Bump @angular/compiler from 20.3.17 to 21.2.7

[dependabot]

Bumps @angular/compiler from 20.3.17 to 21.2.7.

Release notes

Sourced from @​angular/compiler's releases.

21.2.7

compiler

Commit	Description
	register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit	Description
	prevent recursive scope checks for invalid NgModule imports

core

Commit	Description
	prevent binding unsafe attributes on SVG animation elements (#67797)
	resolve component import by exact specifier in route lazy-loading schematic
	treat object[data] as resource URL context (#67797)

localize

Commit	Description
	validate locale in getOutputPathFn to prevent path traversal

router

Commit	Description
	pass outlet context to split to fix empty path named outlets

21.2.6

common

Commit	Description
	avoid redundant image fetch on destroy with auto sizes

compiler

Commit	Description
	prevent shimCssText from adding extra blank lines per CSS comment

core

Commit	Description
	fixes a regression with animate.leave and reordering

migrations

Commit	Description
	inject migration not work in multi-project workspace with option path

21.2.5

compiler

Commit	Description
	ensure generated code compiles
	parse named HTML entities containing digits

compiler-cli

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.7 (2026-04-01)

compiler

Commit	Type	Description
fea25d1a60	fix	register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit	Type	Description
bba5ed8e64	fix	prevent recursive scope checks for invalid NgModule imports

core

Commit	Type	Description
d04ddd73df	fix	prevent binding unsafe attributes on SVG animation elements (#67797)
8fd896e99a	fix	resolve component import by exact specifier in route lazy-loading schematic
b682c62873	fix	treat object[data] as resource URL context (#67797)

localize

Commit	Type	Description
3c41e74fdd	fix	validate locale in getOutputPathFn to prevent path traversal

router

Commit	Type	Description
0960592d3d	fix	pass outlet context to split to fix empty path named outlets

22.0.0-next.5 (2026-03-25)

Breaking Changes

compiler-cli

• Elements with multiple matching selectors will now throw at compile time.

core

• Component with undefined changeDetection property are now OnPush by default. Specify changeDetection: ChangeDetectionStrategy.Eager to keep the previous behavior.

platform-browser

• Hammer.js integration has been removed. Use your own implementation.

common

Commit	Type	Description
c1312da183	fix	avoid redundant image fetch on destroy with auto sizes

compiler

Commit	Type	Description
e850643b1b	feat	Support comments in html element.
96be4f429b	fix	abstract emitter producing incorrect code for dynamic imports
5a712d42d1	fix	prevent shimCssText from adding extra blank lines per CSS comment

compiler-cli

Commit	Type	Description
ca67828ee2	refactor	introduce NG8023 compile-time diagnostic for duplicate selectors

core

... (truncated)

Commits

• d04ddd7 fix(core): prevent binding unsafe attributes on SVG animation elements (#67797)
• fea25d1 fix(compiler): register SVG animation attributes in URL security context (#67...
• 880a57d fix(compiler): prevent shimCssText from adding extra blank lines per CSS comment
• 23ea431 fix(compiler): parse named HTML entities containing digits
• 334ae10 fix(compiler): ensure generated code compiles
• ed2d324 fix(compiler): disallow translations of iframe src
• 1df1697 fix(compiler): prevent mutation of children array in RecursiveVisitor
• 95b3f37 feat(compiler): Exhaustive checks for switch blocks
• 9c5658a refactor(compiler): clean up pipeline compatibility distinction
• 6e0d783 refactor(compiler): Add info about unclosed element.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.