build(deps): bump the npm_and_yarn group across 1 directory with 3 updates

[dependabot]

Bumps the npm_and_yarn group with 3 updates in the / directory: @angular/platform-server, hono and js-yaml.

Updates @angular/platform-server from 22.1.1 to 22.1.4

Release notes

Sourced from @​angular/platform-server's releases.

22.1.4

common

Commit	Description
	avoid prototype member collisions
	use locale NaN symbol in number formatting

compiler

Commit	Description
	scope animations declared in minified nested rules

compiler-cli

Commit	Description
	default template diagnostic related message source file to template
	Produce correct tcb expression for optional chaining
	retain metadata for strict standalone errors

core

Commit	Description
	avoid prototype member collisions
	explicitly reject foreign components in JIT mode
	preserve namespace for dynamic component hosts
	prevent TransferState prototype pollution
	throw coded RuntimeErrors instead of crashing when hydration/rendering can't find an expected DOM node

forms

Commit	Description
	use dot-access for readonly rule configuration

language-service

Commit	Description
	honor quote style preference when generating imports

migrations

Commit	Description
	preserve registerLocaleData calls in standalone bootstrap migration

platform-server

Commit	Description
	avoid stripping unicode whitespace during url resolution

22.1.3

animations

Commit	Description
	detect object trigger values with Object.hasOwn

common

Commit	Description
	preserve literal key union in KeyValuePipe.transform()

... (truncated)

Changelog

Sourced from @​angular/platform-server's changelog.

22.1.4 (2026-08-26)

common

Commit	Type	Description
60a874c3fb	fix	avoid prototype member collisions
e8378dfeab	fix	use locale NaN symbol in number formatting

compiler

Commit	Type	Description
05c7c725a5	fix	scope animations declared in minified nested rules

compiler-cli

Commit	Type	Description
afe8499a14	fix	default template diagnostic related message source file to template
079a846263	fix	Produce correct tcb expression for optional chaining
55eeb46418	fix	retain metadata for strict standalone errors

core

Commit	Type	Description
3da35cbab9	fix	avoid prototype member collisions
b199bdfa2a	fix	explicitly reject foreign components in JIT mode
9a8e4826b9	fix	preserve namespace for dynamic component hosts
7c752d4815	fix	prevent TransferState prototype pollution
7546b7a805	fix	throw coded RuntimeErrors instead of crashing when hydration/rendering can't find an expected DOM node

forms

Commit	Type	Description
c8eb7f0056	fix	use dot-access for readonly rule configuration

language-service

Commit	Type	Description
93d7f718d2	fix	honor quote style preference when generating imports

migrations

Commit	Type	Description
85c8829ac1	fix	preserve registerLocaleData calls in standalone bootstrap migration

platform-server

Commit	Type	Description
71e52d1396	fix	avoid stripping unicode whitespace during url resolution

22.1.3 (2026-08-19)

animations

Commit	Type	Description
d9620e0f1b	fix	detect object trigger values with Object.hasOwn

common

... (truncated)

Commits

• 7546b7a fix(core): throw coded RuntimeErrors instead of crashing when hydration/rende...
• 71e52d1 fix(platform-server): avoid stripping unicode whitespace during url resolution
• 4413711 fix(core): replace all hasOwnProperty usages with Object.hasOwn
• c04931c fix(core): throw a descriptive error instead of crashing when a hydration nod...
• 601d1f6 fix(core): throw NG0500 instead of a raw TypeError on element hydration mismatch
• 98bc211 test(platform-server): clean up viewport hydration observer
• 6f9a64e fix(compiler): remove namespaced MathML script elements
• See full diff in compare view

Updates hono from 4.13.1 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

• eebdf7b 4.13.7
• 2b8ed40 Merge commit from fork
• cac0c4d 4.13.6
• dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
• ec648d6 chore: bump editorconfig-checker (#5336)
• e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
• 499c35e fix(client): normalize root WebSocket URLs (#5291)
• 50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• Additional commits viewable in compare view

Updates js-yaml from 3.15.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• See full diff in compare view