chore(deps): bump @angular/compiler from 20.3.16 to 21.2.9

[dependabot]

Bumps @angular/compiler from 20.3.16 to 21.2.9.

Release notes

Sourced from @​angular/compiler's releases.

21.2.9

core

Commit	Description
	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Description
	add CSP nonce support to JsonpClientBackend
	Don't on Passthru outside of reactive context

platform-server

Commit	Description
	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Description
	normalize multiple leading slashes in URL parser

21.2.8

compiler

Commit	Description
	handle nested brackets in host object bindings

compiler-cli

Commit	Description
	error for type parameter declarations

core

Commit	Description
	handle missing serialized container hydration data
	remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit	Description
	get quick info at local var location to align with TS semantics and support type narrowing

21.2.7

compiler

Commit	Description
	register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit	Description
	prevent recursive scope checks for invalid NgModule imports

core

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.9 (2026-04-15)

core

Commit	Type	Description
f603d4714f	fix	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Type	Description
540536c386	fix	add CSP nonce support to JsonpClientBackend
63a857b874	fix	Don't on Passthru outside of reactive context

platform-server

Commit	Type	Description
e0b5078cf2	fix	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Type	Description
684e9fd53d	fix	normalize multiple leading slashes in URL parser

22.0.0-next.7 (2026-04-08)

Breaking Changes

core

• The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
• • TypeScript versions older than 6.0 are no longer supported.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

platform-browser

• This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.

router

• The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

compiler

Commit	Type	Description
2ce0e98f79	fix	handle nested brackets in host object bindings

compiler-cli

Commit	Type	Description
7f9450219f	feat	Adds warning for prefetch without main defer trigger
ab061a7610	fix	error for type parameter declarations
9218140348	fix	resolve TCB mapping failure for safe property reads with as any

core

Commit	Type	Description
a0aa8304cd	feat	bootstrap via ApplicationRef with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
77f1ca08e4	fix	handle missing serialized container hydration data

... (truncated)

Commits

• a4f3120 refactor(compiler): require a reference in DirectiveMeta
• de533fe refactor(compiler-cli): move ClassPropertyMapping into compiler
• ea1e34c refactor(compiler): move matchSource into base metadata
• e40d378 fix(compiler): handle nested brackets in host object bindings
• d04ddd7 fix(core): prevent binding unsafe attributes on SVG animation elements (#67797)
• fea25d1 fix(compiler): register SVG animation attributes in URL security context (#67...
• 880a57d fix(compiler): prevent shimCssText from adding extra blank lines per CSS comment
• 23ea431 fix(compiler): parse named HTML entities containing digits
• 334ae10 fix(compiler): ensure generated code compiles
• ed2d324 fix(compiler): disallow translations of iframe src
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.9%. Comparing base (fdbbd47) to head (a17951f).

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #1286     +/-   ##
=======================================
- Coverage   65.9%   65.9%   -0.1%     
=======================================
  Files        335     335             
  Lines       9821    9821             
  Branches    1290    1291      +1     
=======================================
- Hits        6477    6476      -1     
+ Misses      2971    2969      -2     
- Partials     373     376      +3     

see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.