chore(deps): bump @angular/core from 21.2.4 to 21.2.6

[dependabot]

Bumps @angular/core from 21.2.4 to 21.2.6.

Release notes

Sourced from @​angular/core's releases.

21.2.6

common

Commit	Description
	avoid redundant image fetch on destroy with auto sizes

compiler

Commit	Description
	prevent shimCssText from adding extra blank lines per CSS comment

core

Commit	Description
	fixes a regression with animate.leave and reordering

migrations

Commit	Description
	inject migration not work in multi-project workspace with option path

21.2.5

compiler

Commit	Description
	ensure generated code compiles
	parse named HTML entities containing digits

compiler-cli

Commit	Description
	escape template literal in TCB
	generic types not filled out correctly in type check block

core

Commit	Description
	clean up dehydrated views during HMR component replacement
	run linked signal equality check without reactive consumer

migrations

Commit	Description
	prevent trailing comma syntax errors after removing NgStyle

service-worker

Commit	Description
	preserve redirect policy on reconstructed asset requests

Changelog

Sourced from @​angular/core's changelog.

21.2.6 (2026-03-25)

common

Commit	Type	Description
b4ab6ba2e8	fix	avoid redundant image fetch on destroy with auto sizes

compiler

Commit	Type	Description
880a57d4b3	fix	prevent shimCssText from adding extra blank lines per CSS comment

core

Commit	Type	Description
ad0156e056	fix	fixes a regression with animate.leave and reordering

migrations

Commit	Type	Description
73d6b01b47	fix	inject migration not work in multi-project workspace with option path

22.0.0-next.4 (2026-03-18)

Breaking Changes

core

• Leave animations are no longer limited to the element being removed.
• ChangeDetectorRef.checkNoChanges was removed. In tests use fixture.detectChanges() instead.

compiler

Commit	Type	Description
412788fac9	fix	ensure generated code compiles
75560ce43d	fix	parse named HTML entities containing digits
d99ab0e040	fix	stop generating unused field

compiler-cli

Commit	Type	Description
2bd708fb6b	fix	escape template literal in TCB
9769560da7	fix	generic types not filled out correctly in type check block
7a0d6b8df2	fix	transform dropping exclamationToken from properties

core

Commit	Type	Description
df659b8d0c	feat	re-introduce nested leave animations scoped to component boundaries
dc3131c639	feat	TestBed.getFixture -> TestBed.getLastFixture and update implementation
dc0446552a	fix	clean up dehydrated views during HMR component replacement
523d69a768	fix	run linked signal equality check without reactive consumer
69fb1614ef	refactor	remove checkNoChanges from the public API.

forms

Commit	Type	Description
3983080236	feat	support ngNoCva as an opt-out for ControlValueAccessors

... (truncated)

Commits

• c157916 build: consolidate domino bundling in platform-server
• 9be5e2c docs: fix typo in Input decorator
• a21be36 refactor: prepare for required changeDetection prop on G3.
• 831746e docs: Add callout about the Component interface.
• ad0156e fix(core): fixes a regression with animate.leave and reordering
• 73d6b01 fix(migrations): inject migration not work in multi-project workspace with op...
• 3838554 build: update cross-repo angular dependencies to v21.2.3
• 851ef77 Revert "refactor(core): Ensure determineLongestAnimation is run synchronously...
• 076d41c fix(migrations): prevent trailing comma syntax errors after removing NgStyle
• a8f80c1 refactor(core): declare explicit reactive node prototypes types
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​angular/​core@​21.2.4 ⏵ 21.2.6			+1
	angular-eslint@​21.3.0
	better-auth@​1.5.6
	eslint@​10.0.3
	cloudflare@​5.2.0
	agents@​0.8.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @zxcvbn-ts/language-common is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → npm/@clerk/clerk-js@6.3.0 → npm/@zxcvbn-ts/language-common@3.0.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zxcvbn-ts/language-common@3.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @zxcvbn-ts/language-common is 95.0% likely obfuscated Confidence: 0.95 Location: Package overview From: pnpm-lock.yaml → npm/@clerk/clerk-js@6.3.0 → npm/@zxcvbn-ts/language-common@3.0.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zxcvbn-ts/language-common@3.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm dijkstrajs License: HPND-sell-MIT-disclaimer-xserver - the applicable license policy does not allow this license (4) (package/LICENSE.md) From: pnpm-lock.yaml → npm/dijkstrajs@1.0.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/dijkstrajs@1.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report