Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @​styfle and @​lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

• fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

• d7b012d v15.5.14
• 2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
• f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
• cfd5f53 v15.5.13
• 15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
• d23f41c v15.5.12
• 8e75765 fix unlock in publish-native
• 6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
• 7a94645 Apply needs for publishRelease
• bbfd4e3 v15.5.11
• Additional commits viewable in compare view

Sourced from fast-xml-parser's releases.

fix bugs of entity parsing and value parsing

fix: entity expansion limits update strnum package to 2.2.0

fix entity expansion and incorrect replacement and performance

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.5...v5.5.6

support onDangerousProperty

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.3...v5.5.5

update dependecies to fix typings

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.1...v5.5.2

integrate path-expression-matcher

• support path-expression-matcher
• fix: stopNode should not be parsed
• performance improvement for stopNode checking

Separate Builder

XML Builder was the part of fast-xml-parser for years. But considering that any bug in builder may false-alarm the users who are only using parser and vice-versa, we have decided to split it into a separate package.

Migration

To migrate to fast-xml-builder;

From

import { XMLBuilder } from "fast-xml-parser";

To

import  XMLBuilder  from "fast-xml-builder";

XMLBuilder will be removed from current package in any next major version of this library. So better to migrate.

support strictReservedNames

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.9...v5.3.9

handle non-array input for XML builder && support maxNestedTags

• support maxNestedTags
• handle non-array input for XML builder when preserveOrder is true (By Angelo Coetzee)
• save use of js properies Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.7...v5.3.8

CJS typing fix

What's Changed

• Unexport X2jOptions at declaration site by @​Drarig29 in NaturalIntelligence/fast-xml-parser#787

... (truncated)

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.5.9 / 2026-03-23

• combine typing files

4.5.5 / 2026-03-22

apply fixes from v5 (legacy maintenance branch v4-maintenance)

• support maxEntityCount
• support onDangerousProperty
• support maxNestedTags
• handle prototype pollution
• fix incorrect entity name replacement
• fix incorrect condition for entity expansion

5.5.8 / 2026-03-20

• pass read only matcher in callback

5.5.7 / 2026-03-19

• fix: entity expansion limits
• update strnum package to 2.2.0

5.5.6 / 2026-03-16

• update builder dependency
• fix incorrect regex to replace . in entity name
• fix check for entitiy expansion for lastEntities and html entities too

5.5.5 / 2026-03-13

• sanitize dangerous tag or attribute name
• error on critical property name
• support onDangerousProperty option

5.5.4 / 2026-03-13

• declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

5.5.3 / 2026-03-11

• upgrade builder

5.5.2 / 2026-03-11

• update dependency to fix typings

5.5.1 / 2026-03-10

• fix dependency

... (truncated)

• a21c441 update package detail
• 239b64a check for min value for entity exapantion options
• 61cb666 restrict more properties to be unsafe
• 41abd66 performance improvement of reading DOCTYPE
• 3dfcd20 refactor: performance improvement
• 870043e update release info
• 6df401e update builder dependency
• bd26122 check for entitiy expansion for lastEntities and html entities too
• 7e70dd8 fix incorrect regex to replace . in entity name
• e54155f update package info
• Additional commits viewable in compare view

Sourced from file-type's releases.

v21.3.2

• Fix ZIP bomb in known-size ZIP probing (GHSA-j47w-4g3g-c36v) a155cd7
• Fix bound recursive BOM and ID3 detection 370ed91

---

sindresorhus/file-type@v21.3.1...v21.3.2

v21.3.1

• Fix infinite loop in ASF parser on malformed input (GHSA-5v7r-6r5c-r473) 319abf8

---

sindresorhus/file-type@v21.3.0...v21.3.1

v21.3.0

• Add support for Mach-O Universal (aka "Fat") binaries and additional architectures (#779) d223491

---

sindresorhus/file-type@v21.2.0...v21.3.0

v21.2.0

• Add support for SPSS data files (#787) 889f638
• Add support for JMP (#784) 093dba0

---

sindresorhus/file-type@v21.1.1...v21.2.0

v21.1.1

• Fix handling of partial Gunzip file (#783) 710e053

---

sindresorhus/file-type@v21.1.0...v21.1.1

v21.1.0

• Add support for .tar.gz (gunzipped tarball file) (#763) eda03a7
• Add support for Windows registry (.reg) files 0db61ec 7d2ddcf
• Add support for Windows registry hive file (.dat) (#767) f8d62be
• Fix: Handle partial unzip (#773) 7ad3a90

---

sindresorhus/file-type@v21.0.0...v21.1.0

v21.0.0

Breaking

... (truncated)

• e18028c 21.3.2
• a155cd7 Fix ZIP bomb in known-size ZIP probing
• 6954817 Harden parser more
• 370ed91 Fix bound recursive BOM and ID3 detection
• d2ecea1 Add a few more safeguards
• 41fcff5 Update readme
• a8f6934 Fix CI
• ad5857e 21.3.1
• 5d2fedf Harden parser
• 319abf8 Fix infinite loop in ASF parser on malformed input
• Additional commits viewable in compare view

Sourced from yaml's releases.

v2.8.3

• Add trailingComma ToString option for multiline flow formatting (#670)
• Catch stack overflow during node composition (1e84ebb)

v2.8.2

• Serialize -0 as -0 (#638)
• Do not double newlines for empty map values (#642)

v2.8.1

• Preserve empty block literals (#634)

• ce14587 2.8.3
• 1e84ebb fix: Catch stack overflow during node composition
• 6b24090 ci: Include Prettier check in lint action
• 9424dee chore: Refresh lockfile
• d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
• 4321509 ci: Drop the branch filter from GitHub PR actions
• 47207d0 chore: Update docs-slate
• 5212fae chore: Update docs-slate
• 086fa6b 2.8.2
• 95f01e9 chore: Add funding to package.json
• Additional commits viewable in compare view

Sourced from astro's releases.

astro@5.18.1

Patch Changes

• Updated dependencies [c2cd371]:
  • @​astrojs/internal-helpers@​0.7.6
  • @​astrojs/markdown-remark@​6.3.11

Sourced from astro's changelog.

5.18.1

Patch Changes

• Updated dependencies [c2cd371]:
  • @​astrojs/internal-helpers@​0.7.6
  • @​astrojs/markdown-remark@​6.3.11

5.18.0

Minor Changes

• #15589 b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

  This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

  If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.

  // astro.config.mjs
  export default defineConfig({
    security: {
      actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
    },
  });

Patch Changes

• #15594 efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.

5.17.3

Patch Changes

• #15564 522f880 Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

• #15569 e01e98b Thanks @​matthewp! - Respect image allowlists when inferring remote image sizes and reject remote redirects.

5.17.2

Patch Changes

• c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies

5.17.1

Patch Changes

• #15334 d715f1f Thanks @​florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API only

... (truncated)

• 434d9cc [ci] release (#15829)
• c2cd371 fix(helpers): Backport remote patterns segments fix (#15828)
• 011f061 [ci] release (#15597)
• efae11c fix: X-Forwarded-Proto rejected when allowedDomains includes protocol… (#15594)
• 751ccf0 Update actionBodySizeLimit changeset and make minor (#15600)
• b7dd447 make actionBodySizeLimit configurable (#15589)
• e0f1a2b [ci] release (#15571)
• 522f880 Limit action request body size (#15564)
• 436962a chore: Upgrade Vite and esbuild (#15554)
• e01e98b Respect remote image allowlists (#15569)
• Additional commits viewable in compare view

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.

Sourced from @​angular/core's releases.

21.2.4

compiler

Commit	Description
	disallow translations of iframe src

core

Commit	Description
	reverts "feat(core): add support for nested animations"
	sanitize translated form attributes

VSCode Extension: 21.2.3

This release contains internal refactorings only.

21.2.3

core

Commit	Description
	ensure definitions compile
	include signal debug names in their toString() representation
	sanitize translated attribute bindings with interpolations

VSCode Extension: 21.2.2

• fix(extension): bundle TypeScript 5.9 internally (da57d1af73)

21.2.2

compiler

Commit	Description
	prevent mutation of children array in RecursiveVisitor

compiler-cli

Commit	Description
	always parenthesize object literals in TCB
	ignore generated ngDevMode signal branch for code coverage

forms

Commit	Description
	add 'blur' option to debounce rule

VSCode Extension: 21.2.1

• perf(language-service): use lightweight project warmup for Angular analysis (d2137928e8)

21.2.1

core

Commit	Description
	adds transfer cache to httpResource to fix hydration
	prevent child animation elements from being orphaned
	Prevent removal of elements during drag and drop

... (truncated)

Sourced from @​angular/core's changelog.

21.2.4 (2026-03-12)

compiler

Commit	Type	Description
ed2d324f9c	fix	disallow translations of iframe src

core

Commit	Type	Description
abbd8797bb	fix	reverts "feat(core): add support for nested animations"
d1dcd16c5b	fix	sanitize translated form attributes

22.0.0-next.2 (2026-03-11)

Breaking Changes

core

• createNgModuleRef was removed, use createNgModule instead

core

Commit	Type	Description
b918beda32	feat	allow debouncing signals
f9ede9ec98	fix	ensure definitions compile
b401c18674	fix	include signal debug names in their toString() representation
8630319f74	fix	sanitize translated attribute bindings with interpolations
36936872c9	refactor	remove createNgModuleRef

forms

Commit	Type	Description
3e7ce0dafc	fix	restrict SignalFormsConfig to a readonly API

language-service

Commit	Type	Description
5a6d88626b	feat	add angular template inlay hints support

21.2.3 (2026-03-11)

core

Commit	Type	Description
62a97f7e4b	fix	ensure definitions compile
21b1c3b2ee	fix	include signal debug names in their toString() representation
224e60ecb1	fix	sanitize translated attribute bindings with interpolations

21.2.2 (2026-03-09)

... (truncated)

• d1dcd16 fix(core): sanitize translated form attributes
• abbd879 fix(core): reverts "feat(core): add support for nested animations"
• 7907e98 test: remove duplicate tests
• 21b1c3b fix(core): include signal debug names in their toString() representation
• 6c73aac refactor(common): Removes unused generic type parameters from KeyValueDiffers
• c98eab7 refactor(core): remove old resource params
• 7513558 docs: combine multiple documentation improvements into one PR
• 575f302 refactor(core): interface cleanup
• 224e60e fix(core): sanitize translated attribute bindings with interpolations
• 09638ec docs(core): clarify provideZoneChangeDetection usage in v21+
• Additional commits viewable in compare view

Sourced from @​angular/ssr's releases.

21.2.3

@​angular/cli

Commit	Description
	use parsed package name for migrate-only updates

@​angular/build

Commit	Description
	alias createRequire banner import to avoid duplicate binding
	only use external packages for polyfills when no local files are present

@​angular/ssr

Commit	Description
	disallow x-forwarded-prefix starting with a backslash
	ensure unique values in redirect response Vary header
	support custom headers in redirect responses

21.2.2

@​angular/cli

Commit	Description
	conditionally quote package names when adding dependencies based on host requirements
	preserve exact version in ng add when requested
	avoid redundant package version resolution in ng add

@​angular/build

Commit	Description
	allow any CHROME_BIN for vitest playwright provider
	normalize line endings for CSP hash generation
	pass process environment variables to prerender workers
	resolve assets correctly during i18n prerendering

21.2.1

@​schematics/angular

Commit	Description
	prevent adding test dependencies when minimal option is enabled

@​angular/cli

Commit	Description
	correct dev dependency detection logic in ng add
	disable npm update notifier in package manager host
	ensure group members are updated to targeted version
	ignore unknown files when formatting schematic changes

@​angular-devkit/build-angular

Commit	Description
	update copy-webpack-plugin to v14.0.0

@​angular/build

| Commit | Description |

... (truncated)

Sourced from @​angular/ssr's changelog.

21.2.3 (2026-03-18)

@​angular/cli

Commit	Type	Description
1505164bb	fix	use parsed package name for migrate-only updates

@​angular/build

Commit	Type	Description
75fa94cad	fix	alias createRequire banner import to avoid duplicate binding
d009aa1ec	fix	only use external packages for polyfills when no local files are present

@​angular/ssr

Commit	Type	Description
f3e0e82c2	fix	disallow x-forwarded-prefix starting with a backslash
b8bcd59b4	fix	ensure unique values in redirect response Vary header
84385411d	fix	support custom headers in redirect responses

22.0.0-next.1 (2026-03-11)

Breaking Changes

@​angular/build

• The @angular/build:dev-server (ng serve) now assigns the highest priority to the PORT environment variable. This value will override any port configurations specified in angular.json or via the --port command-line flag. This includes the default port 4200.

@​schematics/angular

Commit	Type	Description
b3d838dfd	fix	replace deprecated ChangeDetectionStrategy.Default with Eager

@​angular/cli

Commit	Type	Description
598a690a0	fix	conditionally quote package names when adding dependencies based on host requirements
b5fb457e1	fix	preserve exact version in ng add when requested
93c3eb8fb	fix	update zoneless migration tool to handle ChangeDetectionStrategy.Eager
ad0fd5f41	perf	avoid redundant package version resolution in ng add
a39a33128	perf	cache root manifest and resolve restricted package exports in ng add

... (truncated)

• ec8a04b release: cut the v21.2.3 release
• 94959e9 docs: update references from app.component to app to match the style guide
• d01bcb3 build: update cross-repo angular dependencies
• b8bcd59 fix(@​angular/ssr): ensure unique values in redirect response Vary header
• ba511f7 build: lock file maintenance
• 1505164 fix(@​angular/cli): use parsed package name for migrate-only updates
• 8438541 fix(@​angular/ssr): support custom headers in redirect responses
• f3e0e82 fix(@​angular/ssr): disallow x-forwarded-prefix starting with a backslash
• 411b2db build: update cross-repo angular dependencies
• e5a9976 docs: update long-description
• Additional commits viewable in compare view

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144

New Contributors

• @​Jason3S made their first contribution in micromatch/picomatch#144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

• e5474fc Publish 4.0.4
• 4516eb5 Merge commit from fork
• 5eceecd Merge commit from fork
• 0db7dd7 Run benchmark again against latest minimatch version (#161)
• 9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
• 2661f23 fix typo in globstars.js test name (#138)
• 1798b07 docs: fix makeRe example (#143)
• 9d76bc5 chore: undocument removed options (#146)
• e4d718b Remove unused time-require (#160)
• 38dffeb chore(deps): pin dependencies (#158)
• Additional commits viewable in compare view

Sourced from smol-toml's releases.

v1.6.1

This release addresses a minor security vulnerability where an attacker-controlled TOML document can exploit an unrestricted recustion and cause a stack overflow error with a document that contains thousands of sucessive commented lines. Security advisory: GHSA-v3rj-xjv7-4jmq

v1.6.0

As of this version, smol-toml now supports the newly released TOML 1.1.0 specification!

Highlights

Multiline inline tables

TOML 1.1.0 now allows inline tables to have newlines, as well as trailing commas.

database = {
  driver = "postgresql",
  server = {
    host = "127.0.0.1",
    port = 3307,
  },
}

Omitting seconds in datetime and time

TOML 1.1.0 renders the seconds component of time elements optional.

datetime-tz = 1979-05-27 07:32Z
datetime = 2001-09-21 10:17
time = 13:37

New string escapes

Strings now support 2 additional escape sequences:

• \xHH for code points between 0 and 255
• \e for the escape character (U+001B)

What's Changed

• feat: toml 1.1 support by @​cyyynthia in squirrelchat/smol-toml#49

Full Changelog: squirrelchat/smol-toml@v1.5.2...v1.6.0

v1.5.2

Hot fix for v1.5.1... 🙃

What's Changed

• fix: properly stringify arrays of tables by @​cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.5.1...v1.5.2

v1.5.1

Smol fix that makes newlines actually consistent when stringifying objects to TOML.

What's Changed

... (truncated)

• 072b64f chore: version bump
• 19a5dc7 chore: upgrade dependencies and actions
• f286f87 fix: don't use recursion in skipVoid
• 399c545 chore: version bump
• 06521ca Merge pull request #49 from squirrelchat/toml-110
• f3a68a7 fix: properly test \e escape
• 9743a86 fix: properly run toml-test v2
• 1ec5303 docs: toml 1.1.0 in the readme
• 8bc0e2b chore: upgrade dependencies, actions
• 24618db feat: allow omitting seconds in datetime and time values
• Additional commits viewable in compare view

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for smol-toml since your current version.

Sourced from svgo's releases.

v2.8.2

This is effectively just a re-release of SVGO v2.8.1, but with *.test.js files omitted. It seems something was wrong with the configuration in the v2.8.0 tag and I hadn't noticed it included a few extra files. 😅

We'll deprecate v2.8.1, and I'll include the change log here.

What's Changed

Dependencies

• Migrates from our unsupported fork of sax (@​trysound/sax) to the upstream version of sax (sax).

Bug Fixes

• No longer throws error when encountering comments in DTD.

Metrics

Before and after of the browser bundle of each respective version:

	v2.8.0	v2.8.2	Delta
svgo.browser.js	587.2 kB	589.2 kB	⬆️ 2 kB

Support

SVGO v2 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v2 to v3 and Migration Guide from v3 to v4 which should ease the process.

v2.8.1

Deprecated

This release left *.test.js files in the package, which have been omitted in v2.8.2. Sorry for the noise!

What's Changed

Dependencies

• Migrates from our unsupported fork of sax (@​trysound/sax) to the upstream version of sax (sax).

Bug Fixes

• No longer throws error when encountering comments in DTD.

Metrics

Before and after of the browser bundle of each respective version:

	v2.8.0	v2.8.1	Delta

... (truncated)

• f706b07 deps: upgrade to sax v1.5.0
• See full diff in compare view

This version was pushed to npm by sethiii, a new releaser for svgo since your current version.

• 888baa0 3.3.3
• 1adbbe9 ruf/linted Python + dev-dependencies updates