629905d537
fix(platform-server): add allowedHosts option to renderModule and renderApplication
...
In server-side rendering (SSR) setups, passing request URLs directly to the lower-level rendering APIs `renderModule` or `renderApplication` can expose applications to Server-Side Request Forgery (SSRF) or Host Header Injection attacks via absolute-form request URLs.
To mitigate these vulnerabilities at the framework layer, this commit introduces the `allowedHosts` option to `PlatformConfig` (supporting exact hostnames, wildcards like `*.example.com`, or `*` to allow all).
During platform initialization inside `createServerPlatform`, the hostname of the request `url` is validated against the `allowedHosts` list. If the hostname is not authorized, bootstrap immediately throws a host validation error, preventing unauthorized rendering and silent SSRF bypasses.
Closes #68436
(cherry picked from commit 60552a73e8
2026-05-07 15:30:07 -07:00
4900e453e1
build: update cross-repo angular dependencies
...
See associated pull request for more information.
2026-04-29 13:29:44 -07:00
85f1c0a268
build: lock file maintenance
...
See associated pull request for more information.
2026-04-28 11:59:30 -07:00
8ce8b9342a
build: update pnpm to v10.33.2
...
See associated pull request for more information.
2026-04-24 10:11:20 -07:00
f3308dc1f7
build: update cross-repo angular dependencies
...
See associated pull request for more information.
2026-04-23 14:14:19 -07:00
750af5b123
build: update cross-repo angular dependencies to v21.2.8
...
See associated pull request for more information.
2026-04-22 11:03:02 -07:00
4dc7bf5a75
build: lock file maintenance
...
See associated pull request for more information.
2026-04-21 10:23:48 -07:00
62266eee8b
ci: remove disabled side-effects integration tests
...
This test was disabled 5+ years ago, we probably don't need it anymore.
(cherry picked from commit 13be2961f6
2026-04-20 13:13:28 -07:00
810fb7382f
build: update cross-repo angular dependencies
...
See associated pull request for more information.
2026-04-17 14:34:29 -07:00
bb8cdd9566
build: lock file maintenance
...
See associated pull request for more information.
2026-04-14 12:20:59 +03:00
05d9b97cf9
build: update cross-repo angular dependencies
...
See associated pull request for more information.
2026-04-09 14:17:44 +03:00
e8265f4593
build: lock file maintenance
...
See associated pull request for more information.
2026-04-07 09:49:43 -07:00
4441a95119
build: update cross-repo angular dependencies to v21.2.5
...
See associated pull request for more information.
2026-04-02 15:50:14 -07:00
4ad6d582d2
build: update cross-repo angular dependencies to v21.2.6
...
See associated pull request for more information.
2026-04-01 18:25:52 +02:00
5fd4f0f854
build: lock file maintenance
...
See associated pull request for more information.
2026-03-31 13:42:53 +02:00
cf7846bd62
build: update pnpm to v10.33.0
...
See associated pull request for more information.
2026-03-30 12:47:07 +02:00
4b2008d0f2
build: update cross-repo angular dependencies
...
See associated pull request for more information.
2026-03-27 14:00:33 +01:00
a3048f231c
build: update cross-repo angular dependencies
...
See associated pull request for more information.
2026-03-25 12:59:42 -07:00
3b3ab8b626
build: lock file maintenance
...
See associated pull request for more information.
2026-03-24 15:08:55 -07:00
1ba89d1128
build: lock file maintenance
...
See associated pull request for more information.
2026-03-20 15:14:25 -07:00
ad0156e056
fix(core): fixes a regression with animate.leave and reordering
...
PATCH PR for #67765
This fixes a regression bug that resulted in reordered elements not getting properly removed from the DOM. Reused nodes were not being cleared out in this situation.
fixes : #67728
2026-03-19 15:52:35 -07:00
3838554503
build: update cross-repo angular dependencies to v21.2.3
...
See associated pull request for more information.
2026-03-19 15:04:08 -07:00
f39896da99
build: update cross-repo angular dependencies
...
See associated pull request for more information.
2026-03-13 16:25:45 -06:00
2d28e9b392
build: update pnpm to v10.32.1
...
See associated pull request for more information.
2026-03-13 13:08:54 -06:00
ff697707ba
build: update pnpm to v10.32.0
...
See associated pull request for more information.
2026-03-11 09:28:49 -07:00
934e2732b3
build: lock file maintenance
...
See associated pull request for more information.
2026-03-10 09:59:30 -07:00
024e307ab0
build: update pnpm to v10.31.0
...
See associated pull request for more information.
2026-03-09 17:00:10 -07:00
b4ec3cc4e4
fix(core): prevent child animation elements from being orphaned
...
When routing between two different routes, child animations were not finishing, causing elements to be left behind in the dom. The fix ensures the proper fallback is handled to avoid automatically cancelled custom events. This ensures the animation-fallback cancelling the animation actually completes, and ensures the element is removed.
fixes : #67400
(cherry picked from commit 9e64147b73
2026-03-04 16:21:41 +00:00
84e79f5add
build: update pnpm to v10.30.3
...
See associated pull request for more information.
2026-03-04 08:03:41 -08:00
8f6ca1d9f9
build: lock file maintenance
...
See associated pull request for more information.
2026-03-03 09:08:50 -08:00
0c8a2858b9
build: update cross-repo angular dependencies to v21.2.0
...
See associated pull request for more information.
2026-03-02 11:32:52 -08:00
e923d88398
fix(core): Prevent removal of elements during drag and drop
...
This addresses a reported issue where elements were being fully removed from the DOM during drag and drop operations.
fixes : #67257
(cherry picked from commit 0b59cba85d
2026-03-02 16:46:13 +00:00
fc5f9d03cf
build: update pnpm to v10.30.3
...
See associated pull request for more information.
2026-03-02 08:37:49 -08:00
c960a6e492
build: update cross-repo angular dependencies to v21.2.0
...
See associated pull request for more information.
2026-02-25 15:11:49 -08:00
d3ab1ea5f2
build: lock file maintenance
...
See associated pull request for more information.
2026-02-25 08:52:48 -08:00
a25f74238e
build: update jasmine dependencies to v6.1.0
...
See associated pull request for more information.
2026-02-25 07:57:47 -08:00
61ad0f8b90
build: update pnpm to v10.30.2
...
See associated pull request for more information.
2026-02-25 07:54:45 -08:00
b17a7e062f
build: update cross-repo angular dependencies
...
See associated pull request for more information.
2026-02-24 09:21:23 -08:00
c9ecf9e40b
build: update cross-repo angular dependencies to v21.2.0-rc.1
...
See associated pull request for more information.
2026-02-23 13:17:58 -08:00
31bf694599
build: update pnpm to v10.30.1
...
See associated pull request for more information.
2026-02-23 09:12:54 -08:00
eb7c593fda
ci: add zone.js to minimumReleaseAgeExclude
...
This is a package we control the release of.
(cherry picked from commit d501506aa6
2026-02-19 20:41:24 +00:00
c5afb88d9a
build: update cross-repo angular dependencies to v21.2.0-rc.0
...
See associated pull request for more information.
2026-02-19 08:51:02 -08:00
22a209055c
build: update pnpm to v10.30.0
...
See associated pull request for more information.
2026-02-18 09:07:03 -08:00
084f7dc08d
build: update cross-repo angular dependencies
...
See associated pull request for more information.
Closes #66795 as a pr takeover
2026-02-17 12:40:20 -08:00
81cabc1477
feat(core): add support for TypeScript 6
...
Updates the project to support TypeScript 6 and accounts for some of the breakages.
2026-02-17 08:40:38 -08:00
dfd5e3a90a
build: update pnpm to v10.29.3
...
See associated pull request for more information.
2026-02-13 09:18:58 -08:00
5b59dbd36f
build: lock file maintenance
...
See associated pull request for more information.
2026-02-12 10:18:03 -08:00
a4fceda35b
build: update pnpm to v10.29.2
...
See associated pull request for more information.
2026-02-11 13:40:49 -08:00
4999868d8d
build: migrate integration tests to manual Protractor setup
...
Removes the use of the private Protractor builder (`@angular-devkit/build-angular:private-protractor`)
from all integration test projects. Projects that still require E2E tests
now invoke Protractor directly via NPM scripts using `concurrently` to
manage the development server.
2026-02-11 13:38:55 -08:00
387793fe29
build: remove unused Protractor E2E target from legacy-animations
...
Removes the `e2e` architect target from the `legacy-animations` integration test
project as it does not have actual E2E tests and was using a placeholder script.
2026-02-10 09:41:26 -08:00
Alan Agius