chore(deps): bump the npm_and_yarn group across 1 directory with 36 updates

[dependabot]

Bumps the npm_and_yarn group with 16 updates in the / directory:

Package	From	To
@angular/common	9.1.11	19.2.16
@angular/compiler	9.1.11	19.2.17
@angular/core	9.1.11	10.2.5
chart.js	2.9.3	2.9.4
moment	2.26.0	2.30.1
karma	4.4.1	6.4.4
json5	2.1.3	2.2.3
json5	1.0.1	1.0.2
loader-utils	1.4.0	3.3.1
ajv	6.12.0	6.12.3
async	2.6.3	2.6.4
qs	6.5.2	6.5.3
follow-redirects	1.11.0	1.15.11
ip	1.1.5	removed
js-yaml	3.13.1	3.14.2
json-schema	0.2.3	0.4.0
jszip	3.3.0	3.10.1

Updates @angular/common from 9.1.11 to 19.2.16

Release notes

Sourced from @​angular/common's releases.

19.2.16

http

Commit	Description
	prevent XSRF token leakage to protocol-relative URLs

19.2.15

core

Commit	Description
	introduce BootstrapContext for improved server bootstrapping (#63639)

Breaking Changes

core

• The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

  Before:

  const bootstrap = () => bootstrapApplication(AppComponent, config);

  After:

  const bootstrap = (context: BootstrapContext) =>
    bootstrapApplication(AppComponent, config, context);

  A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

  In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

For more information please see: GHSA-68x2-mx4q-78m7

19.2.14

compiler

Commit	Description
	lexer support for template literals in object literals (#61601)

migrations

Commit	Description
	preserve comments when removing unused imports (#61674)

19.2.13

common

Commit	Description
	avoid injecting ApplicationRef in FetchBackend (#61649)

service-worker

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

19.2.16 (2025-11-26)

http

Commit	Type	Description
05fe6686a9	fix	prevent XSRF token leakage to protocol-relative URLs

21.1.0-next.0 (2025-11-25)

platform-browser

Commit	Type	Description
ec9dc94cee	feat	add context to createApplication
ab67988d2e	feat	resolve JIT resources in createApplication

router

Commit	Type	Description
a03c82564d	feat	Add scroll behavior controls on router navigation
c25d749d85	feat	Execute RunGuardsAndResolvers function in injection context
c84d372778	feat	Support wildcard params with segments trailing (#64737)

20.3.14 (2025-11-25)

http

Commit	Type	Description
0276479e7d	fix	prevent XSRF token leakage to protocol-relative URLs

21.0.1 (2025-11-25)

compiler-cli

| Commit | Type | Description |

... (truncated)

Commits

• 05fe668 fix(http): prevent XSRF token leakage to protocol-relative URLs
• 12e2302 build: update common's locales to use rules_js (#61630)
• 9701047 test(common): Add circular deps test to 19.2.x (#61651)
• 2c876b4 fix(common): avoid injecting ApplicationRef in FetchBackend (#61649)
• 8e54b57 build: move private testing helpers outside platform-browser/testing (#61571)
• 2b1b14f fix(core): cleanup rxResource abort listener (#58306)
• 126efc9 fix(common): cancel reader when app is destroyed (#61528)
• efda872 fix(common): prevent reading chunks if app is destroyed (#61354)
• c43fd3a build: migrate common to use rules_js based toolchain (#61434)
• 185b780 build: migrate packages/core/schematics to ts_project (#61420)
• Additional commits viewable in compare view

Updates @angular/compiler from 9.1.11 to 19.2.17

Release notes

Sourced from @​angular/compiler's releases.

19.2.17

compiler

Commit	Description
	prevent XSS via SVG animation attributeName and MathML/SVG URLs

19.2.16

http

Commit	Description
	prevent XSRF token leakage to protocol-relative URLs

19.2.15

core

Commit	Description
	introduce BootstrapContext for improved server bootstrapping (#63639)

Breaking Changes

core

• The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

  Before:

  const bootstrap = () => bootstrapApplication(AppComponent, config);

  After:

  const bootstrap = (context: BootstrapContext) =>
    bootstrapApplication(AppComponent, config, context);

  A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

  In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

For more information please see: GHSA-68x2-mx4q-78m7

19.2.14

compiler

Commit	Description
	lexer support for template literals in object literals (#61601)

migrations

Commit	Description
	preserve comments when removing unused imports (#61674)

19.2.13

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

19.2.17 (2025-12-01)

compiler

Commit	Type	Description
7c42e2ebeb	fix	prevent XSS via SVG animation attributeName and MathML/SVG URLs

19.2.16 (2025-11-26)

http

Commit	Type	Description
05fe6686a9	fix	prevent XSRF token leakage to protocol-relative URLs

21.1.0-next.0 (2025-11-25)

platform-browser

Commit	Type	Description
ec9dc94cee	feat	add context to createApplication
ab67988d2e	feat	resolve JIT resources in createApplication

router

Commit	Type	Description
a03c82564d	feat	Add scroll behavior controls on router navigation
c25d749d85	feat	Execute RunGuardsAndResolvers function in injection context
c84d372778	feat	Support wildcard params with segments trailing (#64737)

20.3.14 (2025-11-25)

http

| Commit | Type | Description |

... (truncated)

Commits

• 7c42e2e fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
• 24bab55 fix(compiler): lexer support for template literals in object literals (#61601)
• fc2483e refactor(compiler): avoid duplication between FactoryTarget type (#61571)
• 8e54b57 build: move private testing helpers outside platform-browser/testing (#61571)
• 44bb328 fix(compiler): avoid conflicts between HMR code and local symbols (#61550)
• 1007079 build: update compiler-cli to not be stamped when used for the compiler in ng...
• 0d025c5 build: support new ng_project rule (#61336)
• 899cb4a refactor: add explicit types for exports relying on inferred call return type...
• 1312eb1 build: remove irrelevant madge circular deps tests (#61209)
• 964b261 refactor(compiler): improve stringify (#60013)
• Additional commits viewable in compare view

Updates @angular/core from 9.1.11 to 10.2.5

Changelog

Sourced from @​angular/core's changelog.

10.2.5 (2021-04-14)

Bug Fixes

• compiler-cli: show a more specific error for Ivy NgModules (#41534) (#41598) (f630f33)
• core: fix possible XSS attack in development through SSR (#40525) (ba8da74)

10.2.4 (2020-12-17)

Bug Fixes

• core: fix possible XSS attack in development through SSR. (#40152) (0b8e3d5)
• core: set ngDevMode to false when calling enableProdMode() (#40160) (90570c0)

10.2.3 (2020-11-09)

Bug Fixes

• compiler: ensure that i18n message-parts have the correct source-span (#39589) (e67a331)
• compiler: skipping leading whitespace should not break placeholder source-spans (#39589) (2b684b7), closes #39195
• compiler-cli: avoid duplicate diagnostics about unknown pipes (#39517) (861e4fa)
• compiler-cli: do not drop non-Angular decorators when downleveling (#39577) (1c6cf8a), closes #39574

10.2.2 (2020-11-04)

Bug Fixes

• compiler-cli: report missing pipes when fullTemplateTypeCheck is disabled (#39320) (71d0063), closes #38195
• core: markDirty() should only mark flags when really scheduling tick. (#39316) (8c82106), closes #39296
• router: Ensure all outlets are used when commands have a prefix (#39456) (85d5242)

Performance Improvements

• core: do not recurse into modules that have already been registered (#39514) (812355c), closes #39487

... (truncated)

Commits

• ba8da74 fix(core): fix possible XSS attack in development through SSR (#40525)
• 90570c0 fix(core): set ngDevMode to false when calling enableProdMode() (#40160)
• 0b8e3d5 fix(core): fix possible XSS attack in development through SSR. (#40152)
• 1aee8b3 refactor(compiler): store the fullStart location on ParseSourceSpans (#39...
• 812355c perf(core): do not recurse into modules that have already been registered (#3...
• 8f36c21 refactor(router): Small refactor of createUrlTree and extra tests (#39456)
• 90acb91 docs: tView.preOrderHooks and tView.preOrderCheckHooks docs update (#39497)
• 8c82106 fix(core): markDirty() should only mark flags when really scheduling tick. (#...
• 0b37249 docs(core): update a typo in the comment of ngZoneEventCoalescing (#39423)
• 3b779a1 docs: fix typo in initializeInputAndOutputAliases docstring (#39438)
• Additional commits viewable in compare view

Updates chart.js from 2.9.3 to 2.9.4

Release notes

Sourced from chart.js's releases.

v2.9.4

This is the last release of v2 and focused on fixing bugs identified in the v2.9.3 release.

Bugs Fixed

• #7404 - Preserve prototypes when cloning. Thanks @​iddings
• #7587 - Fix docs for external moment.js. Thanks @​mojoaxel
• #7853 - Fix box recursion when dimensions are NaN. Thanks @​alessandroasm
• #7883 - Fix call stack exception when computing label sizes. Thanks @​silentmatt
• #7918 - Prevent global prototype pollution via the merge helper
• #7920 - Use Object.create(null) as merge target, to prevent prototype pollution

Commits

• 9bd4cf8 Release v2.9.4
• 1d92605 Use Object.create(null) as merge target (#7920)
• dff7140 When objects are merged together, the target prototype can be polluted. (#7918)
• d919188 Bump verison number to v2.9.4
• 42ed589 Fix Maximum call stack size exception in computeLabelSizes (#7883)
• 063b7dc [2.9] FitBoxes recursion when dimensions are NaN (#7853)
• 2493cb5 Use node v12.18.2 on Travis CI (#7864)
• 679ec4a docs: fix rollup external moment (#7587)
• 484f0d1 Preserve object prototypes when cloning (#7404)
• 2df6986 Look for any branch starting with release (#7087) (#7089)
• See full diff in compare view

Updates moment from 2.26.0 to 2.30.1

Changelog

Sourced from moment's changelog.

2.30.1

• Release Dec 27, 2023
• Revert moment/moment#5827, because it's breaking a lot of TS code.

2.30.0 Full changelog

• Release Dec 26, 2023

2.29.4

• Release Jul 6, 2022
  • #6015 [bugfix] Fix ReDoS in preprocessRFC2822 regex

2.29.3 Full changelog

• Release Apr 17, 2022
  • #5995 [bugfix] Remove const usage
  • #5990 misc: fix advisory link

2.29.2 See full changelog

• Release Apr 3 2022

Address GHSA-8hfj-j24r-96c4

2.29.1 See full changelog

• Release Oct 6, 2020

Updated deprecation message, bugfix in hi locale

2.29.0 See full changelog

• Release Sept 22, 2020

New locales (es-mx, bn-bd). Minor bugfixes and locale improvements. More tests. Moment is in maintenance mode. Read more at this link: https://momentjs.com/docs/#/-project-status/

2.28.0 See full changelog

• Release Sept 13, 2020

Fix bug where .format() modifies original instance, and locale updates

2.27.0 See full changelog

... (truncated)

Commits

• 485d9a7 Build 2.30.1
• e048b09 Bump version to 2.30.1
• f9f2d58 Update changelog for 2.30.1
• a52ffb2 Revert "Merge pull request #5827 from BobZombie:feature/fix_d.ts"
• ddd6809 Build 2.30.0
• be64d00 Bump version to 2.30.0
• ad41179 Update changelog for 2.30.0
• 63fe479 [misc] Make code ES6 compatible
• 0f0195f Revert "Merge pull request #5599 from Alanscut:issue_4985"
• 15b82f5 Revert "Merge pull request #5597 from Alanscut:issue-5596"
• Additional commits viewable in compare view

Updates karma from 4.4.1 to 6.4.4

Release notes

Sourced from karma's releases.

v6.4.4

6.4.4 (2024-07-29)

v6.4.3

6.4.3 (2024-02-24)

Bug Fixes

• add build commits for patch release (d7f2d69)

v6.4.2

6.4.2 (2023-04-21)

Bug Fixes

• few typos (c6a4271)

v6.4.1

6.4.1 (2022-09-19)

Bug Fixes

• pass integrity value (63d86be)

v6.4.0

6.4.0 (2022-06-14)

Features

• support SRI verification of link tags (dc51a2e)
• support SRI verification of script tags (6a54b1c)

v6.3.20

6.3.20 (2022-05-13)

Bug Fixes

• prefer IPv4 addresses when resolving domains (e17698f), closes #3730

v6.3.19

6.3.19 (2022-04-19)

Bug Fixes

... (truncated)

Changelog

Sourced from karma's changelog.

6.4.4 (2024-07-29)

6.4.3 (2024-02-24)

Bug Fixes

• add build commits for patch release (d7f2d69)

6.4.2 (2023-04-21)

Bug Fixes

• few typos (c6a4271)

6.4.1 (2022-09-19)

Bug Fixes

• pass integrity value (63d86be)

6.4.0 (2022-06-14)

Features

• support SRI verification of link tags (dc51a2e)
• support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

• prefer IPv4 addresses when resolving domains (e17698f), closes #3730

6.3.19 (2022-04-19)

Bug Fixes

• client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes

... (truncated)

Commits

• 84f85e7 chore(release): 6.4.4 [skip ci]
• a4d1284 build(deps-dev): bump ws from 6.2.1 to 6.2.3
• d8cf806 chore(release): 6.4.3 [skip ci]
• d7f2d69 fix: add build commits for patch release
• 85a2eeb build(deps-dev): bump decode-uri-component from 0.2.0 to 0.2.2
• 0bffce2 build(deps): updated socket.io version to fix security issues with socket.io-...
• 86667ab build(deps): bump follow-redirects from 1.11.0 to 1.15.4
• 450fdfd docs: Add deprecation notice to Karma README
• 9de3c00 chore(release): 6.4.2 [skip ci]
• c6a4271 fix: few typos
• Additional commits viewable in compare view

Updates json5 from 2.1.3 to 2.2.3

Release notes

Sourced from json5's releases.

v2.2.3

• Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2

• Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

• Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0

• New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

Changelog

Sourced from json5's changelog.

v2.2.3 [code, diff]

• Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

• Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

• Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0 [code, diff]

• New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

Commits

• c3a7524 2.2.3
• 94fd06d docs: update CHANGELOG for v2.2.3
• 3b8cebf docs(security): use GitHub security advisories
• f0fd9e1 docs: publish a security policy
• 6a91a05 docs(template): bug -> bug report
• 14f8cb1 2.2.2
• 10cc7ca docs: update CHANGELOG for v2.2.2
• 7774c10 fix: add proto to objects and arrays
• edde30a Readme: slight tweak to intro
• 97286f8 Improve example in readme
• Additional commits viewable in compare view

Updates json5 from 1.0.1 to 1.0.2

Release notes

Sourced from json5's releases.

v2.2.3

• Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2

• Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

• Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0

• New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

Changelog

Sourced from json5's changelog.

v2.2.3 [code, diff]

• Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

• Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

• Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0 [code, diff]

• New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

Commits

• c3a7524 2.2.3
• 94fd06d docs: update CHANGELOG for v2.2.3
• 3b8cebf docs(security): use GitHub security advisories
• f0fd9e1 docs: publish a security policy
• 6a91a05 docs(template): bug -> bug report
• 14f8cb1 2.2.2
• 10cc7ca docs: update CHANGELOG for v2.2.2
• 7774c10 fix: add proto to objects and arrays
• edde30a Readme: slight tweak to intro
• 97286f8 Improve example in readme
• Additional commits viewable in compare view

Updates loader-utils from 1.4.0 to 3.3.1

Release notes

Sourced from loader-utils's releases.

v3.3.1

3.3.1 (2024-06-05)

Bug Fixes

• base64safe regex (3b2d3b1)

v3.3.0

3.3.0 (2024-06-04)

Features

• add digestType 'base64safe' (#259) (af15793)

v3.2.2

3.2.2 (2024-05-29)

Bug Fixes

• unreachable code for directories (128f945)

v3.2.1

3.2.1 (2022-11-11)

Bug Fixes

• ReDoS problem (#224) (d2d752d)

v3.2.0

3.2.0 (2021-11-11)

Features

• hash uniformity for base digests (451858b)

v3.1.3

3.1.3 (2021-11-04)

Bug Fixes

• crash with md4 hash (#198) (ef084d4)

v3.1.2

3.1.2 (2021-11-04)

... (truncated)

Changelog

Sourced from loader-utils's changelog.

3.3.1 (2024-06-05)

Bug Fixes

• base64safe regex (3b2d3b1)

3.3.0 (2024-06-04)

Features

• add digestType 'base64safe' (#259) (af15793)

3.2.2 (2024-05-29)

Bug Fixes

• unreachable code for directories (128f945)

3.2.1 (2022-11-11)

Bug Fixes

• ReDoS problem (#224) (d2d752d)

3.2.0 (2021-11-11)

Features

• hash uniformity for base digests (451858b)

3.1.3 (2021-11-04)

Bug Fixes

• crash with md4 hash (#198) (ef084d4)

3.1.2 (2021-11-04)

Bug Fixes

• bug with unicode characters (#196) (0426405)

3.1.1 (2021-11-04)

... (truncated)

Commits

• 06fcc0a chore(release): 3.3.1
• 3b2d3b1 fix: base64safe regex
• 2d6ed3c chore(release): 3.3.0
• af15793 feat: add digestType 'base64safe' (#259)
• 977b28d chore(release): 3.2.2
• 83e1c68 style: fix (#258)
• 128f945 fix: unreachable code for directories
• 50890cd docs: add missing security policy (#251)
• 62e12f1 chore(deps): bump word-wrap from 1.2.3 to 1.2.4 (#247)
• 9e20ec8 chore(deps): bump semver from 5.7.1 to 5.7.2 (#246)
• Additional commits viewable in compare view

Updates ajv from 6.12.0 to 6.12.3

Release notes

Sourced from ajv's releases.

v6.12.3

Pass schema object to processCode function Option for strictNumbers (@​issacgerges, #1128) Fixed vulnerability related to untrusted schemas (CVE-2020-15366)

v6.12.2

Removed post-install script

v6.12.1

Docs and dependency updates

Commits

• 521c3a5 6.12.3
• bd7107b Merge pull request #1229 from ajv-validator/dependabot/npm_and_yarn/mocha-8.0.1
• 9c26bb2 Merge pull request #1234 from ajv-validator/dependabot/npm_and_yarn/eslint-7.3.1
• c6a6daa Merge branch 'master' into dependabot/npm_and_yarn/mocha-8.0.1
• 15eda23 Merge branch 'master' into dependabot/npm_and_yarn/eslint-7.3.1
• d6aabb8 test: remove node 8 from travis test
• c4801ca Merge pull request #1242 from ajv-validator/refactor
• 988982d ignore proto properties
• f2b1e3d whitespace
• 65e3678 Merge pull request #1239 from GrahamLea/patch-1
• Additional commits viewable in compare view

Updates async from 2.6.3 to 2.6.4

Changelog

Sourced from async's changelog.

v2.6.4

• Fix potential prototype pollution exploit (#1828)

Commits

• c6bdaca Version 2.6.4
• 8870da9 Update built files
• 4df6754 update changelog
• 8f7f903 Fix prototype pollution vulnerability (#1828)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by hargasinski, a new releaser for async since your current version.

Updates body-parser from 1.19.0 to 1.20.4

Release notes

Sourced from body-parser's releases.

1.20.4

What's Changed

• Remove redundant depth check by @​blakeembrey in expressjs/body-parser#538
• ci: add support for Node.js v23 by @​Phillip9587 in expressjs/body-parser#553
• ci: restore CI for 1.x branch by @​bjohansebas in expressjs/body-parser#665
• deps: qs@^6.14.0 by @​bjohansebas in expressjs/body-parser#664
• deps: use tilde notation and update certain dependencies by @​Phillip9587 in