chore(deps): bump the npm_and_yarn group across 5 directories with 8 updates

[dependabot]

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
@angular/platform-server	21.2.5	21.2.9
@angular/ssr	21.2.3	21.2.9
astro	5.18.1	6.1.6
vite	5.4.21	6.4.2
uuid	11.1.0	14.0.0
@sveltejs/kit	2.53.4	2.57.1
postcss	8.5.6	8.5.10

Bumps the npm_and_yarn group with 1 update in the /packages/js-client/playground/vanilla directory: vite.
Bumps the npm_and_yarn group with 1 update in the /packages/richtext/playground/astro directory: astro.
Bumps the npm_and_yarn group with 1 update in the /packages/richtext/playground/vanilla directory: vite.
Bumps the npm_and_yarn group with 1 update in the /packages/richtext/playground/vue directory: vite.

Updates @angular/platform-server from 21.2.5 to 21.2.9

Release notes

Sourced from @​angular/platform-server's releases.

21.2.9

core

Commit	Description
	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Description
	add CSP nonce support to JsonpClientBackend
	Don't on Passthru outside of reactive context

platform-server

Commit	Description
	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Description
	normalize multiple leading slashes in URL parser

21.2.8

compiler

Commit	Description
	handle nested brackets in host object bindings

compiler-cli

Commit	Description
	error for type parameter declarations

core

Commit	Description
	handle missing serialized container hydration data
	remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit	Description
	get quick info at local var location to align with TS semantics and support type narrowing

21.2.7

compiler

Commit	Description
	register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit	Description
	prevent recursive scope checks for invalid NgModule imports

core

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/platform-server's changelog.

21.2.9 (2026-04-15)

core

Commit	Type	Description
f603d4714f	fix	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Type	Description
540536c386	fix	add CSP nonce support to JsonpClientBackend
63a857b874	fix	Don't on Passthru outside of reactive context

platform-server

Commit	Type	Description
e0b5078cf2	fix	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Type	Description
684e9fd53d	fix	normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

• The second argument of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
• • TypeScript versions older than 6.0 are no longer supported.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

• This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

• The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit	Type	Description
2ce0e98f79	fix	handle nested brackets in host object bindings

compiler-cli

Commit	Type	Description
7f9450219f	feat	Adds warning for prefetch without main defer trigger
ab061a7610	fix	error for type parameter declarations
9218140348	fix	resolve TCB mapping failure for safe property reads with as any

core

Commit	Type	Description
a0aa8304cd	feat	bootstrap via ApplicationRef with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
77f1ca08e4	fix	handle missing serialized container hydration data

... (truncated)

Commits

• e0b5078 fix(platform-server): prevent SSRF bypasses via protocol-relative and backsla...
• f603d47 fix(core): escape forward slashes in transfer state to prevent crawler indexing
• 04f5841 test(platform-server): fix race condition in incremental hydration test
• 958fc6a test(platform-server): replace fixed timeout with polling in event replay test
• c157916 build: consolidate domino bundling in platform-server
• See full diff in compare view

Updates @angular/ssr from 21.2.3 to 21.2.9

Release notes

Sourced from @​angular/ssr's releases.

21.2.9

@​schematics/angular

Commit	Description
	add missing imports for focus and skip APIs in refactor-jasmine-vitest

@​angular/cli

Commit	Description
	fix broken img ref in ai-tutor
	introduce initial package manager workspace awareness
	remove standalone true ref in ai tutor

@​angular/ssr

Commit	Description
	introduce trustProxyHeaders option to safely validate and sanitize proxy headers
	add support for configuring trusted proxy headers via environment variable
	decode route segments when building and matching route tree
	use router to normalize URLs for comparison

21.2.8

@​angular/cli

Commit	Description
	dynamically resolve project Angular CLI executable inside MCP tools
	ignore EBADF file system errors during MCP project scan
	use headless option in MCP test tool

@​angular-devkit/build-angular

Commit	Description
	ensure route has leading slash in prerender builder
	fix app-shell route format and

@​angular/build

Commit	Description
	use rootDir for HMR component updates path resolution
	validate V8 coverage support for browsers in Vitest

21.2.7

@​angular/cli

Commit	Description
	handle missing package manager during analytics initialization

@​angular/build

Commit	Description
	preserve coverage ignore comments in development
	show clear error when styleUrl points to a TypeScript file

21.2.6

@​angular/cli

... (truncated)

Changelog

Sourced from @​angular/ssr's changelog.

21.2.9 (2026-04-29)

@​angular/cli

Commit	Type	Description
233deef01	fix	fix broken img ref in ai-tutor
7cea9885c	fix	introduce initial package manager workspace awareness
5b1a5b743	fix	remove standalone true ref in ai tutor

@​schematics/angular

Commit	Type	Description
e7abeb5c7	fix	add missing imports for focus and skip APIs in refactor-jasmine-vitest

@​angular/ssr

Commit	Type	Description
94023f62c	fix	introduce trustProxyHeaders option to safely validate and sanitize proxy headers
5ffe5c309	fix	add support for configuring trusted proxy headers via environment variable
930ada9b7	fix	decode route segments when building and matching route tree
0dc8a440c	fix	use router to normalize URLs for comparison

20.3.25 (2026-04-29)

@​angular-devkit/build-angular

Commit	Type	Description
5e01ef40e	fix	upgrade postcss to 8.5.12

@​angular/ssr

Commit	Type	Description
6686848d9	fix	introduce trustProxyHeaders option to safely validate and sanitize proxy headers

22.0.0-next.6 (2026-04-22)

@​angular/cli

... (truncated)

Commits

• 564b108 release: cut the v21.2.9 release
• dbda92b build: update cross-repo angular dependencies
• 828c175 build: update pnpm to v10.33.2
• a887b94 build: lock file maintenance
• 56d19be build: update cross-repo angular dependencies
• f2f4851 build: update dependency postcss to v8.5.12
• 5ffe5c3 fix(@​angular/ssr): add support for configuring trusted proxy headers via envi...
• 930ada9 fix(@​angular/ssr): decode route segments when building and matching route tree
• 0dc8a44 fix(@​angular/ssr): use router to normalize URLs for comparison
• 7cea988 fix(@​angular/cli): introduce initial package manager workspace awareness
• Additional commits viewable in compare view

Updates astro from 5.18.1 to 6.1.6

Release notes

Sourced from astro's releases.

astro@6.1.6

Patch Changes

• #16202 b5c2fba Thanks @​matthewp! - Fixes Actions failing with ActionsWithoutServerOutputError when using output: 'static' with an adapter

• #16303 b06eabf Thanks @​matthewp! - Improves handling of special characters in inline <script> content

• #14924 bb4586a Thanks @​aralroca! - Fixes SCSS and CSS module file changes triggering a full page reload instead of hot-updating styles in place during development

astro@6.1.5

Patch Changes

• #16171 5bcd03c Thanks @​Desel72! - Fixes a build error that occurred when a pre-rendered page used the <Picture> component and another page called render() on content collection entries.

• #16239 7c65c04 Thanks @​dataCenter430! - Fixes sync content inside <Fragment> not streaming to the browser until all async sibling expressions have resolved.

• #16242 686c312 Thanks @​martrapp! - Revives UnoCSS in dev mode when used with the client router.

  This change partly reverts #16089, which in hindsight turned out to be too general. Instead of automatically persisting all style sheets, we now do this only for styles from Vue components.

• #16192 79d86b8 Thanks @​alexanderniebuhr! - Uses today’s date for Cloudflare compatibility_date in astro add cloudflare

  When creating new projects, astro add cloudflare now sets compatibility_date to the current date. Previously, this date was resolved from locally installed packages, which could be unreliable in some package manager environments. Using today’s date is simpler and more reliable across environments, and is supported by workerd.

• #16259 34df955 Thanks @​gameroman! - Removed dlv dependency

astro@6.1.4

Patch Changes

• #16197 21f9fe2 Thanks @​SchahinRohani! - Remove unused re-exports from assets/utils barrel file to fix Vite build warning

• #16059 6d5469e Thanks @​matthewp! - Fixes Expected 'miniflare' to be defined errors and 404 responses in dev mode when using the Cloudflare adapter and the config file changes. Instead of creating a brand new Vite server on config changes, Astro now performs a Vite in-place restart, allowing the Cloudflare adapter to reuse its existing miniflare instance across restarts.

• #16154 7610ba4 Thanks @​Desel72! - Fixes pages with dots in their filenames (e.g. hello.world.astro) returning 404 when accessed with a trailing slash in the dev server. The trailingSlashForPath function now only forces trailingSlash: 'never' for endpoints with file extensions, allowing pages to correctly respect the user's trailingSlash config.

• #16193 23425e2 Thanks @​matthewp! - Fixes trailingSlash: "always" producing redirect HTML instead of the actual response for extensionless endpoints during static builds

astro@6.1.3

Patch Changes

• #16161 b51f297 Thanks @​matthewp! - Fixes a dev rendering issue with the Cloudflare adapter where head metadata could be missing and dev CSS/scripts could be injected in the wrong place

• #16110 de669f0 Thanks @​tmimmanuel! - Fixes skew protection query parameters not being appended to inter-chunk JavaScript imports in client bundles, which could cause version mismatches during rolling deployments on Vercel

• #16162 a0a49e9 Thanks @​rururux! - Fixes an issue where HMR would not trigger when modifying files while using @​astrojs/cloudflare with prerenderEnvironment: 'node' enabled.

• #16142 7454854 Thanks @​rururux! - Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using the AstroContainer APIs.

• #16116 12602a9 Thanks @​riderx! - Fixes a bug where page-level CSS could leak between unrelated pages when traversing style parents across top-level route boundaries

... (truncated)

Changelog

Sourced from astro's changelog.

6.1.6

Patch Changes

• #16202 b5c2fba Thanks @​matthewp! - Fixes Actions failing with ActionsWithoutServerOutputError when using output: 'static' with an adapter

• #16303 b06eabf Thanks @​matthewp! - Improves handling of special characters in inline <script> content

• #14924 bb4586a Thanks @​aralroca! - Fixes SCSS and CSS module file changes triggering a full page reload instead of hot-updating styles in place during development

6.1.5

Patch Changes

• #16171 5bcd03c Thanks @​Desel72! - Fixes a build error that occurred when a pre-rendered page used the <Picture> component and another page called render() on content collection entries.

• #16239 7c65c04 Thanks @​dataCenter430! - Fixes sync content inside <Fragment> not streaming to the browser until all async sibling expressions have resolved.

• #16242 686c312 Thanks @​martrapp! - Revives UnoCSS in dev mode when used with the client router.

  This change partly reverts #16089, which in hindsight turned out to be too general. Instead of automatically persisting all style sheets, we now do this only for styles from Vue components.

• #16192 79d86b8 Thanks @​alexanderniebuhr! - Uses today’s date for Cloudflare compatibility_date in astro add cloudflare

  When creating new projects, astro add cloudflare now sets compatibility_date to the current date. Previously, this date was resolved from locally installed packages, which could be unreliable in some package manager environments. Using today’s date is simpler and more reliable across environments, and is supported by workerd.

• #16259 34df955 Thanks @​gameroman! - Removed dlv dependency

6.1.4

Patch Changes

• #16197 21f9fe2 Thanks @​SchahinRohani! - Remove unused re-exports from assets/utils barrel file to fix Vite build warning

• #16059 6d5469e Thanks @​matthewp! - Fixes Expected 'miniflare' to be defined errors and 404 responses in dev mode when using the Cloudflare adapter and the config file changes. Instead of creating a brand new Vite server on config changes, Astro now performs a Vite in-place restart, allowing the Cloudflare adapter to reuse its existing miniflare instance across restarts.

• #16154 7610ba4 Thanks @​Desel72! - Fixes pages with dots in their filenames (e.g. hello.world.astro) returning 404 when accessed with a trailing slash in the dev server. The trailingSlashForPath function now only forces trailingSlash: 'never' for endpoints with file extensions, allowing pages to correctly respect the user's trailingSlash config.

• #16193 23425e2 Thanks @​matthewp! - Fixes trailingSlash: "always" producing redirect HTML instead of the actual response for extensionless endpoints during static builds

6.1.3

Patch Changes

• #16161 b51f297 Thanks @​matthewp! - Fixes a dev rendering issue with the Cloudflare adapter where head metadata could be missing and dev CSS/scripts could be injected in the wrong place

• #16110 de669f0 Thanks @​tmimmanuel! - Fixes skew protection query parameters not being appended to inter-chunk JavaScript imports in client bundles, which could cause version mismatches during rolling deployments on Vercel

• #16162 a0a49e9 Thanks @​rururux! - Fixes an issue where HMR would not trigger when modifying files while using @​astrojs/cloudflare with prerenderEnvironment: 'node' enabled.

... (truncated)

Commits

• 1945a93 [ci] release (#16281)
• bb4586a fix: avoid full-reload in scss modules (#14924)
• 5f3085b [ci] format
• b5c2fba Skip actions server-output validation when an adapter is configured (#16202)
• b06eabf Consolidate inline script escaping into shared utility (#16303)
• 92fc030 refactor(core): rename logger internal types (#16271)
• ba18015 [ci] format
• d198e82 test: port 16 routing unit tests to TypeScript (#16266)
• 673a871 [ci] release (#16244)
• fab9c00 chore: upgrade biome (#16246)
• Additional commits viewable in compare view

Updates vite from 5.4.21 to 6.4.2

Release notes

Sourced from vite's releases.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.2 (2026-04-06)

• fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163
• fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

• feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

• fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

• fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736
• fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735
• test: detect ts support via process.features (#20544) (7d99229), closes #20544

6.3.5 (2025-05-05)

• fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

• fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965
• fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940
• refactor: remove duplicate plugin context type (#19935) (d6d01c2), closes #19935

6.3.3 (2025-04-24)

• fix: ignore malformed uris in tranform middleware (#19853) (e4d5201), closes #19853

... (truncated)

Commits

• 6b3fad0 release: v6.4.2
• ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
• fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
• 5487f4f release: v6.4.1
• 1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
• f12697c release: v6.4.0
• ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
• 0e173d8 release: v6.3.7
• c59a222 fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940)
• 3f337c5 release: v6.3.6
• Additional commits viewable in compare view

Updates uuid from 11.1.0 to 14.0.0

Release notes

Sourced from uuid's releases.

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

• expect crypto to be global everywhere (requires node@20+) (#935)
• drop node@18 support (#934)

Features

• drop node@18 support (#934) (dc4ddb8)

Bug Fixes

• expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
• Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

• rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

• backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

• make browser exports the default (#901)

Bug Fixes

• make browser exports the default (#901) (bce9d72)

v12.0.1

12.0.1 (2026-04-29)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

• Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

• crypto is now expected to be globally defined (requires node@20+) (#935)
• drop node@18 support (#934)
• upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

• make browser exports the default (#901)

Bug Fixes

• make browser exports the default (#901) (bce9d72)

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

• update to typescript@5.2 (#887)
• remove CommonJS support (#886)
• drop node@16 support (#883)

Features

• add node@24 to ci matrix (#879) (42b6178)
• drop node@16 support (#883) (0f38cf1)
• remove CommonJS support (#886) (ae786e2)
• update to typescript@5.2 (#887) (c7ee405)

Bug Fixes

• improve v4() performance (#894) (5fd974c)
• restore node: prefix (#889) (e1f42a3)

Commits

• 7c1ea08 chore(main): release 14.0.0 (#926)
• 3d2c5b0 Merge commit from fork
• f2c235f fix!: expect crypto to be global everywhere (requires node@20+) (#935)
• 529ef08 chore: upgrade TypeScript and fixup types (#927)
• 086fd79 chore: update dependencies (#933)
• dc4ddb8 feat!: drop node@18 support (#934)
• 0f1f9c9 chore: switch to Biome for parsing and linting (#932)
• e2879e6 chore: use maintained version of npm-run-all (#930)
• ffa3138 fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)
• 0423d49 docs: remove obsolete v1 option notes (#915)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Updates @sveltejs/kit from 2.53.4 to 2.57.1

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.57.1

Patch Changes

• fix: better validation for redirect inputs (10d7b44)

• fix: enforce BODY_SIZE_LIMIT on chunked requests (3202ed6)

• fix: use default values as fallbacks (#15680)

• fix: relax form typings for union types (#15687)

@​sveltejs/kit@​2.57.0

Minor Changes

• feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#15530)

Patch Changes

• fix: use array type for select fields that accept multiple values (#15591)

• fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)

• fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#15323)

• fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)

• fix: reimplement treeshaking non-dynamic prerendered remote functions (#15447)

@​sveltejs/kit@​2.56.1

Patch Changes

• chore: update JSDoc (#15640)

@​sveltejs/kit@​2.56.0

Minor Changes

• breaking: rework client-driven refreshes (#15562)

• breaking: stabilize remote function caching by sorting object keys (#15570)

• breaking: add run() method to queries, disallow awaiting queries outside render (#15533)

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.57.1

Patch Changes

• fix: better validati...

  Description has been truncated

  Note
  Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.