Bump the npm_and_yarn group across 11 directories with 4 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the /behavior-subject directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /component-interaction directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /component-view-binding directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /hashLocation directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /http-client directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /material-design directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /modal-basic directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /modal-injection directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /model-driven-form directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /template-driven-form directory: @angular/common, @angular/compiler, @angular/core and karma.
Bumps the npm_and_yarn group with 4 updates in the /validator directory: @angular/common, @angular/compiler, @angular/core and karma.

Updates @angular/common from 4.4.7 to 21.2.13

Release notes

Sourced from @​angular/common's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

21.2.13 (2026-05-13)

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit	Type	Description
f584840e2e	fix	add allowedHosts option to renderModule and renderApplication

22.0.0-next.12 (2026-05-08)

core

Commit	Type	Description
8ebae1de33	fix	allow service with factory on abstract classes
6f525245cd	fix	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Type	Description
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-server

| Commit | Type | Description |

... (truncated)

Commits

• 30cf85f refactor(common): update deprecation message
• 42d57c3 refactor(common): fix viewport tests
• 10ad3c0 fix(common): prevent focus from scrollToAnchor
• 540536c fix(http): add CSP nonce support to JsonpClientBackend
• 8102331 test(http): disable XSRF and mock location in HttpClient tests to avoid Domin...
• 13f050d test: construct local Date objects to fix timezone flakiness
• d0cf299 test: remove unsupported timezone from formatDate tests
• b4ab6ba fix(common): avoid redundant image fetch on destroy with auto sizes
• adda6c5 build: update aspect_rules_js to 3.0.2
• 93c6dc6 Revert "refactor(http): Improves base64 encoding/decoding with feature detect...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/common since your current version.

Updates @angular/compiler from 4.4.7 to 21.2.13

Release notes

Sourced from @​angular/compiler's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.13 (2026-05-13)

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit	Type	Description
f584840e2e	fix	add allowedHosts option to renderModule and renderApplication

22.0.0-next.12 (2026-05-08)

core

Commit	Type	Description
8ebae1de33	fix	allow service with factory on abstract classes
6f525245cd	fix	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Type	Description
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-server

| Commit | Type | Description |

... (truncated)

Commits

• baf92da test: remove invalid css that was causing issues with the postcss parser
• 1c6553e fix(core): disallow event attribute bindings in host bindings unconditionally
• 4f5d8a2 fix(compiler): let declaration span not including end character
• a4f3120 refactor(compiler): require a reference in DirectiveMeta
• de533fe refactor(compiler-cli): move ClassPropertyMapping into compiler
• ea1e34c refactor(compiler): move matchSource into base metadata
• e40d378 fix(compiler): handle nested brackets in host object bindings
• d04ddd7 fix(core): prevent binding unsafe attributes on SVG animation elements (#67797)
• fea25d1 fix(compiler): register SVG animation attributes in URL security context (#67...
• 880a57d fix(compiler): prevent shimCssText from adding extra blank lines per CSS comment
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/compiler since your current version.

Updates @angular/core from 4.4.7 to 21.2.13

Release notes

Sourced from @​angular/core's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

21.2.13 (2026-05-13)

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit	Type	Description
f584840e2e	fix	add allowedHosts option to renderModule and renderApplication

22.0.0-next.12 (2026-05-08)

core

Commit	Type	Description
8ebae1de33	fix	allow service with factory on abstract classes
6f525245cd	fix	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Type	Description
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-server

| Commit | Type | Description |

... (truncated)

Commits

• 1c6553e fix(core): disallow event attribute bindings in host bindings unconditionally
• 9e38ed7 fix(core): sanitizer typings
• 3430251 fix(core): i18n flags leaking on errors
• c37f6ca fix(core): visit ng-let expression value in signal migration schematics
• fe13bb6 fix(core): allow explicit read generic with signal input transforms
• 7a05a9a fix(core): validate security-sensitive attributes in i18n bindings
• 1aeebbe fix(core): respect ngSkipHydration on components with projectable nodes in LC...
• 4900e45 build: update cross-repo angular dependencies
• a40e2ce fix(core): fix ordering of view queries metadata in JIT mode
• 9bcbf37 refactor(core): fix bundling symbol test
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/core since your current version.

Updates karma from 1.7.1 to 6.4.4

Release notes

Sourced from karma's releases.

v6.4.4

6.4.4 (2024-07-29)

v6.4.3

6.4.3 (2024-02-24)

Bug Fixes

• add build commits for patch release (d7f2d69)

v6.4.2

6.4.2 (2023-04-21)

Bug Fixes

• few typos (c6a4271)

v6.4.1

6.4.1 (2022-09-19)

Bug Fixes

• pass integrity value (63d86be)

v6.4.0

6.4.0 (2022-06-14)

Features

• support SRI verification of link tags (dc51a2e)
• support SRI verification of script tags (6a54b1c)

v6.3.20

6.3.20 (2022-05-13)

Bug Fixes

• prefer IPv4 addresses when resolving domains (e17698f), closes #3730

v6.3.19

6.3.19 (2022-04-19)

Bug Fixes

... (truncated)

Changelog

Sourced from karma's changelog.

6.4.4 (2024-07-29)

6.4.3 (2024-02-24)

Bug Fixes

• add build commits for patch release (d7f2d69)

6.4.2 (2023-04-21)

Bug Fixes

• few typos (c6a4271)

6.4.1 (2022-09-19)

Bug Fixes

• pass integrity value (63d86be)

6.4.0 (2022-06-14)

Features

• support SRI verification of link tags (dc51a2e)
• support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

• prefer IPv4 addresses when resolving domains (e17698f), closes #3730

6.3.19 (2022-04-19)

Bug Fixes

• client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes

... (truncated)

Commits

• 84f85e7 chore(release): 6.4.4 [skip ci]
• a4d1284 build(deps-dev): bump ws from 6.2.1 to 6.2.3
• d8cf806 chore(release): 6.4.3 [skip ci]
• d7f2d69 fix: add build commits for patch release
• 85a2eeb build(deps-dev): bump decode-uri-component from 0.2.0 to 0.2.2
• 0bffce2 build(deps): updated socket.io version to fix security issues with socket.io-...
• 86667ab build(deps): bump follow-redirects from 1.11.0 to 1.15.4
• 450fdfd docs: Add deprecation notice to Karma README
• 9de3c00 chore(release): 6.4.2 [skip ci]
• c6a4271 fix: few typos
• Additional commits viewable in compare view

Updates @angular/common from 2.4.10 to 21.2.13

Release notes

Sourced from @​angular/common's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

21.2.13 (2026-05-13)

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

19.2.22 (2026-05-12)

core

Commit	Type	Description
83a640516f	fix	disallow event attribute bindings in host bindings unconditionally (#68469)
24a0103a98	fix	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Type	Description
8569db8875	fix	add allowedHosts option to renderModule and renderApplication
837a710217	fix	ensure origin has a trailing slash when parsing url (#68469)

20.3.21 (2026-05-12)

platform-server

Commit	Type	Description
f584840e2e	fix	add allowedHosts option to renderModule and renderApplication

22.0.0-next.12 (2026-05-08)

core

Commit	Type	Description
8ebae1de33	fix	allow service with factory on abstract classes
6f525245cd	fix	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Type	Description
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-server

| Commit | Type | Description |

... (truncated)

Commits

• 30cf85f refactor(common): update deprecation message
• 42d57c3 refactor(common): fix viewport tests
• 10ad3c0 fix(common): prevent focus from scrollToAnchor
• 540536c fix(http): add CSP nonce support to JsonpClientBackend
• 8102331 test(http): disable XSRF and mock location in HttpClient tests to avoid Domin...
• 13f050d test: construct local Date objects to fix timezone flakiness
• d0cf299 test: remove unsupported timezone from formatDate tests
• b4ab6ba fix(common): avoid redundant image fetch on destroy with auto sizes
• adda6c5 build: update aspect_rules_js to 3.0.2
• 93c6dc6 Revert "refactor(http): Improves base64 encoding/decoding with feature detect...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/common since your current version.

Updates @angular/compiler from 2.4.10 to 21.2.13

Release notes

Sourced from @​angular/compiler's releases.

21.2.13

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

...

Description has been truncated

[dependabot]

Superseded by #6.