[dependabot]

Bumps the npm_and_yarn group with 19 updates in the /projects/grid-fintech-dock-manager directory:

Package	From	To
@angular/platform-server	22.1.4	22.2.1
@angular/router	22.1.4	22.2.1
@angular/ssr	22.1.6	22.2.5
@hono/node-server	1.19.17	2.1.6
@modelcontextprotocol/sdk	1.30.0	1.32.2
baseline-browser-mapping	2.8.32	2.11.34
body-parser	2.3.0	2.4.0
body-parser	1.20.3	1.20.9
browserslist	4.28.0	4.29.5
dompurify	3.4.13	3.4.17
engine.io	6.6.4	6.6.11
qs	6.13.0	6.16.2
fast-uri	3.1.5	3.1.9
fflate	0.8.2	0.8.3
hono	4.13.1	4.13.16
ip-address	10.5.0	10.7.5
brace-expansion	1.1.12	1.1.21
proxy-addr	2.0.7	2.0.8
socket.io-parser	4.2.4	4.2.7
source-map-js	1.2.1	1.2.2

Bumps the npm_and_yarn group with 19 updates in the /projects/sales-dashboard directory:

Package	From	To
@angular/platform-server	22.1.4	22.2.1
@angular/router	22.1.4	22.2.1
@angular/ssr	22.1.6	22.2.5
@hono/node-server	1.19.17	2.1.6
@modelcontextprotocol/sdk	1.30.0	1.32.2
baseline-browser-mapping	2.8.32	2.11.34
body-parser	2.3.0	2.4.0
body-parser	1.20.3	1.20.9
browserslist	4.28.0	4.29.5
dompurify	3.4.13	3.4.17
engine.io	6.6.4	6.6.11
qs	6.13.0	6.16.2
fast-uri	3.1.5	3.1.9
fflate	0.8.2	0.8.3
hono	4.13.1	4.13.16
ip-address	10.5.0	10.7.5
brace-expansion	1.1.12	1.1.21
proxy-addr	2.0.7	2.0.8
socket.io-parser	4.2.4	4.2.7
source-map-js	1.2.1	1.2.2

Updates @angular/platform-server from 22.1.4 to 22.2.1

Release notes

Sourced from @​angular/platform-server's releases.

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

compiler-cli

Commit	Description
	support extendedConfigCache in readConfiguration

core

Commit	Description
	add debugName on afterRenderEffect
	block dangerous data: and vbscript: URLs in URL sanitizer
	extend data: URL allowlist for non-executable MIME types
	include signal and component name in NG0600 error message
	render error boundary fallbacks after HMR

http

Commit	Description
	forward reportProgress of httpResource as reportDownloadProgress

platform-server

Commit	Description
	reject protocol-relative paths in resolveUrl

router

Commit	Description
	do not copy URL-sized objects into every route snapshot
	fall back when serializing protocol-relative URLs
	limit absolute redirects from redirect functions
	reject duplicate outlets in production builds
	require outlets to match a route before processing child segments
	set initial blocking resource input synchronously on activation
	do not retain UrlTree instances in RouterLink

22.2.0

compiler

Commit	Description
	allow template to access private props
	do not encapsulate nested selectors if parent contains ::ng-deep
	scope nested CSS rules

compiler-cli

... (truncated)

Commits

• 928dcfd fix(platform-server): reject protocol-relative paths in resolveUrl
• d33f2d0 refactor(core): show the enclosing component in the NG0502 hydration error
• 5e621df fix(platform-server): preserve Unicode whitespace in ServerXhr URLs
• 1c91efc fix(core): wait for app stability before cleaning up dehydrated views
• bc3a6cd fix(platform-server): avoid sourcemap corruption during domino path substitution
• d470afa refactor(platform-server): ensure error boundaries work with ssr/hydration (#...
• b3bb36a fix(platform-server): resolve HTTP(S) URLs without authority as relative duri...
• 83f7695 fix(core): throw coded RuntimeErrors instead of crashing when hydration/rende...
• 3e924cc fix(platform-server): avoid stripping unicode whitespace during url resolution
• 732e505 fix(core): replace all hasOwnProperty usages with Object.hasOwn
• Additional commits viewable in compare view

Updates @angular/router from 22.1.4 to 22.2.1

Release notes

Sourced from @​angular/router's releases.

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

compiler-cli

Commit	Description
	support extendedConfigCache in readConfiguration

core

Commit	Description
	add debugName on afterRenderEffect
	block dangerous data: and vbscript: URLs in URL sanitizer
	extend data: URL allowlist for non-executable MIME types
	include signal and component name in NG0600 error message
	render error boundary fallbacks after HMR

http

Commit	Description
	forward reportProgress of httpResource as reportDownloadProgress

platform-server

Commit	Description
	reject protocol-relative paths in resolveUrl

router

Commit	Description
	do not copy URL-sized objects into every route snapshot
	fall back when serializing protocol-relative URLs
	limit absolute redirects from redirect functions
	reject duplicate outlets in production builds
	require outlets to match a route before processing child segments
	set initial blocking resource input synchronously on activation
	do not retain UrlTree instances in RouterLink

22.2.0

compiler

Commit	Description
	allow template to access private props
	do not encapsulate nested selectors if parent contains ::ng-deep
	scope nested CSS rules

compiler-cli

... (truncated)

Commits

• e9bf52a fix(router): require outlets to match a route before processing child segments
• 83abee3 Revert "fix(router): fall back when serializing protocol-relative URLs"
• 3b6796f fix(router): reject duplicate outlets in production builds
• a6e6097 fix(router): fall back when serializing protocol-relative URLs
• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• 8b6dd5e fix(router): limit absolute redirects from redirect functions
• d23932f fix(router): set initial blocking resource input synchronously on activation
• 568d6a8 fix(router): do not copy URL-sized objects into every route snapshot
• 14793bf perf(router): do not retain UrlTree instances in RouterLink
• 83cb045 docs(router): fix UrlHandlingStrategy guide link
• Additional commits viewable in compare view

Updates @angular/ssr from 22.1.6 to 22.2.5

Release notes

Sourced from @​angular/ssr's releases.

22.2.5

@​schematics/angular

Commit	Description
	avoid adding web worker snippet to server configuration files
	ignore non-workspace stylesheet entries when adding Tailwind
	include the SSR entry file in the trust-proxy-headers migration
	include the type separator in the class spec import
	keep the default getter access type of spyOnProperty in refactor-jasmine-vitest
	migrate CallInfo returnValue and object in refactor-jasmine-vitest
	migrate spy.calls.first().args in refactor-jasmine-vitest
	set explicit type for the module --route component
	set explicit type for the app-shell component

@​angular/cli

Commit	Description
	explain how to pick a project when a schematic cannot determine one
	handle bun registry error output and 404 detection
	support resolving subproject dependencies in bun workspaces

@​angular-devkit/build-angular

Commit	Description
	resolve dev-server sslKey and sslCert relative to the workspace root (#34399)

@​angular-devkit/core

Commit	Description
	only invoke smart default provider when value is undefined

@​angular-devkit/schematics

Commit	Description
	support delegating trees in partition (#34539)
	support delegating trees in the filter rule (#34539)

@​angular/build

Commit	Description
	escape prerender redirect URLs
	include the oxc-parser WASI binding as an optional dependency
	only require karma-coverage when coverage is enabled
	resolve dev-server sslKey and sslCert relative to the workspace root (#34399)
	serialize server manifest asset paths
	suggest the istanbul provider in the unit-test V8 browser coverage error
	warn about unsupported options in the unit-test karma runner
	write the stats file in a stable, deterministic order
	avoid duplicate Domino bundling in server bundles
	avoid web worker channel overhead in library parallel compilation

@​angular/ssr

Commit	Description
	preserve trailing slashes in query and fragment of redirect URLs

... (truncated)

Changelog

Sourced from @​angular/ssr's changelog.

22.2.5 (2026-10-28)

@​angular/cli

Commit	Type	Description
7efeeb9caa	fix	explain how to pick a project when a schematic cannot determine one
ee61e328ac	fix	handle bun registry error output and 404 detection
0d8898c289	fix	support resolving subproject dependencies in bun workspaces

@​schematics/angular

Commit	Type	Description
982c3dcbfc	fix	avoid adding web worker snippet to server configuration files
18e5dc6fe8	fix	ignore non-workspace stylesheet entries when adding Tailwind
dd18bda9db	fix	include the SSR entry file in the trust-proxy-headers migration
b7e24561e7	fix	include the type separator in the class spec import
7f3840c70c	fix	keep the default getter access type of spyOnProperty in refactor-jasmine-vitest
eaf2343be4	fix	migrate CallInfo returnValue and object in refactor-jasmine-vitest
6680d289cb	fix	migrate spy.calls.first().args in refactor-jasmine-vitest
9cba0da43f	fix	set explicit type for the module --route component
e9ae950364	fix	set explicit type for the app-shell component

@​angular-devkit/build-angular

Commit	Type	Description
0c4bd19ace	fix	resolve dev-server sslKey and sslCert relative to the workspace root (#34399)

@​angular-devkit/core

Commit	Type	Description
ad04d689bb	fix	only invoke smart default provider when value is undefined

@​angular-devkit/schematics

Commit	Type	Description
e7fd1bd9cb	fix	support delegating trees in partition (#34539)
1854c1714d	fix	support delegating trees in the filter rule (#34539)

@​angular/build

Commit	Type	Description
6d45d1007f	fix	escape prerender redirect URLs
6298fb89e6	fix	include the oxc-parser WASI binding as an optional dependency
325f6a0f48	fix	only require karma-coverage when coverage is enabled

... (truncated)

Commits

• 9e8eea0 release: cut the v22.2.5 release
• e3134b4 fix(@​angular/build): warn about unsupported options in the unit-test karma ru...
• 199775b build: update dependency webpack-dev-middleware to v8.5.0
• 7efeeb9 fix(@​angular/cli): explain how to pick a project when a schematic cannot dete...
• 6298fb8 fix(@​angular/build): include the oxc-parser WASI binding as an optional depen...
• 7f3840c fix(@​schematics/angular): keep the default getter access type of spyOnPropert...
• 325f6a0 fix(@​angular/build): only require karma-coverage when coverage is enabled
• e7fd1bd fix(@​angular-devkit/schematics): support delegating trees in partition (#34...
• 1854c17 fix(@​angular-devkit/schematics): support delegating trees in the filter rul...
• 9701ae9 docs(@​angular-devkit/build-angular): correct browser-esbuild statsJson descri...
• Additional commits viewable in compare view

Updates @hono/node-server from 1.19.17 to 2.1.6

Release notes

Sourced from @​hono/node-server's releases.

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

---

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.1.5

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in honojs/node-server#404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in honojs/node-server#405

New Contributors

• @​affanmomin made their first contribution in honojs/node-server#404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in honojs/node-server#406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

... (truncated)

Commits

• 123f782 2.1.6
• cfaa79f Merge commit from fork
• 61cc026 Merge commit from fork
• a152a45 test: wait for the first chunk before sending the second in the readable-stre...
• fb97395 Merge commit from fork
• 4b47a0d 2.1.5
• e77824a fix(serve-static): only serve GET and HEAD requests (#405)
• 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
• d57ed9b 2.1.4
• 92b014c chore: allow hono v5 as a peer dependency (#406)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

• fix: add explicit | undefined to Transport optional properties (v1.x backport of #1766) by @​kishormorol in modelcontextprotocol/typescript-sdk#2814
• [v1.x] fix: allow registering after connect() when the capability was declared by @​claude[bot] in modelcontextprotocol/typescript-sdk#2958
• chore: bump version to 1.32.2 by @​claude[bot] in modelcontextprotocol/typescript-sdk#3089

New Contributors

• @​kishormorol made their first contribution in modelcontextprotocol/typescript-sdk#2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

1.32.1

What's Changed

• [v1.x] docs: state the principles in CLAUDE.md by @​claude[bot] in modelcontextprotocol/typescript-sdk#2939
• [v1.x] docs: point the README at v2 and say what v1.x supports by @​claude[bot] in modelcontextprotocol/typescript-sdk#2942
• chore: bump version to 1.32.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in modelcontextprotocol/typescript-sdk#2902
• docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in modelcontextprotocol/typescript-sdk#2910
• [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in modelcontextprotocol/typescript-sdk#2914
• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in modelcontextprotocol/typescript-sdk#2925
• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2927
• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in modelcontextprotocol/typescript-sdk#2045
• [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in modelcontextprotocol/typescript-sdk#2930
• [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2931
• chore: bump version to 1.32.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2935

New Contributors

• @​raashish1601 made their first contribution in modelcontextprotocol/typescript-sdk#2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

• Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
• Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

• [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @​maxisbey in modelcontextprotocol/typescript-sdk#2888
• chore: bump version to 1.31.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2890

... (truncated)

Commits

• 3b73021 chore: bump version to 1.32.2 (#3089)
• fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
• 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
• ff07b00 chore: bump version to 1.32.1 (#2954)
• 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
• a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
• 32549b0 chore: bump version to 1.32.0 (#2935)
• 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
• 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
• 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
• Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.8.32 to 2.11.34

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.0

What's Changed

• Introduces support for Node 6 by refactoring all Object.entries and Object.values instances and lowering ES target in Rollup to es2015.
• Adds specified Node version support in package.json for >=6.0.0.
• Refactors CLI code to avoid parseArgs which is not supported by versions of Node prior to 18, changes import to require and changes Rollup export to cjs to allow execution on older versions of Node.
• Adds a new legacy-test.js file that allows basic testing on older versions of Node where current versions of Jasmine and ESLint are not supported.
• Adds a test matrix to run tests on all even-numbered Node versions from 6 to 24.
• refactor publish workflows to support NPM's new OIDC integration

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.24...v2.10.0

v2.9.3 - remove process.loadEnvFile()

What's Changed

• Remove process.loadEnfFile() from main script by @​tonypconway in web-platform-dx/baseline-browser-mapping#112

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.2...v2.9.3

v2.9.2 - fix browser support bug

What's Changed

• Fix browser support bug by @​tonypconway in web-platform-dx/baseline-browser-mapping#111 Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.1...v2.9.2

v2.9.0 - Reduce frequency of data staleness warnings

This version introduces a number of changes to data staleness warnings in response to #105 , #107 and #109

• Data staleness warnings are now only shown if the getCompatibleVersions() or getAllVersions() functions are called - previously they were shown whenever the module was loaded, which meant many browserslist consumers were seeing the warning despite not targeting Baseline, especially those who were consuming browserslist in a pre-compiled format via next.js.
• Adds new conditions for these warnings to be displayed which should only warn users for whom data freshness is critical:
  • The feature cut off data must be within the last two months, i.e. widelyAvailableOnDate: today + >2 years and 4 months or newly available in a browserslist query.
  • The module data must be more than 2 months old.
• Introduces suppression options for these warning via the options objects and environment variables:
  • Adds a new suppressWarnings boolean to the getCompatibleVersions() and getAllVersions()
  • Respects the existing BROWSERSLIST_IGNORE_OLD_DATA environment variable.
  • Respects a new BASELINE_BROWSER_MAPPING_IGNORE_OLD_DATA environment variable.
• Adds explanatory text to the README for how to avoid such warnings when reproducible builds are a requirement.
• Change warning text to be package manager agnostic and mention the possibility of pre-compiled data.

Commits

• 4a311c7 Patch to 2.11.34 because browser or feature data changed
• cadd64d Browser or feature data changed
• 7439261 Updating static site
• 47dde6e Patch to 2.11.33 because browser or feature data changed
• 7d23626 Browser or feature data changed
• 107852a Updating static site
• b010b39 Patch to 2.11.32 because browser or feature data changed
• b41f5fb Browser or feature data changed
• b1b7b47 Updating static site
• 22ea69a Patch to 2.11.31 because browser o...

  Description has been truncated