Bump @angular/core, @angular/animations, @angular/cdk, @angular/common, @angular/forms, @angular/material, @angular/platform-browser, @angular/platform-browser-dynamic, @angular/router and @angular/build in /samples/openai-acs-msgraph/client

[dependabot]

Bumps @angular/core, @angular/animations, @angular/cdk, @angular/common, @angular/forms, @angular/material, @angular/platform-browser, @angular/platform-browser-dynamic, @angular/router and @angular/build. These dependencies needed to be updated together.
Updates @angular/core from 20.2.4 to 22.0.1

Release notes

Sourced from @​angular/core's releases.

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

Commit	Description
	disable WebMCP during SSR
	Handle synchronous errors in PendingTasks.run function
	harden TransferState restoration against DOM clobbering
	prevent dangling prevConsumer reference from leaking destroyed views (#68681)
	require WebMCP tool descriptions
	update comment for Default change detection
	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
	validate lowercase SVG animation attribute names

forms

Commit	Description
	delay mcp reading the form model by a tick
	harden FormGroup control lookups against prototype shadowing
	remove animationstart listener on component destroy to prevent memory leak
	set additionalProperties: false on generated WebMCP form

http

Commit	Description
	ensure query parameters are inserted before URL fragments
	pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit	Description
	prevent external template inlay hints from appearing in TS files

platform-server

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

22.0.1 (2026-06-10)

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)

common

Commit	Type	Description
c4b5fa3c92	fix	escape CSS string-terminating characters in escapeCssUrl
dfff57ede9	fix	Limits date format string length
3c2892c8df	fix	prevent prototype pollution in formatDateTime
1d87c49f6e	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
1ee224ca30	fix	disallow i18n event attributes
a56f1cdf8f	fix	more robust logic to check if regex can be optimized
5946c18275	fix	sanitize href/xlink:href attributes of any element of the MathML namespace
393b84caf8	fix	sanitize two-way properties

compiler-cli

Commit	Type	Description
3d9ca2f173	fix	bind switch exhaustive check expressions

core

Commit	Type	Description
669146b0e7	fix	disable WebMCP during SSR
562a566ead	fix	Handle synchronous errors in PendingTasks.run function
fa546f382d	fix	harden TransferState restoration against DOM clobbering
29fdb98684	fix	prevent dangling prevConsumer reference from leaking destroyed views (#68681)
cdcea80327	fix	require WebMCP tool descriptions
4289c4c840	fix	update comment for Default change detection
3dd433b39a	fix	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
045bb736b3	fix	validate lowercase SVG animation attribute names

forms

Commit	Type	Description
11836a670a	fix	delay mcp reading the form model by a tick
85d2d100e3	fix	harden FormGroup control lookups against prototype shadowing
e51ad374ea	fix	remove animationstart listener on component destroy to prevent memory leak
55b7b5a6b6	fix	set additionalProperties: false on generated WebMCP form

http

Commit	Type	Description
ffb06c0514	fix	ensure query parameters are inserted before URL fragments
2dd65d21e6	fix	pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
4254eb416c	fix	preserve empty referrer option in HttpRequest
167bd4c162	fix	Rejects non-HTTP(S) URLs in JSONP requests

language-service

| Commit | Type | Description |

... (truncated)

Commits

• 4b0c3b8 refactor(core): Update registerNgModuleType to support codegen typechecking
• dbf64c8 test(core): fix AI tools test flake
• 045bb73 fix(core): validate lowercase SVG animation attribute names
• 1ee224c fix(compiler): disallow i18n event attributes
• 5946c18 fix(compiler): sanitize href/xlink:href attributes of any element of the ...
• b1f02eb refactor(core): add internal utility
• 85d2d10 fix(forms): harden FormGroup control lookups against prototype shadowing
• 6e3d51d refactor(migrations): Improve safeNavigationMigration heuristic
• 01ea640 refactor(core): Fix DirectiveDefinition interface to allow abstract classes
• a704b08 docs: add Signal Forms and v22 guidance to AI best-practices and llms.txt
• Additional commits viewable in compare view

Updates @angular/animations from 20.2.4 to 22.0.1

Release notes

Sourced from @​angular/animations's releases.

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

Commit	Description
	disable WebMCP during SSR
	Handle synchronous errors in PendingTasks.run function
	harden TransferState restoration against DOM clobbering
	prevent dangling prevConsumer reference from leaking destroyed views (#68681)
	require WebMCP tool descriptions
	update comment for Default change detection
	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
	validate lowercase SVG animation attribute names

forms

Commit	Description
	delay mcp reading the form model by a tick
	harden FormGroup control lookups against prototype shadowing
	remove animationstart listener on component destroy to prevent memory leak
	set additionalProperties: false on generated WebMCP form

http

Commit	Description
	ensure query parameters are inserted before URL fragments
	pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit	Description
	prevent external template inlay hints from appearing in TS files

platform-server

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/animations's changelog.

22.0.1 (2026-06-10)

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)

common

Commit	Type	Description
c4b5fa3c92	fix	escape CSS string-terminating characters in escapeCssUrl
dfff57ede9	fix	Limits date format string length
3c2892c8df	fix	prevent prototype pollution in formatDateTime
1d87c49f6e	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
1ee224ca30	fix	disallow i18n event attributes
a56f1cdf8f	fix	more robust logic to check if regex can be optimized
5946c18275	fix	sanitize href/xlink:href attributes of any element of the MathML namespace
393b84caf8	fix	sanitize two-way properties

compiler-cli

Commit	Type	Description
3d9ca2f173	fix	bind switch exhaustive check expressions

core

Commit	Type	Description
669146b0e7	fix	disable WebMCP during SSR
562a566ead	fix	Handle synchronous errors in PendingTasks.run function
fa546f382d	fix	harden TransferState restoration against DOM clobbering
29fdb98684	fix	prevent dangling prevConsumer reference from leaking destroyed views (#68681)
cdcea80327	fix	require WebMCP tool descriptions
4289c4c840	fix	update comment for Default change detection
3dd433b39a	fix	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
045bb736b3	fix	validate lowercase SVG animation attribute names

forms

Commit	Type	Description
11836a670a	fix	delay mcp reading the form model by a tick
85d2d100e3	fix	harden FormGroup control lookups against prototype shadowing
e51ad374ea	fix	remove animationstart listener on component destroy to prevent memory leak
55b7b5a6b6	fix	set additionalProperties: false on generated WebMCP form

http

Commit	Type	Description
ffb06c0514	fix	ensure query parameters are inserted before URL fragments
2dd65d21e6	fix	pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
4254eb416c	fix	preserve empty referrer option in HttpRequest
167bd4c162	fix	Rejects non-HTTP(S) URLs in JSONP requests

language-service

| Commit | Type | Description |

... (truncated)

Commits

• a97d5ec build: update minimum supported Node.js versions
• ad717df refactor(core): use the @Service decorator where possible.
• b8d3f36 feat(compiler-cli): add support for Node.js 26.0.0
• 6672192 test: remove duplicate tests (#67518)
• d550bf7 build: update minimum supported Node.js versions
• 81cabc1 feat(core): add support for TypeScript 6
• abb1794 refactor(core): mark VERSION exports as pure for better tree-shaking
• 26fed34 build: format md files
• b9e2ccd refactor(common): remove unused import (#64699)
• 70332b0 fix(core): pass element removal property through in all locations (#64565)
• Additional commits viewable in compare view

Updates @angular/cdk from 20.2.2 to 22.0.1

Release notes

Sourced from @​angular/cdk's releases.

22.0.1

youtube-player

Commit	Description
	avoid errors with clobbered variables
	validate ID before attaching them to placeholder

material

Commit	Description
	dialog: ignore clicks on aria-disabled close buttons (#33373)
	timepicker: do not allow intervals less than a second (#33354)

cdk

Commit	Description
	a11y: avoid prototype conflicts in id generator (#33356)
	clipboard: avoid infinite attempt loop (#33366)

aria

Commit	Description
	combobox: avoid error for synthetic events (#33360)
	combobox: prevent re-dispatching keyboard event on control target change (#33362)
	tree: recursive textDirection getter (#33337)

22.0.0

aria

Commit	Description
	accordion: introduce accordion harness (#33046)
	combobox: add test harnesses (#33194)
	combobox: migrate simple-combobox directly into primary entrypoints (#33206)
	grid: add test harnesses (#33081)
	listbox: introduce listbox harness (#33064)
	menu: introduce menu harness (#33067)
	tabs: add test harnesses (#33079)
	toolbar: add test harnesses (#33068)
	tree: add test harnesses (#33066)
	combobox: increases autocomplete demo's placeholder text c… (#33084)
	combobox: separates placeholder prefixes (#33163)
	menu: allow menu item role override (#33264)
	menu: defer menu item focus in case menus in cdk overlay (#33258)
	menu: unable to set softDisabled (#33265)

cdk

Commit	Description
	dialog: add the ability to pass bindings
	portal: add directives support to ComponentPortal (#33142)
	a11y: breaking changes for v22
	drag-drop: breaking changes for v22
	menu: breaking changes for v22
	scrolling: make it easier to provide custom scrollable (#33269)

... (truncated)

Changelog

Sourced from @​angular/cdk's changelog.

22.0.1 "argon-apple" (2026-06-10)

aria

Commit	Type	Description
7581b0592	fix	combobox: avoid error for synthetic events (#33360)
1c4706155	fix	combobox: prevent re-dispatching keyboard event on control target change (#33362)
96e9ce10c	fix	tree: recursive textDirection getter (#33337)

cdk

Commit	Type	Description
629aea403	fix	a11y: avoid prototype conflicts in id generator (#33356)
49aeb676c	fix	clipboard: avoid infinite attempt loop (#33366)

material

Commit	Type	Description
d7a8cb963	fix	dialog: ignore clicks on aria-disabled close buttons (#33373)
bde3c7621	fix	timepicker: do not allow intervals less than a second (#33354)

youtube-player

Commit	Type	Description
d75a22d69	fix	avoid errors with clobbered variables
fe0a96ce6	fix	validate ID before attaching them to placeholder

22.0.0 "aurostibite-ambulance" (2026-06-03)

Breaking Changes

aria

• The legacy combobox and autocomplete implementations have been removed. Use the new standalone combobox instead.

  • feat(aria/combobox): promote simple-combobox to stable un-prefixed combobox
  • Relocates public, private, and example directories to clean combobox entry points.
  • Renames internal layout symbols, selectors, and uppercase tokens (SIMPLE_COMBOBOX_POPUP -> COMBOBOX_POPUP).
  • Establishes full documentation extraction parity with the json_api Bazel rule target.
  • Standardizes the accompanying toolbar component showcase into the clean aria-toolbar path.
  • Re-routes dev-app navigation links and migrates public API golden records.

• SimpleCombobox has been promoted to Combobox. All simple-combobox prefixed symbols, selectors, and tokens have been renamed to use the combobox prefix.

  • refactor(aria/combobox): relocate and restructure autocomplete and toolbar examples Relocate the autocomplete examples to src/components-examples/aria/autocomplete and toolbar examples to src/components-examples/aria/toolbar.
  • Restore naming continuity with the historical codebase by stripping redundant prefixes from example filenames and component selectors.
  • Sync dev-app preview routing layout paths and strict Bazel target dependency links.

cdk

• • CDK_DESCRIBEDBY_HOST_ATTRIBUTE has been removed.
  • CDK_DESCRIBEDBY_ID_PREFIX has been removed.
  • The injector parameter of the ConfigurableFocusTrap and FocusTrap constructors is now required.
  • The boolean parameter of ConfigurableFocusTrapFactory.create has been replaced with a config object.
  • MESSAGES_CONTAINER_ID has been removed.

... (truncated)

Commits

• 75f6542 release: cut the v22.0.1 release
• d7a8cb9 fix(material/dialog): ignore clicks on aria-disabled close buttons (#33373)
• 49aeb67 fix(cdk/clipboard): avoid infinite attempt loop (#33366)
• 5a5f6eb build: update cross-repo angular dependencies (#33326)
• ae48b2c docs(cdk/dialog): improve dialog example contrast (#33334)
• 1a68d18 build: update pnpm to v10.34.1 (#33316)
• c696e41 build: lock file maintenance (#33331)
• d84dca2 build: update all github actions (#33348)
• da17b4c build: update bazel dependencies to v3.2.1 (#33350)
• 7a8b3f7 docs(aria/menu): fix menubar example highlight styling (#33290)
• Additional commits viewable in compare view

Updates @angular/common from 20.2.4 to 22.0.1

Release notes

Sourced from @​angular/common's releases.

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

Commit	Description
	disable WebMCP during SSR
	Handle synchronous errors in PendingTasks.run function
	harden TransferState restoration against DOM clobbering
	prevent dangling prevConsumer reference from leaking destroyed views (#68681)
	require WebMCP tool descriptions
	update comment for Default change detection
	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
	validate lowercase SVG animation attribute names

forms

Commit	Description
	delay mcp reading the form model by a tick
	harden FormGroup control lookups against prototype shadowing
	remove animationstart listener on component destroy to prevent memory leak
	set additionalProperties: false on generated WebMCP form

http

Commit	Description
	ensure query parameters are inserted before URL fragments
	pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit	Description
	prevent external template inlay hints from appearing in TS files

platform-server

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

22.0.1 (2026-06-10)

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)

common

Commit	Type	Description
c4b5fa3c92	fix	escape CSS string-terminating characters in escapeCssUrl
dfff57ede9	fix	Limits date format string length
3c2892c8df	fix	prevent prototype pollution in formatDateTime
1d87c49f6e	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
1ee224ca30	fix	disallow i18n event attributes
a56f1cdf8f	fix	more robust logic to check if regex can be optimized
5946c18275	fix	sanitize href/xlink:href attributes of any element of the MathML namespace
393b84caf8	fix	sanitize two-way properties

compiler-cli

Commit	Type	Description
3d9ca2f173	fix	bind switch exhaustive check expressions

core

Commit	Type	Description
669146b0e7	fix	disable WebMCP during SSR
562a566ead	fix	Handle synchronous errors in PendingTasks.run function
Description has been truncated

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​angular/​animations@​20.2.4 ⏵ 22.0.1				-45
	npm/​@​angular/​platform-browser-dynamic@​20.2.4 ⏵ 22.0.1	+1			+1
	npm/​@​angular/​platform-browser@​20.2.4 ⏵ 22.0.1				+2
	npm/​@​angular/​router@​20.2.4 ⏵ 22.0.1				+2
	npm/​@​angular/​forms@​20.2.4 ⏵ 22.0.1	+1		+1	+2
	npm/​@​angular/​build@​20.2.2 ⏵ 22.0.1	-15		+1	+1
	npm/​@​angular/​cdk@​20.2.2 ⏵ 22.0.1				+2
	npm/​@​angular/​core@​20.2.4 ⏵ 22.0.1		+40	-1	+2
	npm/​@​angular/​common@​20.2.4 ⏵ 22.0.1	+1	+16		+2
	npm/​@​angular/​material@​20.2.2 ⏵ 22.0.1	+1		+1	+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @angular/build is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: samples/openai-acs-msgraph/client/package-lock.json → npm/@angular/build@22.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@angular/build@22.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm htmlparser2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: samples/openai-acs-msgraph/client/package-lock.json → npm/@angular/build@22.0.1 → npm/htmlparser2@10.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/htmlparser2@10.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm lmdb is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: samples/openai-acs-msgraph/client/package-lock.json → npm/@angular/build@22.0.1 → npm/lmdb@3.5.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lmdb@3.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report