[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: @angular/router, basic-ftp, dompurify and webpack-dev-middleware.

Updates @angular/router from 20.3.31 to 20.3.32

Release notes

Sourced from @​angular/router's releases.

20.3.32

router

Commit	Description
	avoid dense elements allocation for numeric URL keys

Changelog

Sourced from @​angular/router's changelog.

20.3.32 (2026-09-23)

router

Commit	Type	Description
ddfe21072b	fix	avoid dense elements allocation for numeric URL keys

Commits

• ddfe210 fix(router): avoid dense elements allocation for numeric URL keys
• See full diff in compare view

Updates basic-ftp from 5.3.1 to 6.2.1

Release notes

Sourced from basic-ftp's releases.

6.2.1

• Fixed: Protect against excessive CPU use when parsing a directory listing, fixes GHSA-c475-qrg2-pj4r.
• Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.

6.2.0

• Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
• Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.

6.1.0

• Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.

6.0.2

• Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).

6.0.1

• Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @​dennisameling)

6.0.0

• Breaking change: This library does not allow separate transfer hosts by default anymore. This provides security by default against FTP bounce attacks. This FTP feature is used very rarely, there is a good chance you don't actually have to change anything in your code. You can allow separate transfer hosts by using allowSeparateTransferHost: true when instantiating a Client. (Thanks, @​Jvr2022)

Changelog

Sourced from basic-ftp's changelog.

6.2.1

• Fixed: Protect against excessive CPU use when parsing a directory listing, fixes GHSA-c475-qrg2-pj4r.
• Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.

6.2.0

• Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
• Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.

6.1.0

• Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.

6.0.2

• Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).

6.0.1

• Fixed: Use and renew TLS 1.3 session tickets for data connections.

6.0.0

• Breaking change: This library no longer allows separate transfer hosts by default. This feature is used very rarely by FTP servers anyway and it is highly likely that you don't actually have to change anything in your code. Preventing it by default protects users from FTP bounce attacks. You can still allow separate transfer hosts by using allowSeparateTransferHost: true when instantiating a Client. (Thanks, @​Jvr2022)

Commits

• a5b160f Fix tests
• d6d3245 Fix timeout issue
• b7cc6a5 Update dev dependencies
• d0d9e07 Fix quadratic-time CPU denial of service in Client.list()
• 9cbc5cf Update dependencies
• a825fdc Fix failed transfer reporting failure twice
• 344504c Bump version
• 0fa741d Make data transfer timeout tracking independent of streams controlled by
• e025e1d Bump version
• d465295 Guard against files being changed during upload
• Additional commits viewable in compare view

Updates dompurify from 3.4.13 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

Commits

• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• See full diff in compare view

Updates webpack-dev-middleware from 7.4.2 to 7.4.5

Release notes

Sourced from webpack-dev-middleware's releases.

v7.4.5

7.4.5 (2025-09-24)

Bug Fixes

• unpin memfs (#2176) (c9a0e68)

v7.4.4

7.4.4 (2025-09-23)

Bug Fixes

• pin memfs version (#2174) (044d691)

v7.4.3

7.4.3 (2025-09-05)

Bug Fixes

• do not call the next middleware for 304 responses (#2155) (c26a326)
• do not call the next middleware when request is finished or errored (#2156) (116c680)

Changelog

Sourced from webpack-dev-middleware's changelog.

7.4.5 (2025-09-24)

Bug Fixes

• unpin memfs (#2176) (c9a0e68)

7.4.4 (2025-09-23)

Bug Fixes

• pin memfs version (#2174) (044d691)

7.4.3 (2025-09-05)

Bug Fixes

• do not call the next middleware for 304 responses (#2155) (c26a326)
• do not call the next middleware when request is finished or errored (#2156) (116c680)

Commits

• ec97e06 chore(release): 7.4.5
• c9a0e68 fix: unpin memfs (#2176)
• 0c87e95 chore(deps-dev): bump the dependencies group across 1 directory with 6 update...
• 8f40f5f chore(release): 7.4.4
• 044d691 fix: pin memfs version (#2174)
• 253c7e1 chore(deps-dev): bump the dependencies group with 3 updates (#2170)
• 2535262 chore(deps): bump the dependencies group across 1 directory with 5 updates (#...
• 6b7531e chore: remove CODEOWNERS, too spammy (#2167)
• be10aa6 chore(deps): remove strip-ansi (#2166)
• 0c4431b chore(deps): update
• Additional commits viewable in compare view