[dependabot]

Bumps @angular/common, @angular/fire, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic and @angular/router. These dependencies needed to be updated together.
Updates @angular/common from 19.2.9 to 22.2.3

Release notes

Sourced from @​angular/common's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• dcb29a9 docs: fix @​param names that don't match their parameters
• fafec77 fix(common): harden param encoding against prototype pollution
• ad2f291 fix(common): let NgOptimizedImage pass a [srcset] binding through when srcset...
• 6dee7fe fix(http): forward reportProgress of httpResource as `reportDownloadProgr...
• 270abc9 docs(docs-infra): throw on absolute links in @​see tags
• b9de99d fix(common): remove abort listener on the abort path too in httpResource
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• 0bdbbcf fix(docs-infra): only read a deprecation version from the start of the tag
• af26a8c fix(router): avoid view transitions when the user agent provides one
• 7596548 fix(common): use locale NaN symbol in number formatting
• Additional commits viewable in compare view

Updates @angular/fire from 19.1.0 to 21.0.0

Release notes

Sourced from @​angular/fire's releases.

21.0.0

Upgrading from AngularFire 20

AngularFire 21 requires Angular 21.2 or newer, firebase 12.18.0 or newer, rxfire 6.2.0 or newer, and TypeScript 5.8 or newer (below 6). ng add and ng deploy work with firebase-tools 14 or 15.

ng update @angular/core@21 @angular/cli@21 @angular/fire

The AngularFire 21 upgrade guide covers the rest, including the Vertex AI to Firebase AI Logic move.

Update firebase together with @angular/fire. If your package.json still requests firebase 11, npm does not report a conflict. It installs both SDK versions side by side, and the two copies reject each other's objects at runtime. ng update @angular/fire@21 moves your firebase dependency to ^12.18.0 for you. If you upgrade by hand, run npm install firebase@^12 with it, then check that npm ls firebase shows one version.

Breaking changes

• Angular 21.2 or newer is required (#3763). Angular 21 is in long-term support, so 21.2 is its final minor line. Run ng update @angular/core @angular/cli first if your app is on 21.0 or 21.1.

• firebase 12.18.0 or newer and rxfire 6.2.0 or newer are required (#3761, #3723). Older rxfire versions ask for firebase 11, which installs a second SDK copy next to your firebase 12.

• The @angular/fire/vertexai entry point is gone. Its replacement is @angular/fire/ai, Firebase AI Logic (#3674). ng update @angular/fire@21 rewrites the imports and renamed symbols, emits AgentPlatformBackend in place of the deprecated VertexAIBackend, and changes the default location from us-central1 to global, warning for every file whose region changed (#3725, #3762). The Imagen API, removed in firebase 12.18, is no longer wrapped, and the migration warns remaining Imagen users (#3750).

• App Check no longer runs during server rendering by default (#3773). AngularFire no longer calls the function passed to provideAppCheck on the server, and inject(AppCheck) returns null there. Browser-side behavior is unchanged. This fixes the ReferenceError: document is not defined build failure in server-rendered apps, because the reCAPTCHA providers need a browser. To keep App Check running during server rendering, provide APP_CHECK_ON_SERVER as true in your server config:

  import { APP_CHECK_ON_SERVER } from '@angular/fire/app-check';
  // in your server app config's providers
  { provide: APP_CHECK_ON_SERVER, useValue: true },

  Details, including how server-side Firebase requests can still carry an App Check token: App Check during server rendering.

Updating from a 21 release candidate or canary build

Installing a release candidate saves its exact version, so it does not move on its own (#3709). Run:

ng update @angular/fire@21

If you installed a canary build, run npm install @angular/fire@latest instead. ng update does not offer 21.0.0 to a 21.0.1-canary install, because the canary's version number is higher.

What's Changed

Fixes that also shipped to Angular 20 apps in 20.0.3, 20.1.0 and 20.1.1 are not repeated here.

Upgrading to v21

• fix: ng update @angular/fire updates your project's firebase dependency to the supported ^12.18.0, and ng add aligns it during setup, preventing duplicated-SDK installs. by @​armando-navarro in angular/angularfire#3722
• feat: ng add @angular/fire warns when firebase is installed at more than one version, and shows the dependency chain. Prevents various hard-to-diagnose bugs. by @​armando-navarro in angular/angularfire#3760
• fix: ng update @angular/fire no longer stops before the v21 migration when it runs under Angular CLI 22.3, whose schematics package refuses the file path AngularFire's schematics loaded. by @​armando-navarro in angular/angularfire#3793
• build: AngularFire wraps four new Cloud Messaging functions from firebase 12.18: onRegistered, onUnregistered, register and unregister. by @​armando-navarro in angular/angularfire#3761

... (truncated)

Commits

• 2f5ef49 docs: describe AngularFire 21 as released, not as a release candidate (#3813)
• f020821 docs(app-check): explain App Check during server rendering (#3775)
• e11f0da docs: note the removed @​angular/platform-server peer in the v21 upgrade guide...
• 4c5ba7e fix(storage): give the compat fromTask an explicit return type (#3796)
• d95316b fix(schematics): require only exported devkit paths from the shipped schemati...
• bbce8f0 fix(core): drop the unused optional @​angular/platform-server peer (#3792)
• 31fb2ae fix(ci): choose a release's dist-tag when it publishes, and move next after i...
• bc3fdad chore: ask in the PR template whether a change is breaking (#3782)
• 110dac1 docs: cover ng update stopping on a Node.js version message (#3788)
• d3f8531 docs: tell quickstart readers how to get past the npm edgesOut crash (#3787)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/fire since your current version.

Updates @angular/forms from 19.2.9 to 22.2.3

Release notes

Sourced from @​angular/forms's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• cc515b8 perf(forms): use addEventListener to avoid unconditional CD scheduling on blur
• dcb29a9 docs: fix @​param names that don't match their parameters
• 276248f docs(forms): document that minDate and maxDate expect UTC dates
• 26279ed test(forms): cover the deprecated disabled signatures
• 206f541 docs(forms): use the when option in disabled examples
• db91010 fix(docs-infra): stop generating member anchors that do not exist
• c91a8c4 fix(forms): use Object.is when comparing control bindings in signal forms
• b0710b8 fix(forms): don't crash when control is missing in setUpValidators
• 6a96a40 refactor(forms): modernize value accessor integration tests
• ef03596 fix(forms): skip class bindings for orphaned fields
• Additional commits viewable in compare view

Updates @angular/platform-browser from 19.2.9 to 22.2.3

Release notes

Sourced from @​angular/platform-browser's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• 1663b5e docs(platform-browser): link the styling guide from the namespacing APIs (#70...
• 6298b30 refactor(platform-browser): type async animation renderer
• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• ab0cfda refactor(platform-browser): type shadow DOM renderer fields
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• 83f7695 fix(core): throw coded RuntimeErrors instead of crashing when hydration/rende...
• 6f9a6be fix(platform-browser): disallow event handler attributes in Meta
• d35c17d refactor: correct typos in comments, docs, and error messages
• 1cb3d60 fix(platform-browser): throw a descriptive error when insertBefore reference ...
• ec372d6 refactor(platform-browser): modernize DOM renderer tests
• Additional commits viewable in compare view

Updates @angular/platform-browser-dynamic from 19.2.9 to 22.2.3

Release notes

Sourced from @​angular/platform-browser-dynamic's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• 861d37e build: update minimum supported Node.js versions
• b8d3f36 feat(compiler-cli): add support for Node.js 26.0.0
• 4ad3a1f refactor(core): Don't throw when there are not async metadata
• 7f3f3d7 ci: remove remainings of saucelabs tests
• d550bf7 build: update minimum supported Node.js versions
• d3f67f6 refactor(core): mark VERSION as @__PURE__ for better tree-shaking
• 26fed34 build: format md files
• c357650 refactor(core): Update tests for zoneless by default (#63668)
• 2fcafb6 build: rename defaults2.bzl to defaults.bzl (#63383)
• fa8d8b8 build: migrate all npm packages to use new rules_js based npm_package rule (#...
• Additional commits viewable in compare view

Updates @angular/router from 19.2.9 to 22.2.3

Release notes

Sourced from @​angular/router's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• dcb29a9 docs: fix @​param names that don't match their parameters
• f9a4f75 fix(router): check abort signal state on subscribe
• 7bc6a1b refactor(router): Remove canLoad from 1p Router
• e0137cb fix(router): remove the navigate event abort listener once it fires
• fc91c72 fix(router): reset internal state on error handler redirect after state commit
• 576df28 fix(router): fall back when serializing protocol-relative URLs
• d98ee02 docs(router): note that shouldReuseRoute doesn't rerun guards and resolvers
• e9bf52a fix(router): require outlets to match a route before processing child segments
• 83abee3 Revert "fix(router): fall back when serializing protocol-relative URLs"
• 3b6796f fix(router): reject duplicate outlets in production builds
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.