build(deps): bump the all-frontend-dependencies group across 1 directory with 29 updates

[dependabot]

Bumps the all-frontend-dependencies group with 28 updates in the / directory:

Package	From	To
@angular-devkit/core	21.2.5	21.2.10
@angular-devkit/schematics	21.2.5	21.2.10
@angular/cdk	21.2.4	21.2.10
@angular/common	21.2.6	21.2.12
@angular/compiler	21.2.6	21.2.12
@angular/core	21.2.6	21.2.12
@angular/forms	21.2.6	21.2.12
@angular/material	21.2.4	21.2.10
@angular/platform-browser	21.2.6	21.2.12
@angular/platform-browser-dynamic	21.2.6	21.2.12
@angular/platform-server	21.2.6	21.2.12
@angular/router	21.2.6	21.2.12
@angular/ssr	21.2.5	21.2.10
ngx-mat-select-search	8.0.4	8.0.5
@angular/build	21.2.5	21.2.10
@angular/cli	21.2.5	21.2.10
@angular/compiler-cli	21.2.6	21.2.12
@angular/language-service	21.2.6	21.2.12
@angular/localize	21.2.6	21.2.12
@types/node	24.12.0	24.12.3
@vitest/browser-playwright	4.1.2	4.1.6
@vitest/eslint-plugin	1.6.13	1.6.17
eslint	10.1.0	10.3.0
jsdom	29.0.1	29.1.1
ng-packagr	21.2.2	21.2.3
playwright	1.58.2	1.60.0
prettier	3.8.1	3.8.3
typescript-eslint	8.57.2	8.59.3

Updates @angular-devkit/core from 21.2.5 to 21.2.10

Release notes

Sourced from @​angular-devkit/core's releases.

21.2.10

@​angular/cli

Commit	Description
	restrict MCP workspace access to allowed client roots during resolution

21.2.9

@​schematics/angular

Commit	Description
	add missing imports for focus and skip APIs in refactor-jasmine-vitest

@​angular/cli

Commit	Description
	fix broken img ref in ai-tutor
	introduce initial package manager workspace awareness
	remove standalone true ref in ai tutor

@​angular/ssr

Commit	Description
	introduce trustProxyHeaders option to safely validate and sanitize proxy headers
	add support for configuring trusted proxy headers via environment variable
	decode route segments when building and matching route tree
	use router to normalize URLs for comparison

21.2.8

@​angular/cli

Commit	Description
	dynamically resolve project Angular CLI executable inside MCP tools
	ignore EBADF file system errors during MCP project scan
	use headless option in MCP test tool

@​angular-devkit/build-angular

Commit	Description
	ensure route has leading slash in prerender builder
	fix app-shell route format and

@​angular/build

Commit	Description
	use rootDir for HMR component updates path resolution
	validate V8 coverage support for browsers in Vitest

21.2.7

@​angular/cli

Commit	Description
	handle missing package manager during analytics initialization

@​angular/build

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular-devkit/core's changelog.

21.2.10 (2026-05-06)

@​angular/cli

Commit	Type	Description
bb8611913	fix	restrict MCP workspace access to allowed client roots during resolution

19.2.25 (2026-04-30)

@​angular-devkit/build-angular

Commit	Type	Description
49ae0ad2d	fix	upgrade postcss to 8.5.12

@​angular/build

Commit	Type	Description
2d53feca5	fix	update esbuild to 0.28.0

@​angular/ssr

Commit	Type	Description
02ce8bf26	fix	introduce trustProxyHeaders option to safely validate and sanitize proxy headers

22.0.0-next.7 (2026-04-29)

@​angular/cli

Commit	Type	Description
0572df064	fix	fix broken img ref in ai-tutor
d6121b5e8	fix	introduce initial package manager workspace awareness
48eab1fc0	fix	remove standalone true ref in ai tutor

@​schematics/angular

Commit	Type	Description

... (truncated)

Commits

• 64cbd62 release: cut the v21.2.10 release
• 6f26f4f build: lock file maintenance
• 111dcc3 refactor(@​angular/cli): re-add resolveModule for find examples tool
• 5418ebb build: update cross-repo angular dependencies
• a2c8029 refactor: configure Gemini reviewer to ignore lockfile and changelog
• 7130c92 refactor(@​angular/cli): integrate MCP roots into Host abstraction
• bb86119 fix(@​angular/cli): restrict MCP workspace access to allowed client roots duri...
• 564b108 release: cut the v21.2.9 release
• dbda92b build: update cross-repo angular dependencies
• 828c175 build: update pnpm to v10.33.2
• Additional commits viewable in compare view

Updates @angular-devkit/schematics from 21.2.5 to 21.2.10

Release notes

Sourced from @​angular-devkit/schematics's releases.

21.2.10

@​angular/cli

Commit	Description
	restrict MCP workspace access to allowed client roots during resolution

21.2.9

@​schematics/angular

Commit	Description
	add missing imports for focus and skip APIs in refactor-jasmine-vitest

@​angular/cli

Commit	Description
	fix broken img ref in ai-tutor
	introduce initial package manager workspace awareness
	remove standalone true ref in ai tutor

@​angular/ssr

Commit	Description
	introduce trustProxyHeaders option to safely validate and sanitize proxy headers
	add support for configuring trusted proxy headers via environment variable
	decode route segments when building and matching route tree
	use router to normalize URLs for comparison

21.2.8

@​angular/cli

Commit	Description
	dynamically resolve project Angular CLI executable inside MCP tools
	ignore EBADF file system errors during MCP project scan
	use headless option in MCP test tool

@​angular-devkit/build-angular

Commit	Description
	ensure route has leading slash in prerender builder
	fix app-shell route format and

@​angular/build

Commit	Description
	use rootDir for HMR component updates path resolution
	validate V8 coverage support for browsers in Vitest

21.2.7

@​angular/cli

Commit	Description
	handle missing package manager during analytics initialization

@​angular/build

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular-devkit/schematics's changelog.

21.2.10 (2026-05-06)

@​angular/cli

Commit	Type	Description
bb8611913	fix	restrict MCP workspace access to allowed client roots during resolution

19.2.25 (2026-04-30)

@​angular-devkit/build-angular

Commit	Type	Description
49ae0ad2d	fix	upgrade postcss to 8.5.12

@​angular/build

Commit	Type	Description
2d53feca5	fix	update esbuild to 0.28.0

@​angular/ssr

Commit	Type	Description
02ce8bf26	fix	introduce trustProxyHeaders option to safely validate and sanitize proxy headers

22.0.0-next.7 (2026-04-29)

@​angular/cli

Commit	Type	Description
0572df064	fix	fix broken img ref in ai-tutor
d6121b5e8	fix	introduce initial package manager workspace awareness
48eab1fc0	fix	remove standalone true ref in ai tutor

@​schematics/angular

Commit	Type	Description

... (truncated)

Commits

• 64cbd62 release: cut the v21.2.10 release
• 6f26f4f build: lock file maintenance
• 111dcc3 refactor(@​angular/cli): re-add resolveModule for find examples tool
• 5418ebb build: update cross-repo angular dependencies
• a2c8029 refactor: configure Gemini reviewer to ignore lockfile and changelog
• 7130c92 refactor(@​angular/cli): integrate MCP roots into Host abstraction
• bb86119 fix(@​angular/cli): restrict MCP workspace access to allowed client roots duri...
• 564b108 release: cut the v21.2.9 release
• dbda92b build: update cross-repo angular dependencies
• 828c175 build: update pnpm to v10.33.2
• Additional commits viewable in compare view

Updates @angular/cdk from 21.2.4 to 21.2.10

Release notes

Sourced from @​angular/cdk's releases.

21.2.10

aria

Commit	Description
	menu: do not set default aria-label (#33202)

21.2.9

material

Commit	Description
	stepper: allow stepper to be labelled (#33137)

cdk

Commit	Description
	tree: enter/space key on child node should not toggle parent node expansion (#33125)

aria

Commit	Description
	menu: use computed for menu item patterns, with trigger on visible (#33118)

21.2.8

No user facing changes in this release

21.2.7

material

Commit	Description
	sort: deprecate MatSortHeaderIntl and hide from docs (#33089)

21.2.6

material

Commit	Description
	select: wrong transform origin when opening upwards inside another overlay (#33032)

21.2.5

material

Commit	Description
	sidenav: not resetting margin if transition does not start (#33001)
	slider: not picking up static direction (#33006)
	tooltip: allow hover detection logic to be customized (#33018)

cdk

Commit	Description
	stepper: linear updates not reflected in the DOM (#33007)

Changelog

Sourced from @​angular/cdk's changelog.

21.2.10 "metal-wallaby" (2026-05-06)

aria

Commit	Type	Description
48973661e	fix	menu: do not set default aria-label (#33202)

22.0.0-next.7 "astatine-agriculture" (2026-04-29)

aria

Commit	Type	Description
6ec07bc0c	feat	grid: add test harnesses (#33081)
05419c552	fix	menu: use computed for menu item patterns, with trigger on visible (#33118)

cdk

Commit	Type	Description
1a5d5d101	feat	dialog: add the ability to pass bindings
b916ef907	fix	tree: enter/space key on child node should not toggle parent node expansion (#33125)

material

Commit	Type	Description
867ba993b	feat	bottom-sheet: add the ability to pass bindings
bf3596b53	feat	dialog: add the ability to pass bindings
cb9148dca	fix	stepper: allow stepper to be labelled (#33137)

google-maps

Commit	Type	Description
e44ff8318	feat	Add support for the gmp-click event (#33147)

21.2.9 "astatine-astronaut" (2026-04-29)

aria

Commit	Type	Description
bf14cc9d9	fix	menu: use computed for menu item patterns, with trigger on visible (#33118)

cdk

Commit	Type	Description
3a3852d45	fix	tree: enter/space key on child node should not toggle parent node expansion (#33125)

material

Commit	Type	Description
51271c619	fix	stepper: allow stepper to be labelled (#33137)

... (truncated)

Commits

• 583da8a release: cut the v21.2.10 release
• babfbb7 build: update cross-repo angular dependencies (#33205)
• e08fdf2 build: fix failing test (#33212)
• 09e89fa build: lock file maintenance (#33201)
• 4897366 fix(aria/menu): do not set default aria-label (#33202)
• a6c5b72 build: update cross-repo angular dependencies (#33181)
• b7c34e3 build: update cross-repo angular dependencies (#33160)
• 58e29cf build: update dependency bazel_lib to v3.3.1 (#33177)
• e2f16ac build: update pnpm to v10.33.2 (#33165)
• d17f95d release: cut the v21.2.9 release
• Additional commits viewable in compare view

Updates @angular/common from 21.2.6 to 21.2.12

Release notes

Sourced from @​angular/common's releases.

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description
	link formatting in "Animating your Application with CSS"

migrations

Commit	Description
	fix NgClass leaving trailing comma after removal

router

Commit	Description
	restore internal URL on popstate when browserUrl is used

21.2.9

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

21.2.12 (2026-05-06)

core

Commit	Type	Description
fe13bb669d	fix	allow explicit read generic with signal input transforms
3430251fef	fix	i18n flags leaking on errors
1aeebbe304	fix	respect ngSkipHydration on components with projectable nodes in LContainers
9e38ed7d57	fix	sanitizer typings
7a05a9a71a	fix	validate security-sensitive attributes in i18n bindings
c37f6ca42f	fix	visit ng-let expression value in signal migration schematics

forms

Commit	Type	Description
03ad53863b	fix	prohibit concurrent submits in signal forms

20.3.20 (2026-05-06)

core

Commit	Type	Description
a9bcffdbc7	fix	disallow event attribute bindings in host bindings unconditionally (#68468)
97eeb45cfa	fix	validate security-sensitive attributes in i18n bindings (#68468)

platform-server

Commit	Type	Description
25e4e07238	fix	ensure origin has a trailing slash when parsing url (#68468)

22.0.0-next.10 (2026-04-29)

common

Commit	Type	Description
97cac1cf4d	fix	prevent focus from scrollToAnchor

compiler

Commit	Type	Description
2896c93cc1	feat	Angular expressions with optional chaining returns undefined
6bd1721662	fix	let declaration span not including end character

core

Commit	Type	Description
444b024d49	feat	Add a injectAsync helper function
8c11816490	fix	fix ordering of view queries metadata in JIT mode
3583c01bf9	fix	guard against non-object events and avoid listener wrapper identity mismatch
d5fd51e956	fix	prevent event replay double-invocation when element hydrates before app stability

migrations

... (truncated)

Commits

• 30cf85f refactor(common): update deprecation message
• 42d57c3 refactor(common): fix viewport tests
• 10ad3c0 fix(common): prevent focus from scrollToAnchor
• 540536c fix(http): add CSP nonce support to JsonpClientBackend
• 8102331 test(http): disable XSRF and mock location in HttpClient tests to avoid Domin...
• 13f050d test: construct local Date objects to fix timezone flakiness
• d0cf299 test: remove unsupported timezone from formatDate tests
• See full diff in compare view

Updates @angular/compiler from 21.2.6 to 21.2.12

Release notes

Sourced from @​angular/compiler's releases.

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

21.2.10

docs

Commit	Description
	link formatting in "Animating your Application with CSS"

migrations

Commit	Description
	fix NgClass leaving trailing comma after removal

router

Commit	Description
	restore internal URL on popstate when browserUrl is used

21.2.9

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.12 (2026-05-06)

core

Commit	Type	Description
fe13bb669d	fix	allow explicit read generic with signal input transforms
3430251fef	fix	i18n flags leaking on errors
1aeebbe304	fix	respect ngSkipHydration on components with projectable nodes in LContainers
9e38ed7d57	fix	sanitizer typings
7a05a9a71a	fix	validate security-sensitive attributes in i18n bindings
c37f6ca42f	fix	visit ng-let expression value in signal migration schematics

forms

Commit	Type	Description
03ad53863b	fix	prohibit concurrent submits in signal forms

20.3.20 (2026-05-06)

core

Commit	Type	Description
a9bcffdbc7	fix	disallow event attribute bindings in host bindings unconditionally (#68468)
97eeb45cfa	fix	validate security-sensitive attributes in i18n bindings (#68468)

platform-server

Commit	Type	Description
25e4e07238	fix	ensure origin has a trailing slash when parsing url (#68468)

22.0.0-next.10 (2026-04-29)

common

Commit	Type	Description
97cac1cf4d	fix	prevent focus from scrollToAnchor

compiler

Commit	Type	Description
2896c93cc1	feat	Angular expressions with optional chaining returns undefined
6bd1721662	fix	let declaration span not including end character

core

Commit	Type	Description
444b024d49	feat	Add a injectAsync helper function
8c11816490	fix	fix ordering of view queries metadata in JIT mode
3583c01bf9	fix	guard against non-object events and avoid listener wrapper identity mismatch
d5fd51e956	fix	prevent event replay double-invocation when element hydrates before app stability

migrations

... (truncated)

Commits

• 4f5d8a2 fix(compiler): let declaration span not including end character
• a4f3120 refactor(compiler): require a reference in DirectiveMeta
• de533fe refactor(compiler-cli): move ClassPropertyMapping into compiler
• ea1e34c refactor(compiler): move matchSource into base metadata
• e40d378 fix(compiler): handle nested brackets in host object bindings
• d04ddd7 fix(core): prevent binding unsafe attributes on SVG animation elements (#67797)
• fea25d1 fix(compiler): register SVG animation attributes in URL security context (#67...
• See full diff in compare view

Updates @angular/core from 21.2.6 to 21.2.12

Release notes

Sourced from @​angular/core's releases.

21.2.12

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

21.2.11

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including... Description has been truncated