Update Fundamental NGX and Angular

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@angular-devkit/build-angular	21.1.4 → 21.2.14			devDependencies	minor	21.2.15
@angular/animations (source)	21.1.4 → 21.2.16			dependencies	minor	21.2.17
@angular/build	21.1.4 → 21.2.14			devDependencies	minor	21.2.15
@angular/cli	21.1.4 → 21.2.14			devDependencies	minor	21.2.15
@angular/common (source)	21.1.4 → 21.2.16			dependencies	minor	21.2.17
@angular/compiler-cli (source)	21.1.4 → 21.2.16			devDependencies	minor	21.2.17
@angular/elements (source)	21.1.4 → 21.2.16			dependencies	minor	21.2.17
@angular/forms (source)	21.1.4 → 21.2.16			dependencies	minor	21.2.17
@angular/localize	21.1.4 → 21.2.16			dependencies	minor	21.2.17
@angular/platform-browser (source)	21.1.4 → 21.2.16			dependencies	minor	21.2.17
@angular/platform-browser-dynamic (source)	21.1.4 → 21.2.16			dependencies	minor	21.2.17
@angular/router (source)	21.1.4 → 21.2.16			dependencies	minor	21.2.17
rxjs (source)	^7.8.1 → ^7.8.2			dependencies	patch
typescript (source)	^5.8.0 → 5.9.3			devDependencies	pin

---

Release Notes

angular/angular-cli (@​angular-devkit/build-angular)

v21.2.14

Compare Source

@​angular/cli

Commit	Type	Description
aed448748	fix	expand package groups for newly added peer dependencies in update schematic

@​angular/build

Commit	Type	Description
d46c082fb	fix	prevent esbuild service child process leakage

v21.2.13

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
3c6d26a31	fix	remove unconditional CORS wildcard from webpack dev-server

@​angular/build

Commit	Type	Description
2b3e95517	fix	assert that asset input paths are within workspace root

v21.2.12

Compare Source

@​angular/build

Commit	Type	Description
cbad57579	fix	ignore virtual esbuild paths with (disabled):

v21.2.11

Compare Source

@​angular/cli

Commit	Type	Description
bbd63b7a5	fix	robustly parse npm manifest from array

@​angular/ssr

Commit	Type	Description
eafe1a719	fix	allow all hosts in common engine rendering options to prevent validation errors
7a116a80d	fix	remove stateful flag from URL_PARAMETER_REGEXP

v21.2.10

Compare Source

@​angular/cli

Commit	Type	Description
bb8611913	fix	restrict MCP workspace access to allowed client roots during resolution

v21.2.9

Compare Source

@​angular/cli

Commit	Type	Description
233deef01	fix	fix broken img ref in ai-tutor
7cea9885c	fix	introduce initial package manager workspace awareness
5b1a5b743	fix	remove standalone true ref in ai tutor

@​schematics/angular

Commit	Type	Description
e7abeb5c7	fix	add missing imports for focus and skip APIs in refactor-jasmine-vitest

@​angular/ssr

Commit	Type	Description
94023f62c	fix	introduce trustProxyHeaders option to safely validate and sanitize proxy headers
5ffe5c309	fix	add support for configuring trusted proxy headers via environment variable
930ada9b7	fix	decode route segments when building and matching route tree
0dc8a440c	fix	use router to normalize URLs for comparison

v21.2.8: 21.2.8

Compare Source

@​angular/cli

Commit	Description
	dynamically resolve project Angular CLI executable inside MCP tools
	ignore EBADF file system errors during MCP project scan
	use headless option in MCP test tool

@​angular-devkit/build-angular

Commit	Description
	ensure route has leading slash in prerender builder
	fix app-shell route format and

@​angular/build

Commit	Description
	use rootDir for HMR component updates path resolution
	validate V8 coverage support for browsers in Vitest

v21.2.7

Compare Source

@​angular/cli

Commit	Type	Description
971041aa1	fix	handle missing package manager during analytics initialization

@​angular/build

Commit	Type	Description
365cce81d	fix	preserve coverage ignore comments in development
9f74660c3	fix	show clear error when styleUrl points to a TypeScript file

v21.2.6

Compare Source

@​angular/cli

Commit	Type	Description
ea14f28cc	fix	fix sourceRoot resolution for MCP projects tool

@​angular/build

Commit	Type	Description
9136eb376	fix	ensure transitive SCSS partial errors are tracked in watch mode
8186faa11	fix	ensure Vitest mock patching is executed only once
107d1a9e2	fix	preserve error stack traces during prerendering
b7f457253	fix	scope CHROME_BIN executable path to individual playwright instances

v21.2.5

Compare Source

@​angular/cli

Commit	Type	Description
cadf9b201	feat	support custom port in MCP devserver start tool

@​angular/ssr

Commit	Type	Description
bbc255419	fix	allow underscores in host validation
b1fe66a7f	fix	patch Headers.forEach in cloneRequestAndPatchHeaders

v21.2.4

Compare Source

@​angular/cli

Commit	Type	Description
a7787d092	fix	restore console methods after logger completes

@​angular/build

Commit	Type	Description
7170599ab	fix	deduplicate and merge coverage excludes with vitest
c73f13797	fix	prevent reporter duplicates by explicitly overriding Vitest configuration
956ccaa71	fix	remove default for unit-test coverage option
36978db7e	fix	warn about performance of test.exclude in vitest configuration
6ec36f5be	fix	warn when vitest watch config conflicts with builder

@​angular/ssr

Commit	Type	Description
9bdf782c8	fix	apply forwarded prefix and vary header in accept-language redirects
628c58672	fix	support '*' in allowedHosts and warn about security risks

v21.2.3

Compare Source

@​angular/cli

Commit	Type	Description
1505164bb	fix	use parsed package name for migrate-only updates

@​angular/build

Commit	Type	Description
75fa94cad	fix	alias createRequire banner import to avoid duplicate binding
d009aa1ec	fix	only use external packages for polyfills when no local files are present

@​angular/ssr

Commit	Type	Description
f3e0e82c2	fix	disallow x-forwarded-prefix starting with a backslash
b8bcd59b4	fix	ensure unique values in redirect response Vary header
84385411d	fix	support custom headers in redirect responses

v21.2.2

Compare Source

@​angular/cli

Commit	Type	Description
8447d9132	fix	conditionally quote package names when adding dependencies based on host requirements
d2f209823	fix	preserve exact version in ng add when requested
28f4d684a	perf	avoid redundant package version resolution in ng add

@​angular/build

Commit	Type	Description
06010294f	fix	allow any CHROME_BIN for vitest playwright provider
8dec0c62b	fix	normalize line endings for CSP hash generation
58688ebd7	fix	pass process environment variables to prerender workers
4ca61647f	fix	resolve assets correctly during i18n prerendering

v21.2.1

Compare Source

@​angular/cli

Commit	Type	Description
ae4c28d00	fix	correct dev dependency detection logic in ng add
465073bc1	fix	disable npm update notifier in package manager host
36270634f	fix	ensure group members are updated to targeted version
d87dba6af	fix	ignore unknown files when formatting schematic changes

@​schematics/angular

Commit	Type	Description
72d466aa0	fix	prevent adding test dependencies when minimal option is enabled

@​angular-devkit/build-angular

Commit	Type	Description
0019d1c8e	fix	update copy-webpack-plugin to v14.0.0

@​angular/build

Commit	Type	Description
6ad860863	fix	bundle polyfills to preserve execution order in dev server
d17397375	fix	conditionally allow vi.mock for non-relative imports
0d49f86ed	fix	resolve style include paths relative to ng-package.json in unit-test builder
584f6a2d9	fix	treat empty browsers array as undefined in unit-test builder
6699cdc9b	perf	fix memory leak in ng serve with i18n

@​angular/ssr

Commit	Type	Description
43a9dfa66	fix	improve header validation logic
dee3717b3	fix	introduce DI token to signal route discovery process

v21.2.0

Compare Source

@​angular/cli

Commit	Type	Description
0dd04f289	feat	add markdown files to Prettier's formatting list
fbae1b6ab	feat	automatic formatting files modified by schematics
91b9d281f	feat	integrate file formatting into update migrations
98a24d040	feat	standardize MCP tools around workspace/project options
d9cd609c5	fix	correctly parse scoped packages in yarn classic list output
5b05f2500	fix	enable shell option for Prettier execution on Windows platforms
25b8a157d	fix	quote complex range specifiers in package manager
6f29a8c35	fix	renamed files by their new path in the schematic workflow
201a036f2	fix	simplify Angular version compatibility checks and add special handling for local builds of new major versions
cdd26bb66	fix	validate package manager version using semver.valid and throw an error if invalid
bc363af8b	perf	optimize package manager discovery with stat-based probing

@​schematics/angular

Commit	Type	Description
aa7381efd	feat	add a '.prettierrc' file to generated workspaces and add Prettier as dev dependency
f80db6fb7	feat	add ng-add support for Vitest browser providers
5d1df50d8	fix	add actionable feedback to vitest-browser schematic

@​angular/build

Commit	Type	Description
ece30f235	feat	add headless option to unit-test builder
cad7a7c0f	feat	run vitest browser with playwright with OS theme
0b4982720	fix	adjust sourcemap sources when Vitest wrapper is bypassed
1f114a9e8	fix	bundle setup files in unit-test builder for Vitest
fd5cb28c8	fix	explicitly fail when using Vitest runtime mocking
dc899e8a5	fix	normalize allowedHosts in dev-server
26bbea12f	fix	serve extensionless assets without transformation

v21.1.5

Compare Source

@​angular/ssr

Commit	Type	Description
8695d6063	fix	prevent open redirect via X-Forwarded-Prefix header
e4d445ec6	fix	validate host headers to prevent header-based SSRF

angular/angular (@​angular/animations)

v21.2.16

Compare Source

v21.2.15

Compare Source

common

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

compiler

Commit	Type	Description
0b07f47bd6	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#​68925)
eb1cbbf2eb	fix	prevent namespaced SVG <style> elements from being stripped
cc1378d54b	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#​68925)
782e01594e	fix	strip namespaced SVG script elements during template compilation (#​68925)

core

Commit	Type	Description
ff12fe55ac	fix	normalize tag names in runtime i18n attribute security context lookup (#​68925)
e6fe77cc97	fix	sanitize meta selectors
daaf32937f	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#​68925)
dada86e43d	fix	synchronize core sanitization schema with compiler (#​68925)

http

Commit	Type	Description
582a417bd2	fix	exclude withCredentials requests from transfer cache
5c6d6df34b	fix	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Type	Description
37e8aadf87	fix	prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e	fix	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Type	Description
b8bd49341d	fix	Preserves explicit 'credentials: omit' in asset requests
ca32fc1000	fix	Preserves HTTP cache mode in asset group requests

v21.2.14

Compare Source

compiler

Commit	Type	Description
68282dff9f	fix	strip namespaced SVG script elements during template compilation

core

Commit	Type	Description
c0f52272ed	fix	do not insert todo when migrating void @​Output
938a7f3edd	fix	makes resource URL sanitizer lookup case-insensitive
0fb2724194	fix	reject script element as a dynamic component host
49113ac0ef	fix	visit ICU expressions in signal migration schematics

router

Commit	Type	Description
099bf577ee	fix	skip scroll-to-top on initial navigation when hydrating

v21.2.13

Compare Source

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add allowedHosts option to renderModule and renderApplication
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

v21.2.12

Compare Source

core

Commit	Type	Description
fe13bb669d	fix	allow explicit read generic with signal input transforms
3430251fef	fix	i18n flags leaking on errors
1aeebbe304	fix	respect ngSkipHydration on components with projectable nodes in LContainers
9e38ed7d57	fix	sanitizer typings
7a05a9a71a	fix	validate security-sensitive attributes in i18n bindings
c37f6ca42f	fix	visit ng-let expression value in signal migration schematics

forms

| Commit

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch renovate/fundamental-ngx-and-angular

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch renovate/fundamental-ngx-and-angular

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch renovate/fundamental-ngx-and-angular

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch renovate/fundamental-ngx-and-angular

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}