common	21.2.10	21.2.19
@angular/compiler	21.2.10	21.2.19
@angular/core	21.2.10	21.2.17
body-parser	1.20.5	1.20.6
brace-expansion	1.1.14	1.1.18
fast-uri	3.1.2	3.1.5
http-proxy-middleware	2.0.9	2.0.10
ip-address	10.2.0	10.5.0
joi	17.13.3	17.13.4
launch-editor	2.13.2	2.14.1
nanoid	3.3.12	3.3.18
postcss	8.5.14	8.5.26
shell-quote	1.8.3	1.10.0
svgo	3.3.3	3.3.4
tar	7.5.13	7.5.22
undici	6.25.0	6.28.0
webpack-dev-server	5.2.2	5.2.6
websocket-driver	0.7.4	0.7.5
ws	6.2.3	6.2.6

Bumps the npm_and_yarn group with 2 updates in the /e2e/global-teardown directory: @babel/core and @babel/plugin-transform-modules-systemjs.
Bumps the npm_and_yarn group with 4 updates in the /e2e/native-esm directory: brace-expansion, ip-address, tar and ws.
Bumps the npm_and_yarn group with 1 update in the /e2e/require-missing-ext directory: ws.
Bumps the npm_and_yarn group with 2 updates in the /e2e/transform/multiple-transformers directory: @babel/core and @babel/plugin-transform-modules-systemjs.
Bumps the npm_and_yarn group with 1 update in the /e2e/transform/transform-snapshotResolver directory: @babel/plugin-transform-modules-systemjs.
Bumps the npm_and_yarn group with 1 update in the /e2e/transform/transform-testrunner directory: @babel/plugin-transform-modules-systemjs.
Bumps the npm_and_yarn group with 1 update in the /e2e/transform/transformer-config directory: @babel/core.

Updates js-yaml from 4.1.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.
• Fix digits in YAML named tag handles.

Security

• Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• 590dbab 4.2.0 released
• Additional commits viewable in compare view

Updates immutable from 5.1.5 to 5.1.8

Release notes

Sourced from immutable's releases.

v5.1.8

What's Changed

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

• fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227

internal

• Backport tests from 6.x branch by @​jdeniau in immutable-js/immutable-js#2199
• fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index by @​jdeniau in immutable-js/immutable-js#2203
• Better type for reduce if not ininitial value is given by @​jdeniau in immutable-js/immutable-js#2205
• Backport test from #2193 by @​jdeniau in immutable-js/immutable-js#2207
• backport tests from 6.x by @​jdeniau in immutable-js/immutable-js#2213
• Firefox link to non-French page by @​jdeniau in immutable-js/immutable-js#2219
• Bump esbuild and @​size-limit/preset-small-lib by @​dependabot[bot] in immutable-js/immutable-js#2217
• backport tests from #2210 by @​jdeniau in immutable-js/immutable-js#2214
• Bump shell-quote from 1.8.2 to 1.8.4 by @​dependabot[bot] in immutable-js/immutable-js#2211
• Bump @​tootallnate/once from 2.0.0 to 2.0.1 by @​dependabot[bot] in immutable-js/immutable-js#2190
• Bump minimatch from 9.0.5 to 9.0.9 by @​dependabot[bot] in immutable-js/immutable-js#2189
• Bump @​codemirror/theme-one-dark from 6.1.2 to 6.1.3 by @​dependabot[bot] in immutable-js/immutable-js#2168
• Bump form-data from 4.0.5 to 4.0.6 by @​dependabot[bot] in immutable-js/immutable-js#2220
• Bump typescript-eslint from 8.33.0 to 8.61.1 by @​dependabot[bot] in immutable-js/immutable-js#2222
• Bump @​rollup/plugin-commonjs from 28.0.2 to 29.0.3 by @​dependabot[bot] in immutable-js/immutable-js#2224

New Contributors

• @​chatman-media made their first contribution in immutable-js/immutable-js#2227

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

• fix(reverseFactory): read reversedSequence.size in __iterator instead of this by @​jdeniau in immutable-js/immutable-js#2196

Internal

• Bump lodash from 4.17.23 to 4.18.1 by @​dependabot[bot] in immutable-js/immutable-js#2184
• Bump form-data from 4.0.0 to 4.0.5 by @​dependabot[bot] in immutable-js/immutable-js#2187
• Bump flatted from 3.3.2 to 3.4.2 by @​dependabot[bot] in immutable-js/immutable-js#2182
• Bump next from 15.5.9 to 15.5.18 by @​dependabot[bot] in immutable-js/immutable-js#2188

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.8

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

4.3.9

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

• fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
• fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
• [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

• fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

Commits

• 6496539 5.1.8
• 808a83a Merge commit from fork
• e51d49f perf(Map): index large hash-collision buckets for faster lookups
• 25c58b0 fix typescript in tests
• a1a1ee4 Merge commit from fork
• f4c94e2 fix(List): refactor bounds validation and add coverage
• c221031 Merge pull request #2228 from immutable-js/node-24-in-actions
• dcfe0ee Upgrade actions
• 40aeb47 5.1.7
• 6a1860f Merge pull request #2227 from chatman-media/fix/repeat-last-index-of-off-by-one
• Additional commits viewable in compare view

Updates esbuild from 0.28.0 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates @angular/common from 21.2.10 to 21.2.19

Release notes

Sourced from @​angular/common's releases.

21.2.19

compiler

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

http

Commit	Description
	distinguish repeated transfer cache params
	enable xsrf for root-provided HttpClient

platform-server

Commit	Description
	update domino to latest version

21.2.18

compiler-cli

Commit	Description
	update babel dependencies to latest v7

core

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

http

Commit	Description
	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

21.2.17

common

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	sanitize two-way properties

core

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

21.2.19 (2026-07-29)

compiler

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

platform-server

Commit	Type	Description
f34a93c946	fix	update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit	Type	Description
8d22cc953b	fix	update babel dependencies to latest v7

core

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

http

Commit	Type	Description
91df739b80	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

21.2.17 (2026-06-10)

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Type	Description
86a56dc279	fix	Limits date format string length

... (truncated)

Commits

• 948a8d6 fix(http): distinguish repeated transfer cache params
• 9949dcc fix(http): enable xsrf for root-provided HttpClient
• 91df739 fix(http): prevent caching of responses with Set-Cookie headers
• 86a56dc fix(common): Limits date format string length
• bcb1b7e fix(http): preserve empty referrer option in HttpRequest
• a810a31 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
• bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
• d846326 fix(common): skip transfer cache for uncacheable HTTP traffic
• e245d40 fix(http): skip transfer cache for fetch credentialed requests
• f6d8e64 fix(common): only strip a literal /index.html suffix from URLs
• Additional commits viewable in compare view

Updates @angular/compiler from 21.2.10 to 21.2.19

Release notes

Sourced from @​angular/compiler's releases.

21.2.19

compiler

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

http

Commit	Description
	distinguish repeated transfer cache params
	enable xsrf for root-provided HttpClient

platform-server

Commit	Description
	update domino to latest version

21.2.18

compiler-cli

Commit	Description
	update babel dependencies to latest v7

core

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

http

Commit	Description
	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

21.2.17

common

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	sanitize two-way properties

core

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.19 (2026-07-29)

compiler

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

platform-server

Commit	Type	Description
f34a93c946	fix	update domino to latest version

21.2.18 (2026-07-08)

compiler-cli

Commit	Type	Description
8d22cc953b	fix	update babel dependencies to latest v7

core

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

http

Commit	Type	Description
91df739b80	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

21.2.17 (2026-06-10)

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Type	Description
86a56dc279	fix	Limits date format string length

... (truncated)

Commits

• 7b884f5 fix(compiler): restrict possible event handler check to property names longer...
• e2660c3 fix(compiler): disallow i18n event attributes
• dc9c996 fix(compiler): sanitize two-way properties
• ae1c8a1 fix(compiler): move projection attributes into constants
• eb1cbbf fix(compiler): prevent namespaced SVG <style> elements from being stripped
• 29ceeff docs: fix typos in source code comments
• 782e015 fix(compiler): strip namespaced SVG script elements during template compilati...
• ff12fe5 fix(core): normalize tag names in runtime i18n attribute security context loo...
• 0b07f47 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
• cc1378d fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
• Additional commits viewable in compare view

Updates @angular/core from 21.2.10 to 21.2.17

Release notes

Sourced from @​angular/core's releases.

21.2.17

common

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	sanitize two-way properties

core

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69269)

http

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

platform-server

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69255)

service-worker

Commit	Description
	Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

21.2.16

common

Commit	Description
	only strip a literal /index.html suffix from URLs

compiler

Commit	Description
	move projection attributes into constants

core

Commit	Description
	harden inherit definition feature against polluted prototypes
	use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

21.2.17 (2026-06-10)

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Type	Description
86a56dc279	fix	Limits date format string length
d846326b07	fix	skip transfer cache for uncacheable HTTP traffic
bc55749698	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
dc9c99636d	fix	sanitize two-way properties

core

Commit	Type	Description
1523061137	fix	harden TransferState restoration against DOM clobbering
88832c84f8	fix	validate lowercase SVG animation attribute names (#69269)

http

Commit	Type	Description
bcb1b7ea25	fix	preserve empty referrer option in HttpRequest
a810a319d1	fix	Rejects non-HTTP(S) URLs in JSONP requests
e245d40c4d	fix	skip transfer cache for fetch credentialed requests

platform-server

Commit	Type	Description
35510746b7	fix	harden platform location origin validation during SSR
13fb0afe93	refactor	deprecate ServerXhr (#69255)

service-worker

Commit	Type	Description
b9d29381bb	fix	Strips sensitive headers on cross-origin redirects

21.2.16 (2026-06-03)

common

Commit	Type	Description
f6d8e642b0	fix	only strip a literal /index.html suffix from URLs

compiler

Commit	Type	Description
ae1c8a1f7a	fix	move projection attributes into constants

core

Commit	Type	Description

... (truncated)

Commits

• 88832c8 fix(core): validate lowercase SVG animation attribute names (#69269)
• 3551074 fix(platform-server): harden platform location origin validation during SSR
• bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
• d846326 fix(common): skip transfer ca...

  Description has been truncated