Update Fundamental NGX and Angular by renovate[bot] · Pull Request #16 · openmfp/webcomponents

renovate · 2026-03-30T12:47:55Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@angular-devkit/build-angular	`21.2.7` → `21.2.19`	devDependencies	patch
@angular-eslint/builder (source)	`^21.3.1` → `21.3.1`	devDependencies	pin
@angular/build	`^21.2.7` → `21.2.10`	devDependencies	pin
@angular/cli	`21.2.7` → `21.2.19`	devDependencies	patch
@angular/compiler-cli (source)	`21.2.12` → `21.2.18`	devDependencies	patch
@fundamental-ngx/ui5-webcomponents (source)	`^0.59.1` → `^0.59.1 \|\| ^0.63.0`	peerDependencies	minor
@fundamental-ngx/ui5-webcomponents (source)	`0.59.1` → `0.63.1`	peerDependencies	minor
@fundamental-ngx/ui5-webcomponents-fiori (source)	`^0.59.1` → `^0.59.1 \|\| ^0.63.0`	peerDependencies	minor
@fundamental-ngx/ui5-webcomponents-fiori (source)	`0.59.1` → `0.63.1`	peerDependencies	minor
ng-packagr	`^21.1.0` → `21.2.3`	devDependencies	pin
typescript-eslint (source)	`^8.33.0` → `8.59.3`	devDependencies	pin

Release Notes

angular/angular-cli (@angular-devkit/build-angular)

`v21.2.19`

Compare Source

`v21.2.18`

Compare Source

@angular/cli

Commit	Type	Description
61a810ab6	fix	respect release age policy in update bootstrapping logic

@angular/build

Commit	Type	Description
a2b6116ed	fix	bump undici to 7.28.0
2510ee3c9	fix	bump vite to 7.3.6

`v21.2.17`

Compare Source

@angular/build

Commit	Type	Description
9c366e8be	fix	bump @babel/core to 7.29.7
6a06ce9e9	fix	bump esbuild to 0.28.1
637b84877	fix	bump piscina to 5.2.0
e86d58a12	fix	bump vite to 7.3.5

`v21.2.16`

Compare Source

@angular/cli

Commit	Type	Description
77c9047ac	fix	update pacote to 21.5.1

@angular/ssr

Commit	Type	Description
d052e97da	fix	prioritize options over environment variables in AngularNodeAppEngine

`v21.2.15`

Compare Source

@angular/cli

Commit	Type	Description
42ac0ed0f	fix	remove forceAuth and unscoped credential parsing
c7a7f1955	fix	support registry metadata fetching under bun package manager

`v21.2.14`

Compare Source

@angular/cli

Commit	Type	Description
aed448748	fix	expand package groups for newly added peer dependencies in update schematic

@angular/build

Commit	Type	Description
d46c082fb	fix	prevent esbuild service child process leakage

`v21.2.13`

Compare Source

@angular-devkit/build-angular

Commit	Type	Description
3c6d26a31	fix	remove unconditional CORS wildcard from webpack dev-server

@angular/build

Commit	Type	Description
2b3e95517	fix	assert that asset input paths are within workspace root

`v21.2.12`

Compare Source

@angular/build

Commit	Type	Description
cbad57579	fix	ignore virtual esbuild paths with (disabled):

`v21.2.11`

Compare Source

@angular/cli

Commit	Type	Description
bbd63b7a5	fix	robustly parse npm manifest from array

@angular/ssr

Commit	Type	Description
eafe1a719	fix	allow all hosts in common engine rendering options to prevent validation errors
7a116a80d	fix	remove stateful flag from URL_PARAMETER_REGEXP

`v21.2.10`

Compare Source

@angular/cli

Commit	Type	Description
bb8611913	fix	restrict MCP workspace access to allowed client roots during resolution

`v21.2.9`

Compare Source

@angular/cli

Commit	Type	Description
233deef01	fix	fix broken img ref in ai-tutor
7cea9885c	fix	introduce initial package manager workspace awareness
5b1a5b743	fix	remove standalone true ref in ai tutor

@schematics/angular

Commit	Type	Description
e7abeb5c7	fix	add missing imports for focus and skip APIs in refactor-jasmine-vitest

@angular/ssr

Commit	Type	Description
94023f62c	fix	introduce trustProxyHeaders option to safely validate and sanitize proxy headers
5ffe5c309	fix	add support for configuring trusted proxy headers via environment variable
930ada9b7	fix	decode route segments when building and matching route tree
0dc8a440c	fix	use router to normalize URLs for comparison

`v21.2.8`: 21.2.8

Compare Source

@angular/cli

Commit	Description
	dynamically resolve project Angular CLI executable inside MCP tools
	ignore EBADF file system errors during MCP project scan
	use headless option in MCP test tool

@angular-devkit/build-angular

Commit	Description
	ensure route has leading slash in prerender builder
	fix app-shell route format and

@angular/build

Commit	Description
	use rootDir for HMR component updates path resolution
	validate V8 coverage support for browsers in Vitest

angular/angular (@angular/compiler-cli)

`v21.2.18`

Compare Source

compiler-cli

Commit	Type	Description
8d22cc953b	fix	update babel dependencies to latest v7

core

Commit	Type	Description
6bcce117fb	fix	avoid caching missing locale data
5a693bafcd	fix	reject dynamic script host elements

http

Commit	Type	Description
91df739b80	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
1804f73bec	fix	preserve referrer in asset requests
e86c31bf26	fix	preserve referrer policy in asset requests

`v21.2.17`

Compare Source

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Type	Description
86a56dc279	fix	Limits date format string length
d846326b07	fix	skip transfer cache for uncacheable HTTP traffic
bc55749698	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
dc9c99636d	fix	sanitize two-way properties

core

Commit	Type	Description
1523061137	fix	harden TransferState restoration against DOM clobbering
88832c84f8	fix	validate lowercase SVG animation attribute names (#69269)

http

Commit	Type	Description
bcb1b7ea25	fix	preserve empty referrer option in HttpRequest
a810a319d1	fix	Rejects non-HTTP(S) URLs in JSONP requests
e245d40c4d	fix	skip transfer cache for fetch credentialed requests

platform-server

Commit	Type	Description
35510746b7	fix	harden platform location origin validation during SSR
13fb0afe93	refactor	deprecate ServerXhr (#69255)

service-worker

Commit	Type	Description
b9d29381bb	fix	Strips sensitive headers on cross-origin redirects

`v21.2.16`

Compare Source

common

Commit	Type	Description
f6d8e642b0	fix	only strip a literal /index.html suffix from URLs

compiler

Commit	Type	Description
ae1c8a1f7a	fix	move projection attributes into constants

core

Commit	Type	Description
3fd6897a67	fix	harden inherit definition feature against polluted prototypes
7e38336dc7	fix	use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

Commit	Type	Description
66821c4ed5	fix	throw on suspicious URLs and restrict protocol-relative URLs
d3170031b6	fix	update domino to latest version

`v21.2.15`

Compare Source

common

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

compiler

Commit	Type	Description
0b07f47bd6	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
eb1cbbf2eb	fix	prevent namespaced SVG <style> elements from being stripped
cc1378d54b	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
782e01594e	fix	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Type	Description
ff12fe55ac	fix	normalize tag names in runtime i18n attribute security context lookup (#68925)
e6fe77cc97	fix	sanitize meta selectors
daaf32937f	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
dada86e43d	fix	synchronize core sanitization schema with compiler (#68925)

http

Commit	Type	Description
582a417bd2	fix	exclude withCredentials requests from transfer cache
5c6d6df34b	fix	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Type	Description
37e8aadf87	fix	prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e	fix	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Type	Description
b8bd49341d	fix	Preserves explicit 'credentials: omit' in asset requests
ca32fc1000	fix	Preserves HTTP cache mode in asset group requests

`v21.2.14`

Compare Source

compiler

Commit	Type	Description
68282dff9f	fix	strip namespaced SVG script elements during template compilation

core

Commit	Type	Description
c0f52272ed	fix	do not insert todo when migrating void @Output
938a7f3edd	fix	makes resource URL sanitizer lookup case-insensitive
0fb2724194	fix	reject script element as a dynamic component host
49113ac0ef	fix	visit ICU expressions in signal migration schematics

router

Commit	Type	Description
099bf577ee	fix	skip scroll-to-top on initial navigation when hydrating

`v21.2.13`

Compare Source

core

Commit	Type	Description
1c6553e97d	fix	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Type	Description
629905d537	fix	add `allowedHosts` option to `renderModule` and `renderApplication`
0b7192f441	fix	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

SAP/fundamental-ngx (@fundamental-ngx/ui5-webcomponents)

`v0.63.1`

Compare Source

Bug Fixes

ci: set npm provenance config directly before publish (#14342) (e62b8a5)
core: add accessible names to FlexibleColumnLayout separator buttons (#14313) (179f7f3)
core: add option to configure popover placement in Multi Input (#14317) (61c85df)
core: address Shell Bar design review comments (#14333) (96a3b91)
core: fix msg box focus trap (#14298) (7f4ee1c)
core: improve menu ARIA attributes and VoiceOver compatibility (#14327) (ad32db1)
core: prevent duplicate subscription in segmented-button button changes listener (#14308) (fe9efaf), closes #13358
core: prevent inline-help text from being announced twice by screen readers (#14310) (f673625)
core: screen reader announces selection state for fd-list items (#14322) (3da2167)
ng update report missing (#14331) (0f2bade)
platform: approval flow empty results (#14320) (768f218)
platform: f2 key should move focus in and out of child item on fdk focusable items (#14328) (406366a)
platform: search field missing title attribute for sync button (#14321) (38507fa)
platform: update table list and table so header cell popover closes with escape (#14326) (d27f86d)
platform: use live announcer for screenreader when expand all / collapse all buttons are clicked (#14324) (04d1b74)

Features

core: shift-click multi-date selection for fd-calendar / fd-date-picker (#14309) (05e97fc), closes #13502

`v0.63.0`

Compare Source

Bug Fixes

cdk: fix autocomplete race condition with fast typing (#14295) (30b4d63)
ci: generate components.json before netlify docs build (#14285) (fa7408d)
core, datetime-adapter: fix datetime picker manual input (#14251) (2500d9a)
core: combobox click-outside parity with Tab out (#14306) (19e4c97), closes #13481
core: expose bodyRole + bodyAriaLabelledBy inputs on fd-popover (#14260) (#14270) (0ef0ec9)
core: fix datetime picker selection (#14243) (77594be)
core: fix fd-select dropdown reposition upon DOM changes (#14265) (d15a581), closes #14252 #14244 #14267
core: fix Message Strip btn misalignment (#14269) (1fc9721)
core: guard tokenList.changes with takeUntilDestroyed (#14296) (c8411f5)
core: limit rendered tokens in multi-input to visible count (#14137) (f099bf7)
core: prevent parent submenu from closing when hovering nested submenu (#14284) (7f5c4b7)
core: scroll active element into view upon opening select (#14299) (b580a26)
datetime adapters migration (#14016) (6be78b5)
datetime-adapter: accept single-digit M/D in DayjsDatetimeAdapter parse (#13534) (#14307) (05a07d7)
platform: fix the exception that occurs in fdp-approval-flow for multiple blocks (#14228) (4f91b6e)
platform: remove Angular compiler warnings (#14280) (5bb29a6)
platform: stop fdp-combobox auto-selecting first item on open (#14305) (c6c36d9)
platform: use tabs instead of segmented button in combined table settings dialog (#14244) (0f3b2ab)

Features

core: add a shellbar context area overflow example (#14255) (42fb00b)
core: add header content area to User Menu, adopt latest fund-styles (#14268) (f499d1f)
mcp: MCP server evaluation - part 5 (#14224) (12a2225)
mcp: MCP server evaluation - part 6 (#14259) (73af5fd)
platform: add column configuration to table combined settings dialog (#14212) (c54a31e)

BREAKING CHANGES

mcp: recommend_components removed. It used a hardcoded
23-entry UI_PATTERNS dict that missed the entire platform form layer
(fdp-form-group, fdp-form-field). Use search_components with relevant
keywords instead.
mcp: get_design_tokens removed. The corpus was only 92
tokens (42 hardcoded SAP theme vars + 50 spacing utility classes);
focus, disabled, and hover tokens were absent, making it unusable for
component styling. Use @fundamental-styles/mcp get_design_tokens
(1500+ tokens) instead.
mcp: get_migration_guide tool removed from @fundamental-ngx/mcp.
mcp: get_accessibility_guide tool removed from @fundamental-ngx/mcp.
Use get_component_api — it returns all inputs (including ARIA inputs with
descriptions) and the keyboardHandling field.

Features

mcp: MCP server evaluation - part 4 (#14221) (e2866a6)

Bug Fixes

platform: fdp-input inside fdp-form-field requires double click outside to lose focus (#14217) (62129a2)

Features

mcp: MCP server evaluation part 3 - Skills (#14211) ([a2dac62](https://redirect.github.com/SAP/fundamental-n

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-03-30T12:48:01Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 8f7ade76-2684-4387-801e-25b04015df67

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

renovate · 2026-05-21T07:55:05Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @openmfp/webcomponents@0.17.2
npm error Found: @angular/compiler@21.2.12
npm error node_modules/@angular/compiler
npm error   peer @angular/compiler@"^21.2.0" from the root project
npm error   peerOptional @angular/compiler@"21.2.12" from @angular/core@21.2.12
npm error   node_modules/@angular/core
npm error     peer @angular/core@"^21.2.0" from the root project
npm error     peer @angular/core@"21.2.12" from @angular/animations@21.2.12
npm error     node_modules/@angular/animations
npm error       peer @angular/animations@"^21.2.0" from the root project
npm error       3 more (@angular/platform-browser, ...)
npm error     9 more (@angular/cdk, @angular/common, @angular/elements, ...)
npm error   2 more (@angular/platform-browser-dynamic, @storybook/angular)
npm error
npm error Could not resolve dependency:
npm error dev @angular-devkit/build-angular@"21.2.19" from the root project
npm error
npm error Conflicting peer dependency: @angular/compiler@21.2.18
npm error node_modules/@angular/compiler
npm error   peer @angular/compiler@"21.2.18" from @angular/compiler-cli@21.2.18
npm error   node_modules/@angular/compiler-cli
npm error     dev @angular/compiler-cli@"21.2.18" from the root project
npm error     peer @angular/compiler-cli@"^21.0.0" from @angular-devkit/build-angular@21.2.19
npm error     node_modules/@angular-devkit/build-angular
npm error       dev @angular-devkit/build-angular@"21.2.19" from the root project
npm error     2 more (@angular/localize, ng-packagr)
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-18T01_14_43_736Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-18T01_14_43_736Z-debug-0.log

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot force-pushed the renovate/fundamental-ngx-and-angular branch 10 times, most recently from 7112aeb to bd280a2 Compare March 31, 2026 13:52

renovate Bot changed the title ~~Pin dependencies~~ fix(deps): pin dependencies Mar 31, 2026

renovate Bot force-pushed the renovate/fundamental-ngx-and-angular branch 4 times, most recently from 86ae1e6 to 122f13c Compare April 3, 2026 15:14

renovate Bot changed the title ~~fix(deps): pin dependencies~~ chore(deps): pin dependencies Apr 3, 2026

renovate Bot force-pushed the renovate/fundamental-ngx-and-angular branch 8 times, most recently from b4b8629 to 797207c Compare April 8, 2026 13:53

renovate Bot changed the title ~~chore(deps): pin dependencies~~ Pin dependencies Apr 8, 2026

renovate Bot force-pushed the renovate/fundamental-ngx-and-angular branch 4 times, most recently from 9fdf432 to 4bea5ef Compare April 16, 2026 09:36

renovate Bot force-pushed the renovate/fundamental-ngx-and-angular branch 8 times, most recently from 9410e81 to d3d7e77 Compare April 28, 2026 12:33

renovate Bot force-pushed the renovate/fundamental-ngx-and-angular branch from d3d7e77 to d11e806 Compare April 29, 2026 20:37

renovate Bot changed the title ~~Pin dependencies~~ Update Fundamental NGX and Angular Apr 29, 2026

renovate Bot force-pushed the renovate/fundamental-ngx-and-angular branch 9 times, most recently from 269beca to c393350 Compare May 7, 2026 00:24

renovate Bot force-pushed the renovate/fundamental-ngx-and-angular branch 9 times, most recently from 9b3cab2 to 770aa86 Compare May 13, 2026 08:59

Update Fundamental NGX and Angular

eb45e3d

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update Fundamental NGX and Angular#16

Update Fundamental NGX and Angular#16
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/fundamental-ngx-and-angular

renovate Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Mar 30, 2026 •

edited

Loading

Review skipped

Uh oh!

renovate Bot commented May 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v21.2.8: 21.2.8

compiler-cli

core

http

service-worker

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

common

compiler

core

platform-server

common

compiler

core

http

platform-server

service-worker

compiler

core

router

core

platform-server

Bug Fixes

Features

Bug Fixes

Features

BREAKING CHANGES

Features

Bug Fixes

Features

Configuration

Uh oh!

coderabbitai Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

renovate Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Mar 30, 2026 •

edited

Loading

`v21.2.8`: 21.2.8

coderabbitai Bot commented Mar 30, 2026 •

edited

Loading

renovate Bot commented May 21, 2026 •

edited

Loading