Skip to content

chore(deps): update npm packages - #424

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages
Open

chore(deps): update npm packages#424
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages

Conversation

@renovate

@renovate renovate Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@angular/animations (source) 22.0.822.1.0 age adoption passing confidence
@angular/build 22.0.822.1.2 age adoption passing confidence
@angular/cdk 22.0.622.1.0 age adoption passing confidence
@angular/common (source) 22.0.822.1.0 age adoption passing confidence
@angular/compiler (source) 22.0.822.1.0 age adoption passing confidence
@angular/compiler-cli (source) 22.0.822.1.0 age adoption passing confidence
@angular/core (source) 22.0.822.1.0 age adoption passing confidence
@angular/forms (source) 22.0.822.1.0 age adoption passing confidence
@angular/material 22.0.622.1.0 age adoption passing confidence
@angular/platform-browser (source) 22.0.822.1.0 age adoption passing confidence
@angular/platform-browser-dynamic (source) 22.0.822.1.0 age adoption passing confidence
@angular/router (source) 22.0.822.1.0 age adoption passing confidence
@playwright/test (source) 1.61.11.62.1 age adoption passing confidence
@sanity/types (source) 6.6.06.8.0 age adoption passing confidence
pkg-pr-new (source) 0.0.790.0.86 age adoption passing confidence
postcss (source) 8.5.238.5.25 age adoption passing confidence
posthog-js (source) 1.407.21.409.0 age adoption passing confidence
sass 1.101.71.102.0 age adoption passing confidence
vite (source) 8.1.58.2.0 age adoption passing confidence

Release Notes

angular/angular (@​angular/animations)

v22.1.0

Compare Source

Deprecations

http
  • HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.
common
Commit Type Description
1ad6824d0d fix skip transfer cache for uncacheable HTTP traffic (#​69017)
compiler
Commit Type Description
af5e4e1131 feat Add an error for --global-foo cases (#​68846)
d579ecaf73 feat Disable '--global-' error outside of g3 (#​68846)
f98547675c feat Namespace CSS variables to the app (#​68846)
8c8b2f7783 feat Support css var namespacing in properties (#​68846)
292199aa4d fix permissive whitespace parsing in default never blocks
25c744c4d0 fix support foreign components defined outside top-level scope
5bd00add07 fix support foreign components inside control flow blocks (#​69674)
2e442f7876 perf do not emit tag name when control flow root is foreign component (#​69674)
compiler-cli
Commit Type Description
aeb55c8bc1 fix allow passing uninvoked signals as foreign component props
7c60a98b3c fix support import aliases in foreignImports (#​68674)
core
Commit Type Description
124ba10ead feat add custom set option to linkedSignal
eab4847a8b feat Adds deep linking from Performance panel to DevTools
091456a214 fix account for namespaces in host binding sanitization (#​69558)
b3748e9fe4 fix correct container anchor collection order to match DOM layout
11b206b919 fix introduce disposal mechanism for Angular views in foreign @content
56607967db fix introduce logical-only containers for foreign content
23cf1a828b fix sanitize host bindings on concrete hosts (#​69558)
0c07356c5c fix set current tnode in foreign component instruction on reuse
forms
Commit Type Description
bbbd357bd2 fix add utility to assert that value is a field tree
http
Commit Type Description
e3630c23c5 feat add options to allow caching of credentialed and non-cacheable HTTP requests
ec16a3d6c6 fix enable xsrf for root-provided HttpClient
39e362eea5 fix match header values exactly when deleting
be46ca8696 fix preserve immutability of materialized clones
c0cbd46bd7 fix skip transfer cache for fetch credentialed requests (#​69017)
af04e266cc refactor deprecate jsonp support
language-service
Commit Type Description
7f0265e43a feat compile non-exported classes if standalone (#​68454)
4f9c824dd9 feat Typecheck templates which would require inline typecheck blocks (#​68454)
a99fb915c0 fix account for strictTemplates being enabled by default
migrations
Commit Type Description
c75ff0255c feat add migration from injectable to service
5d5b2ea72d fix correctly detect then/else keywords in control flow migration
platform-server
Commit Type Description
cf9d7fa0f8 fix harden platform location origin validation during SSR (#​69184)
router
Commit Type Description
97a3fd6a55 feat handle null and undefined inputs in RouterLinkActive
angular/angular-cli (@​angular/build)

v22.1.2

Compare Source

@​angular/cli
Commit Type Description
57db27ea91 fix add packages with built-in schematics to devDependencies only
@​angular/build
Commit Type Description
baed978885 fix prevent IIFE wrapper interleaving for adjacent classes in minified files

v22.1.1

Compare Source

@​angular/cli
Commit Type Description
ab971a8543 fix support npm 12 metadata array and error formats
@​angular/build
Commit Type Description
db24220fb8 fix rewrite paths from sandboxed execroots when running under Bazel

v22.1.0

Compare Source

Deprecations

@​angular-devkit/core
  • stringToFileBuffer and fileBufferToString are deprecated. Use standard Web APIs (TextEncoder and TextDecoder) instead.

    Internal usages within the repository have been removed and replaced with standard Web APIs. The public API golden file for @angular-devkit/core has been updated to reflect the deprecations.

@​schematics/angular
Commit Type Description
89d7f59cd feat update ai-config to include Angular MCP server config
b345bb54d fix remove unused spec tsconfig outDir
@​angular/cli
Commit Type Description
f59bcf529 fix abort and guide manual mitigation when updating catalog packages
48f90f5d5 fix prevent Yarn registry environment variable override
c963ecbec fix remove algoliasearch dependency and support latest docs versions
6859d25c3 fix resolve correct registry name when using npm alias syntax during update
3a2589dac fix respect client-side release age settings during update resolution
5c3101bff fix revert package.json changes if installation tasks fail during update
7932caaf9 fix robustly parse npm manifest from array
@​angular-devkit/core
Commit Type Description
fd336d365 refactor deprecate stringToFileBuffer and fileBufferToString
@​angular/build
Commit Type Description
34d558c3c feat add built-in SQLite cache store fallback
0c18dc0f6 feat emit debug ids for stable subresource integrity hashes
51f69276f feat enable chunk optimization for server builds
10dc30f9c feat migrate advanced optimization Babel plugins to oxc-parser + magic-string
917393a4c feat migrate i18n inliner to oxc-parser + magic-string
52ae7f862 feat share persistent build cache across git worktrees
95510511d fix add bounded timeout to vitest executor disposal
62b11e316 fix anchor debug ID comment matching and make injection idempotent
6d9b360e5 fix prevent esbuild service hang on internal component stylesheet builds
291caab61 fix prevent stripping nested sourceMappingURL comments
0e3ca3dfb fix support hyphens and underscores when stripping chunk hash in chunk optimizer
585d08af8 perf default chunk optimization to use Rolldown
09d0a11a8 perf enable fast-path AST printing with sourcemaps in AotCompilation
@​angular/ssr
Commit Type Description
7ef9ed24d feat support the standard Forwarded header

v22.0.9

Compare Source

@​angular/cli
Commit Type Description
9ee8f9b669 fix declare devserver_start and devserver_stop as isReadOnly:false
@​angular/build
Commit Type Description
d0c776d461 fix safeguard Karma builder stream controller against closed state
angular/components (@​angular/cdk)

v22.1.0

Compare Source

aria
Commit Type Description
31781a024 fix combobox: allow setting readonly (#​33364)
cdk
Commit Type Description
0e34c64d0 fix stepper: allow signal form to be assigned as stepControl (#​33562)
material
Commit Type Description
73939a835 feat slide-toggle: add full-width support (#​33424)
56c7ff6fa fix slide-toggle: prevent icon label text-spacing cutoff (#​33559)
youtube-player
Commit Type Description
2430e6e53 fix update to latest typings and fix error (#​33387)

v22.0.7

Compare Source

aria
Commit Type Description
e57188b33 fix grid: account for disabled cell widgets and in-place disablement in roving tabindex (#​33571)
material
Commit Type Description
223c51543 fix schematics: resolve issues in navigation schematic (#​33590)
multiple
Commit Type Description
963383e25 fix avoid instanceof checks in aria directives (#​33587)
microsoft/playwright (@​playwright/test)

v1.62.1

Compare Source

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}
🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});
New APIs
Browser and Context
  • New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.
Actions
  • New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.
Network
Evaluation
Command line & MCP
Reporters
  • The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:
// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});
Announcements
  • ⚠️ Debian 11 is not supported anymore.
Browser Versions
  • Chromium 151.0.7922.34
  • Mozilla Firefox 153.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 151
  • Microsoft Edge 151
sanity-io/sanity (@​sanity/types)

v6.8.0

Compare Source

Sanity Studio v6.8.0

This release includes various improvements and bug fixes.

For the complete changelog with all details, please visit:
www.sanity.io/changelog/studio-Ni43LjA

Install or upgrade Sanity Studio

To upgrade to this version, run:

npm install sanity@latest

To initiate a new Sanity Studio project or learn more about upgrading, please refer to our comprehensive guide on Installing and Upgrading Sanity Studio.

📓 Full changelog

Author Message Commit
@​pedrobonamin fix(core): enable clear button when perspective is the non default one (#​13819) 1938e37
@​pedrobonamin fix(core): copy to drafts using transaction, prepare for variants (#​13815) f283b1e
@​pedrobonamin chore(structure): useCopyToDrafts changes (#​13806) e65a38a
squiggler-app[bot] chore(deps): update dependency @​sanity/workbench to v0.1.0-alpha.36 (#​13808) ebc1904
squiggler-app[bot] fix(deps): update dependency @​sanity/cli to ^7.15.1 (#​13813) f57fff2
squiggler-app[bot] chore(deps): update dependency @​sentry/react to ^10.68.0 (#​13812) 391db94
squiggler-app[bot] chore(deps): update dependency turbo to ^2.10.7 (#​13809) b341cd1
squiggler-app[bot] fix(deps): update dev-non-major (#​13810) bd9cee7
squiggler-app[bot] chore(deps): update dependency @​sanity/ailf to ^7.33.0 (#​13811) 4c72095
squiggler-app[bot] chore(deps): update dependency @​sanity/vanilla-extract-vite-plugin to ^0.2.8 (#​13807) 733f618
@​stipsan chore(oxlint): allow side-effect css imports without suppressions (#​13796) ef50a8f
@​stipsan fix(releases): throttle published archived history batches (#​13805) afb3074
@​stipsan chore(deps): upgrade to typescript 7 (#​13759) fe0cd99
@​stipsan fix(deps): bump react-rx to 4.2.5 (#​13797) d820ba1
@​juice49 fix(sanity): virtualised item dimensions in hidden CommandList (#​13792) 2052523
squiggler-app[bot] chore(deps): dedupe pnpm-lock.yaml (#​13766) 015f924
squiggler-app[bot] chore(tests): generate dts tests 🤖 ✨ (#​13801) [6ab5f7d](https://redirect.github.com/sanity-io/sanity/commit/6a

Note

PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • "before 10am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) August 2, 2026 17:52
@socket-security

socket-security Bot commented Aug 2, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @angular/build is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: napi/playground/package.jsonnpm/@angular/build@22.1.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@angular/build@22.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm lmdb is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@angular/build@22.1.2npm/lmdb@3.5.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lmdb@3.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovate Bot force-pushed the renovate/npm-packages branch from e3c741c to 65f951b Compare August 2, 2026 22:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants