Bump @angular/platform-server from 21.2.9 to 21.2.16

[dependabot]

Bumps @angular/platform-server from 21.2.9 to 21.2.16.

Release notes

Sourced from @​angular/platform-server's releases.

21.2.16

common

Commit	Description
	only strip a literal /index.html suffix from URLs

compiler

Commit	Description
	move projection attributes into constants

core

Commit	Description
	harden inherit definition feature against polluted prototypes
	use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

21.2.15

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
	prevent namespaced SVG elements from being stripped
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Description
	normalize tag names in runtime i18n attribute security context lookup (#68925)
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
	synchronize core sanitization schema with compiler (#68925)

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	prevent SSRF bypasses via backslash URLs in HttpClient
	secure location and document initialization against SSRF and path hijack

... (truncated)

Changelog

Sourced from @​angular/platform-server's changelog.

21.2.16 (2026-06-03)

common

Commit	Type	Description
f6d8e642b0	fix	only strip a literal /index.html suffix from URLs

compiler

Commit	Type	Description
ae1c8a1f7a	fix	move projection attributes into constants

core

Commit	Type	Description
3fd6897a67	fix	harden inherit definition feature against polluted prototypes
7e38336dc7	fix	use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

Commit	Type	Description
66821c4ed5	fix	throw on suspicious URLs and restrict protocol-relative URLs
d3170031b6	fix	update domino to latest version

19.2.25 (2026-06-02)

platform-server

Commit	Type	Description
e2fb854d55	fix	throw on suspicious URLs and restrict protocol-relative URLs
0a8befb493	fix	update domino to latest version

20.3.24 (2026-06-02)

platform-server

Commit	Type	Description
6ca433e56b	fix	throw on suspicious URLs and restrict protocol-relative URLs
8680b5152f	fix	update domino to latest version

21.2.15 (2026-05-28)

common

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

compiler

... (truncated)

Commits

• 66821c4 fix(platform-server): throw on suspicious URLs and restrict protocol-relative...
• 8206972 refactor(platform-server): clean up and simplify url resolution utility
• 37e8aad fix(platform-server): prevent SSRF bypasses via backslash URLs in HttpClient
• 72696e2 fix(platform-server): secure location and document initialization against SSR...
• 0b7192f fix(platform-server): forward BEFORE_APP_SERIALIZED errors to ErrorHandler
• 629905d fix(platform-server): add allowedHosts option to renderModule and `render...
• 1aeebbe fix(core): respect ngSkipHydration on components with projectable nodes in LC...
• 41e4851 docs: update documentation for platform server URL token options
• be1f80a fix(platform-server): ensure origin has a trailing slash when parsing url
• 7a64aff fix(core): prevent event replay double-invocation when element hydrates befor...
• Additional commits viewable in compare view

[dependabot]

Superseded by #552.