chore(deps): bump @angular/platform-server from 17.3.12 to 19.2.25#4686
chore(deps): bump @angular/platform-server from 17.3.12 to 19.2.25#4686dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@angular/platform-server](https://github.com/angular/angular/tree/HEAD/packages/platform-server) from 17.3.12 to 19.2.25. - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.25/packages/platform-server) --- updated-dependencies: - dependency-name: "@angular/platform-server" dependency-version: 19.2.25 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5667199. Configure here.
| "@angular/platform-browser": "^17.3.0", | ||
| "@angular/platform-browser-dynamic": "^17.3.0", | ||
| "@angular/platform-server": "^17.3.0", | ||
| "@angular/platform-server": "^19.2.25", |
There was a problem hiding this comment.
Mismatched Angular platform-server version
High Severity
This change pins @angular/platform-server to ^19.2.25 while the Angular 17 SSR workspaces still depend on @angular/core, @angular/common, @angular/compiler, and @angular/platform-browser at ^17.3.0, plus @angular/ssr at ^17.3.8 and Angular 17 build tooling. @angular/platform-server 19.2.25 requires those peers at 19.2.25, so the stack is not a supported Angular combination and can fail install, build, or SSR at runtime.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 5667199. Configure here.
|
| Command | Status | Duration | Result |
|---|---|---|---|
nx test @e2e/angular-17-ssr |
❌ Failed | 1m 13s | View ↗ |
nx test @snippet/angular-17-ssr |
❌ Failed | 1m 43s | View ↗ |
nx test @e2e/react-sdk-next-pages |
✅ Succeeded | 5m 4s | View ↗ |
nx test @e2e/nuxt |
✅ Succeeded | 5m 42s | View ↗ |
nx test @e2e/angular-19-ssr |
✅ Succeeded | 5m 37s | View ↗ |
nx test @e2e/react-native-74 |
✅ Succeeded | 4m 55s | View ↗ |
nx test @e2e/react-sdk-next-14-app |
✅ Succeeded | 5m 19s | View ↗ |
nx test @e2e/vue |
✅ Succeeded | 4m 39s | View ↗ |
Additional runs (38) |
✅ Succeeded | ... | View ↗ |
💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗.
☁️ Nx Cloud last updated this comment at 2026-06-15 18:37:26 UTC
Bumps @angular/platform-server from 17.3.12 to 19.2.25.
Release notes
Sourced from @angular/platform-server's releases.
... (truncated)
Changelog
Sourced from @angular/platform-server's changelog.
... (truncated)
Commits
e2fb854fix(platform-server): throw on suspicious URLs and restrict protocol-relative...a0193farefactor(platform-server): extract parseUrl regex and add comments for URL pa...c75f60efix(platform-server): secure location and document initialization against SSR...e8d35f9Revert "revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f641...4747fe2revert: revert all changes until fdc1b48f32e52da7684583811a6a3090f6418d5ed187e8afix(platform-server): normalize path parsing in ServerPlatformLocation8569db8fix(platform-server): addallowedHostsoption torenderModuleand `render...837a710fix(platform-server): ensure origin has a trailing slash when parsing url (#6...f3a5bfbfix(platform-server): prevent SSRF bypasses via protocol-relative and backsla...70d0639fix(core): introduceBootstrapContextfor improved server bootstrapping (#6...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Cross-major
@angular/platform-serveron Angular 17 apps may cause peer dependency or SSR runtime issues; scope is limited to SDK e2e/snippet fixtures, not production apps.Overview
Bumps
@angular/platform-serverfrom ^17.3.0 (resolved 17.3.12) to ^19.2.25 in the Angular 17 SSR e2e and snippet workspaces, with matchingyarn.lockentries (replacing the ^17.3.0 resolution and adding 19.2.25).Other Angular packages in those apps remain on ^17.3.0, so only the server-rendering package is pulled two major versions ahead—typically to pick up platform-server security fixes (e.g. SSR URL/SSRF hardening) without upgrading the full Angular 17 stack.
Reviewed by Cursor Bugbot for commit 5667199. Bugbot is set up for automated code reviews on this repo. Configure here.