Bump the npm-dependencies-major group across 1 directory with 21 updates

[dependabot]

Bumps the npm-dependencies-major group with 21 updates in the / directory:

Package	From	To
@angular/animations	21.2.8	22.0.2
@angular/cdk	21.2.6	22.0.2
@angular/common	21.2.8	22.0.2
@angular/compiler	21.2.8	22.0.2
@angular/core	21.2.8	22.0.2
@angular/forms	21.2.8	22.0.2
@angular/material	21.2.6	22.0.2
@angular/platform-browser	21.2.8	22.0.2
@angular/platform-browser-dynamic	21.2.8	22.0.2
@angular/router	21.2.8	22.0.2
@angular-eslint/builder	21.3.1	22.0.0
@angular-eslint/eslint-plugin	21.3.1	22.0.0
@angular-eslint/eslint-plugin-template	21.3.1	22.0.0
@angular-eslint/schematics	21.3.1	22.0.0
@angular-eslint/template-parser	21.3.1	22.0.0
@angular/build	21.2.7	22.0.3
@angular/cli	21.2.7	22.0.3
@angular/compiler-cli	21.2.8	22.0.2
@types/node	25.6.0	26.0.0
diff	8.0.4	9.0.0
typescript	5.9.3	6.0.3

Updates @angular/animations from 21.2.8 to 22.0.2

Release notes

Sourced from @​angular/animations's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

http

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Description
	migration skip any target are not build or test

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

... (truncated)

Changelog

Sourced from @​angular/animations's changelog.

22.0.2 (2026-06-17)

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

22.1.0-next.0 (2026-06-10)

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit	Type	Description
25c744c4d0	fix	support foreign components defined outside top-level scope

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#68674)

... (truncated)

Commits

• a97d5ec build: update minimum supported Node.js versions
• ad717df refactor(core): use the @Service decorator where possible.
• b8d3f36 feat(compiler-cli): add support for Node.js 26.0.0
• 6672192 test: remove duplicate tests (#67518)
• d550bf7 build: update minimum supported Node.js versions
• See full diff in compare view

Updates @angular/cdk from 21.2.6 to 22.0.2

Release notes

Sourced from @​angular/cdk's releases.

22.0.2

material

Commit	Description
	bottom-sheet: ensure animation event comes from container
	chips: correct focus management on chip destruction (#33329)
	chips: wrong padding when chip only has edit icon (#33407)
	grid-list: always validate colspan
	stepper: validate animation durations

cdk

Commit	Description
	layout: avoid CSS injection attacks in media matcher
	platform: account for composedPath error during event replay (#33409)

multiple

Commit	Description
	improve dark theme visibility in menu, overlay, and portal examples (#33367)

22.0.1

youtube-player

Commit	Description
	avoid errors with clobbered variables
	validate ID before attaching them to placeholder

material

Commit	Description
	dialog: ignore clicks on aria-disabled close buttons (#33373)
	timepicker: do not allow intervals less than a second (#33354)

cdk

Commit	Description
	a11y: avoid prototype conflicts in id generator (#33356)
	clipboard: avoid infinite attempt loop (#33366)

aria

Commit	Description
	combobox: avoid error for synthetic events (#33360)
	combobox: prevent re-dispatching keyboard event on control target change (#33362)
	tree: recursive textDirection getter (#33337)

22.0.0

aria

Commit	Description
	accordion: introduce accordion harness (#33046)
	combobox: add test harnesses (#33194)
	combobox: migrate simple-combobox directly into primary entrypoints (#33206)
	grid: add test harnesses (#33081)

... (truncated)

Changelog

Sourced from @​angular/cdk's changelog.

22.0.2 "plastic lion" (2026-06-17)

cdk

Commit	Type	Description
e8f3419060	fix	layout: avoid CSS injection attacks in media matcher
9dc2b2b2ed	fix	platform: account for composedPath error during event replay (#33409)

material

Commit	Type	Description
fb4478bff3	fix	bottom-sheet: ensure animation event comes from container
e4f7f3498b	fix	chips: correct focus management on chip destruction (#33329)
766b7aceee	fix	chips: wrong padding when chip only has edit icon (#33407)
ebca801ee5	fix	grid-list: always validate colspan
30942bcd36	fix	stepper: validate animation durations

multiple

Commit	Type	Description
2995797ded	fix	improve dark theme visibility in menu, overlay, and portal examples (#33367)

22.1.0-next.0 "argon-pineapple" (2026-06-10)

No user facing changes in this release

22.0.1 "argon-apple" (2026-06-10)

aria

Commit	Type	Description
7581b0592	fix	combobox: avoid error for synthetic events (#33360)
1c4706155	fix	combobox: prevent re-dispatching keyboard event on control target change (#33362)
96e9ce10c	fix	tree: recursive textDirection getter (#33337)

cdk

Commit	Type	Description
629aea403	fix	a11y: avoid prototype conflicts in id generator (#33356)
49aeb676c	fix	clipboard: avoid infinite attempt loop (#33366)

material

Commit	Type	Description
d7a8cb963	fix	dialog: ignore clicks on aria-disabled close buttons (#33373)
bde3c7621	fix	timepicker: do not allow intervals less than a second (#33354)

youtube-player

Commit	Type	Description
d75a22d69	fix	avoid errors with clobbered variables
fe0a96ce6	fix	validate ID before attaching them to placeholder

... (truncated)

Commits

• 9b9d0ea release: cut the v22.0.2 release
• 7b54e95 build: update cross-repo angular dependencies (#33398)
• b77a829 docs(google-maps): Document the behavior of using the clusterClick output in ...
• 605f200 build: update pnpm to v10.34.3 (#33392)
• 0309150 build: lock file maintenance (#33406)
• 9dc2b2b fix(cdk/platform): account for composedPath error during event replay (#33409)
• 766b7ac fix(material/chips): wrong padding when chip only has edit icon (#33407)
• f7170b9 build: fix build failure (#33408)
• e4f7f34 fix(material/chips): correct focus management on chip destruction (#33329)
• 9ad7964 build: update review config (#33394)
• Additional commits viewable in compare view

Updates @angular/common from 21.2.8 to 22.0.2

Release notes

Sourced from @​angular/common's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

http

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Description
	migration skip any target are not build or test

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

22.0.2 (2026-06-17)

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

22.1.0-next.0 (2026-06-10)

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit	Type	Description
25c744c4d0	fix	support foreign components defined outside top-level scope

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#68674)

... (truncated)

Commits

• 6867f77 fix(http): distinguish repeated transfer cache params
• 6c1f3e9 fix(common): skip transfer cache for uncacheable HTTP traffic (#69316)
• 7ef1399 fix(http): skip transfer cache for fetch credentialed requests (#69316)
• 94ea403 fix(common): escape anchor fragment in shadow DOM name selector
• 2dd65d2 fix(http): pass down the reportUploadProgress and reportDownloadProgress ...
• 1bd5a56 docs: deprecate XHR support for server-side rendering in HTTP docs and recomm...
• 3c2892c fix(common): prevent prototype pollution in formatDateTime
• c4b5fa3 fix(common): escape CSS string-terminating characters in escapeCssUrl
• 4254eb4 fix(http): preserve empty referrer option in HttpRequest
• 167bd4c fix(http): Rejects non-HTTP(S) URLs in JSONP requests
• Additional commits viewable in compare view

Updates @angular/compiler from 21.2.8 to 22.0.2

Release notes

Sourced from @​angular/compiler's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

http

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Description
	migration skip any target are not build or test

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

22.0.2 (2026-06-17)

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

22.1.0-next.0 (2026-06-10)

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit	Type	Description
25c744c4d0	fix	support foreign components defined outside top-level scope

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#68674)

... (truncated)

Commits

• 74f2b91 refactor(compiler): correct TcbInvalidReferenceOp initializer
• b32ee7c fix(core): treat iframe credentialless as security-sensitive
• f309727 refactor(compiler): Collect in-element comments
• 6f11719 fix(compiler): restrict possible event handler check to property names longer...
• 8bb3947 refactor: optimize dom security schema lookups
• 4645850 refactor(compiler): Remove 80 char limit on AbstractEmitterVisitor
• 1ee224c fix(compiler): disallow i18n event attributes
• 5946c18 fix(compiler): sanitize href/xlink:href attributes of any element of the ...
• 393b84c fix(compiler): sanitize two-way properties
• 3d9ca2f fix(compiler-cli): bind switch exhaustive check expressions
• Additional commits viewable in compare view

Updates @angular/core from 21.2.8 to 22.0.2

Release notes

Sourced from @​angular/core's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape... Description has been truncated