Sourced from @​angular/core's releases.

19.2.20

compiler

Commit	Description
	disallow translations of iframe src

core

Commit	Description
	sanitize translated attribute bindings with interpolations
	sanitize translated form attributes

19.2.19

core

Commit	Description
	block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

• Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

  (cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

Sourced from @​angular/core's changelog.

19.2.20 (2026-03-12)

compiler

Commit	Type	Description
5be912eb55	fix	disallow translations of iframe src

core

Commit	Type	Description
b89b0a83a4	fix	sanitize translated attribute bindings with interpolations
621c7071ad	fix	sanitize translated form attributes

20.3.18 (2026-03-12)

compiler

Commit	Type	Description
02fbf08890	fix	disallow translations of iframe src

core

Commit	Type	Description
72126f9a08	fix	sanitize translated attribute bindings with interpolations
626bc8bc20	fix	sanitize translated form attributes

22.0.0-next.3 (2026-03-12)

compiler

Commit	Type	Description
78dea55351	fix	disallow translations of iframe src

core

Commit	Type	Description
999c14eaab	fix	reverts "feat(core): add support for nested animations"
de0eb4c656	fix	sanitize translated form attributes

21.2.4 (2026-03-12)

compiler

Commit	Type	Description
ed2d324f9c	fix	disallow translations of iframe src

core

Commit	Type	Description

... (truncated)

• 621c707 fix(core): sanitize translated form attributes
• b89b0a8 fix(core): sanitize translated attribute bindings with interpolations
• 7475487 fix(core): block creation of sensitive URI attributes from ICU messages
• See full diff in compare view

Sourced from @​angular/core's releases.

19.2.20

compiler

Commit	Description
	disallow translations of iframe src

core

Commit	Description
	sanitize translated attribute bindings with interpolations
	sanitize translated form attributes

19.2.19

core

Commit	Description
	block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

• Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

  (cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

Sourced from @​angular/core's changelog.

19.2.20 (2026-03-12)

compiler

Commit	Type	Description
5be912eb55	fix	disallow translations of iframe src

core

Commit	Type	Description
b89b0a83a4	fix	sanitize translated attribute bindings with interpolations
621c7071ad	fix	sanitize translated form attributes

20.3.18 (2026-03-12)

compiler

Commit	Type	Description
02fbf08890	fix	disallow translations of iframe src

core

Commit	Type	Description
72126f9a08	fix	sanitize translated attribute bindings with interpolations
626bc8bc20	fix	sanitize translated form attributes

22.0.0-next.3 (2026-03-12)

compiler

Commit	Type	Description
78dea55351	fix	disallow translations of iframe src

core

Commit	Type	Description
999c14eaab	fix	reverts "feat(core): add support for nested animations"
de0eb4c656	fix	sanitize translated form attributes

21.2.4 (2026-03-12)

compiler

Commit	Type	Description
ed2d324f9c	fix	disallow translations of iframe src

core

Commit	Type	Description

... (truncated)

• 621c707 fix(core): sanitize translated form attributes
• b89b0a8 fix(core): sanitize translated attribute bindings with interpolations
• 7475487 fix(core): block creation of sensitive URI attributes from ICU messages
• See full diff in compare view

Sourced from electron's releases.

electron v41.2.0

Release Notes for v41.2.0

Features

• Added allowExtensions privilege to protocol.registerSchemesAsPrivileged() to enable Chrome extensions on custom protocols. #50529 (Also in 40, 42)

Fixes

• BrowserWindow now enforces min/max size constraints on window creation, even if they conflict with the requested width and height. #50753 (Also in 42)
• Fixed a regression on Linux where transparent frameless windows would have visible borders. Also fixed a longstanding issue where transparent windows on Linux could show smeared and glitched content as windows moved around. #50605
• Fixed an intermittent Invoke in DisallowJavascriptExecutionScope crash on application quit when a WebContents (or other JS-emitting native object) is garbage-collected during shutdown. #50694 (Also in 40, 42)
• Fixed an issue on macOS where show/hide events and WebContents visibility state could be reported incorrectly when multiple WebContentsViews were attached to a window. #50715 (Also in 40, 42)
• Fixed an issue where concurrent getFileHandle requests on the same path could stall indefinitely. #50670 (Also in 40, 42)
• Fixed an issue where margins did not look as expected when printing in silent mode. #50652 (Also in 42)
• Fixed an issue where the webContents.print() callback may not fire correctly in some cases. #50604 (Also in 42)
• Fixed the appearance of maximized windows on GNOME in Wayland, especially when non-default GTK themes like Breeze are set. #50645 (Also in 42)
• Removed "representedObject is not a WeakPtrToElectronMenuModelAsNSObject" logging when interacting with macOS menus. #50613 (Also in 42)

Other Changes

• Updated Chromium to 146.0.7680.179. #50616

electron v41.1.1

Release Notes for v41.1.1

Fixes

• Fixed a crash when calling contentTracing.getTraceBufferUsage() while a trace session is active. #50594 (Also in 39, 40, 42)
• Fixed printing on Linux failing with "Invalid printer settings". #50486 (Also in 42)

Other Changes

• Enabled profile-guided optimization for V8 builtins in release builds, improving JavaScript builtin performance (Array, String, RegExp, etc.). #50574 (Also in 40, 42)

electron v41.1.0

Release Notes for v41.1.0

Features

• Added nativeTheme.shouldDifferentiateWithoutColor on macOS. #50408 (Also in 42)
• Notes: Added support for the urgency option in Notifications on Windows. #50382 (Also in 42)

Fixes

• Fixed a bug where Windows notification icons could fail to save because their temporary filenames contained invalid characters. #50483 (Also in 40)
• Fixed a crash in clipboard.readImage() when the clipboard contains malformed image data. #50492 (Also in 39, 40, 42)
• Fixed a crash when calling an offscreen shared texture's release() after the texture object was garbage collected. #50501 (Also in 39, 40, 42)
• Fixed an accessibility issue where the AXMenuOpened event was not fired on menu creation. #50506 (Also in 40, 42)
• Fixed an issue where an app shortcut may lose its icon after auto-updating on Windows. #50519 (Also in 40)

Other Changes

• Updated Chromium to 146.0.7680.166. #50458

... (truncated)

• 7394591 ci: use hermetic mac SDK for the release ffmpeg build (#50755)
• d37b4f5 fix: enforce size constraints on window creation on Windows and Linux (#50753)
• 6f1d53a ci: make src-cache upload atomic (#50750)
• fb150b2 docs: link menu type references (#50752)
• c219f2c build: derive patches upstream-head ref from script path (41-x-y) (#50741)
• 3fa5280 fix: re-enable MacWebContentsOcclusion with embedder window fix (#50715)
• 45ad6b3 chore: bump chromium to 146.0.7680.179 (41-x-y) (#50616)
• 26e20c7 ci: use github mirror to get lint dependency versions (#50736)
• ca15223 chore: harden GitHub Actions against script injection patterns (#50708)
• 3d743a6 build: replace npx with lockfile-pinned binaries (#50718)
• Additional commits viewable in compare view

Sourced from electron's releases.

electron v41.2.0

Release Notes for v41.2.0

Features

• Added allowExtensions privilege to protocol.registerSchemesAsPrivileged() to enable Chrome extensions on custom protocols. #50529 (Also in 40, 42)

Fixes

• BrowserWindow now enforces min/max size constraints on window creation, even if they conflict with the requested width and height. #50753 (Also in 42)
• Fixed a regression on Linux where transparent frameless windows would have visible borders. Also fixed a longstanding issue where transparent windows on Linux could show smeared and glitched content as windows moved around. #50605
• Fixed an intermittent Invoke in DisallowJavascriptExecutionScope crash on application quit when a WebContents (or other JS-emitting native object) is garbage-collected during shutdown. #50694 (Also in 40, 42)
• Fixed an issue on macOS where show/hide events and WebContents visibility state could be reported incorrectly when multiple WebContentsViews were attached to a window. #50715 (Also in 40, 42)
• Fixed an issue where concurrent getFileHandle requests on the same path could stall indefinitely. #50670 (Also in 40, 42)
• Fixed an issue where margins did not look as expected when printing in silent mode. #50652 (Also in 42)
• Fixed an issue where the webContents.print() callback may not fire correctly in some cases. #50604 (Also in 42)
• Fixed the appearance of maximized windows on GNOME in Wayland, especially when non-default GTK themes like Breeze are set. #50645 (Also in 42)
• Removed "representedObject is not a WeakPtrToElectronMenuModelAsNSObject" logging when interacting with macOS menus. #50613 (Also in 42)

Other Changes

• Updated Chromium to 146.0.7680.179. #50616

electron v41.1.1

Release Notes for v41.1.1

Fixes

• Fixed a crash when calling contentTracing.getTraceBufferUsage() while a trace session is active. #50594 (Also in 39, 40, 42)
• Fixed printing on Linux failing with "Invalid printer settings". #50486 (Also in 42)

Other Changes

• Enabled profile-guided optimization for V8 builtins in release builds, improving JavaScript builtin performance (Array, String, RegExp, etc.). #50574 (Also in 40, 42)

electron v41.1.0

Release Notes for v41.1.0

Features

• Added nativeTheme.shouldDifferentiateWithoutColor on macOS. #50408 (Also in 42)
• Notes: Added support for the urgency option in Notifications on Windows. #50382 (Also in 42)

Fixes

• Fixed a bug where Windows notification icons could fail to save because their temporary filenames contained invalid characters. #50483 (Also in 40)
• Fixed a crash in clipboard.readImage() when the clipboard contains malformed image data. #50492 (Also in 39, 40, 42)
• Fixed a crash when calling an offscreen shared texture's release() after the texture object was garbage collected. #50501 (Also in 39, 40, 42)
• Fixed an accessibility issue where the AXMenuOpened event was not fired on menu creation. #50506 (Also in 40, 42)
• Fixed an issue where an app shortcut may lose its icon after auto-updating on Windows. #50519 (Also in 40)

Other Changes

• Updated Chromium to 146.0.7680.166. #50458

... (truncated)

• 7394591 ci: use hermetic mac SDK for the release ffmpeg build (#50755)
• d37b4f5 fix: enforce size constraints on window creation on Windows and Linux (#50753)
• 6f1d53a ci: make src-cache upload atomic (#50750)
• fb150b2 docs: link menu type references (#50752)
• c219f2c build: derive patches upstream-head ref from script path (41-x-y) (#50741)
• 3fa5280 fix: re-enable MacWebContentsOcclusion with embedder window fix (#50715)
• 45ad6b3 chore: bump chromium to 146.0.7680.179 (41-x-y) (#50616)
• 26e20c7 ci: use github mirror to get lint dependency versions (#50736)
• ca15223 chore: harden GitHub Actions against script injection patterns (#50708)
• 3d743a6 build: replace npx with lockfile-pinned binaries (#50718)
• Additional commits viewable in compare view

Sourced from next's releases.

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @​styfle and @​lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​ztanner for helping!

• 412eb90 v15.5.15
• cb90de9 [15.x] Avoid consuming cyclic models multiple times (#74)
• fffef9e Fix CI for glibc linux builds
• d7b012d v15.5.14
• 2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
• f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
• cfd5f53 v15.5.13
• 15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
• d23f41c v15.5.12
• 8e75765 fix unlock in publish-native
• Additional commits viewable in compare view

Sourced from nuxt's releases.

v3.19.0

👀 Highlights

Please see the release notes for Nuxt v4.1 for full details on the features and fixes in Nuxt v3.19.

✅ Upgrading

As usual, our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will refresh your lockfile and pull in all the latest dependencies that Nuxt relies on, especially from the unjs ecosystem.

👉 Changelog

compare changes

🚀 Enhancements

• kit: Add ignore option to resolveFiles (#32858)
• kit: Add onInstall and onUpgrade module hooks (#32397)
• nuxt,vite: Add experimental support for rolldown-vite (#31812)
• nuxt: Extract defineRouteRules to page rules property (#32897)
• nuxt,vite: Use importmap to increase chunk stability (#33075)
• nuxt: Lazy hydration macros without auto-imports (#33037)
• kit,nuxt,schema: Allow modules to specify dependencies (#33063)
• kit,nuxt: Add getLayerDirectories util and refactor to use it (#33098)

🔥 Performance

• nuxt: Clear inline route rules cache when pages change (#32877)
• nuxt: Stop watching app manifest once a change has been detected (#32880)

🩹 Fixes

• nuxt: Handle satisfies in page augmentation (#32902)
• nuxt: Type response in useFetch hooks (#32891)
• nuxt: Add TS parenthesis and as expression for page meta extraction (#32914)
• nuxt: Use correct unit thresholds for relative time (#32893)
• nuxt: Handle uncached current build manifests (#32913)
• kit: Resolve directories in resolvePath and normalize file extensions (#32857)
• schema,vite: Bump requestTimeout + allow configuration (#32874)
• nuxt: Deep merge extracted route meta (#32887)
• nuxt: Do not expose app components until fully resolved (#32993)
• kit: Only exclude node_modules/ if no custom srcDir (#32987)
• nuxt: Compare final matched routes when syncing route object (#32899)
• nuxt: Make vue server warnings much less verbose in dev mode (#33018)
• schema: Allow disabling cssnano/autoprefixer postcss plugins (#33016)
• kit: Ensure local layers are prioritised alphabetically (#33030)
• kit,nuxt: Expose global types to vue compiler (#33026)
• nuxt: Support config type inference for defineNuxtModule().with() (#33081)
• nuxt: Search for colliding names in route children (31a9282c2)
• nuxt: Delete nuxtApp._runningTransition on resolve (#33025)
• nuxt: Add validation for nuxt island reviver key (#33069)

... (truncated)

• 8956505 v3.19.0
• 9a3b445 test: update test for app creation
• ae8b0d2 fix(kit): prioritise local layers over extended layers
• 2fd3bc2 feat(kit,nuxt): add getLayerDirectories util and refactor to use it (#33098)
• 6cc79dd feat(kit,nuxt,schema): allow modules to specify dependencies (#33063)
• 78153ba fix(nuxt): add validation for nuxt island reviver key (#33069)
• f4e38b7 fix(nuxt): delete nuxtApp._runningTransition on resolve (#33025)
• 31a9282 fix(nuxt): search for colliding names in route children
• 10fd012 refactor(kit,nuxt,ui-templates,vite): address deprecations + improve regexp p...
• 04dda84 feat(nuxt): lazy hydration macros without auto-imports (#33037)
• Additional commits viewable in compare view

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for nuxt since your current version.

Sourced from svelte's releases.

svelte@5.55.3

Patch Changes

• fix: ensure proper HMR updates for dynamic components (#18079)

• fix: correctly calculate @const blockers (#18039)

• fix: freeze deriveds once their containing effects are destroyed (#17921)

• fix: defer error boundary rendering in forks (#18076)

• fix: avoid false positives for reactivity loss warning (#18088)

svelte@5.55.2

Patch Changes

• fix: invalidate @const tags based on visible references in legacy mode (#18041)

• fix: handle parens in template expressions more robustly (#18075)

• fix: disallow -- in idPrefix (#18038)

• fix: correct types for ontoggle on <details> elements (#18063)

• fix: don't override $destroy/set/on instance methods in dev mode (#18034)

• fix: unskip branches of earlier batches after commit (#18048)

• fix: never set derived.v inside fork (#18037)

• fix: skip rebase logic in non-async mode (#18040)

• fix: don't reset status of uninitialized deriveds (#18054)

svelte@5.55.1

Patch Changes

• fix: correctly handle bindings on the server (#18009)

• fix: prevent hydration error on async {@html ...} (#17999)

• fix: cleanup superTypeParameters in ClassDeclarations/ClassExpression (#18015)

• fix: improve duplicate module import error message (#18016)

• fix: reschedule new effects in prior batches (#18021)

svelte@5.55.0

Minor Changes

... (truncated)

Sourced from svelte's changelog.

5.55.3

Patch Changes

• fix: ensure proper HMR updates for dynamic components (#18079)

• fix: correctly calculate @const blockers (#18039)

• fix: freeze deriveds once their containing effects are destroyed (#17921)

• fix: defer error boundary rendering in forks (#18076)

• fix: avoid false positives for reactivity loss warning (#18088)

5.55.2

Patch Changes

• fix: invalidate @const tags based on visible references in legacy mode (#18041)

• fix: handle parens in template expressions more robustly (#18075)

• fix: disallow -- in idPrefix (#18038)

• fix: correct types for ontoggle on <details> elements (#18063)

• fix: don't override $destroy/set/on instance methods in dev mode (#18034)

• fix: unskip branches of earlier batches after commit (#18048)

• fix: never set derived.v inside fork (#18037)

• fix: skip rebase logic in non-async mode (#18040)

• fix: don't reset status of uninitialized deriveds (#18054)

5.55.1

Patch Changes

• fix: correctly handle bindings on the server (#18009)

• fix: prevent hydration error on async {@html ...} (#17999)

• fix: cleanup superTypeParameters in ClassDeclarations/ClassExpression (#18015)

• fix: improve duplicate module import error message (#18016)

• fix: reschedule new effects in prior batches (#18021)

... (truncated)

• 4a50e8e Version Packages (#18085)
• 15588f5 fix: avoid false positives for reactivity loss warning (#18088)
• 0e9e76f fix: freeze deriveds once their containing effects are destroyed (#17921)
• 3937ec0 fix: correctly calculate @const blockers (#18039)
• 7be1a02 fix: ensure proper HMR updates for dynamic components (#18079)
• a4ce776 fix: defer error boundary rendering in forks (#18076)
• 2e29c87 Version Packages (#18036)
• 6b653b8 chore: simplify parser (#18077)
• 8966601 fix: handle parens in template expressions more robustly (#18075)
• 0395ef0 fix: unskip branches of earlier batches after commit (#18048)
• Additional commits viewable in compare view

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for svelte since your current version.

Sourced from svelte's releases.

svelte@5.55.3

Patch Changes

• fix: ensure proper HMR updates for dynamic components (#18079)

• fix: correctly calculate @const blockers (#18039)

• fix: freeze deriveds once their containing effects are destroyed (#17921)

• fix: defer error boundary rendering in forks (#18076)

• fix: avoid false positives for reactivity loss warning (#18088)

svelte@5.55.2

Patch Changes

• fix: invalidate @const tags based on visible references in legacy mode (#18041)

• fix: handle parens in template expressions more robustly (#18075)

• fix: disallow -- in idPrefix (#18038)

• fix: correct types for ontoggle on <details> elements (#18063)

• fix: don't override $destroy/set/on instance methods in dev mode (#18034)

• fix: unskip branches of earlier batches after commit (#18048)

• fix: never set derived.v inside fork (#18037)

• fix: skip rebase logic in non-async mode (#18040)

• fix: don't reset status of uninitialized deriveds (#18054)

svelte@5.55.1

Patch Changes

• fix: correctly handle bindings on the server (#18009)

• fix: prevent hydration error on async {@html ...} (#17999)

• fix: cleanup superTypeParameters in ClassDeclarations/ClassExpression (#18015)

• fix: improve duplicate module import error message (#18016)

• fix: reschedule new effects in prior batches (#18021)

svelte@5.55.0

Minor Changes

... (truncated)

Sourced from svelte's changelog.

5.55.3

Patch Changes

• fix: ensure proper HMR updates for dynamic components (#18079)

• fix: correctly calculate @const blockers (#18039)

• fix: freeze deriveds once their containing effects are destroyed (#17921)

• fix: defer error boundary rendering in forks (#18076)

• fix: avoid false positives for reactivity loss warning (#18088)

5.55.2

Patch Changes

• fix: invalidate @const tags based on visible references in legacy mode (#18041)

• fix: handle parens in template expressions more robustly (#18075)

• fix: disallow -- in idPrefix (#18038)

• fix: correct types for ontoggle on <details> elements (#18063)

• fix: don't override $destroy/set/on instance methods in dev mode (#18034)

• fix: unskip branches of earlier batches after commit (#18048)

• fix: never set derived.v inside fork (#18037)

• fix: skip rebase logic in non-async mode (#18040)

• fix: don't reset status of uninitialized deriveds (#18054)

5.55.1

Patch Changes

• fix: correctly handle bindings on the server (#18009)

• fix: prevent hydration error on async {@html ...} (#17999)

• fix: cleanup superTypeParameters in ClassDeclarations/ClassExpression (#18015)

• fix: improve duplicate module import error message (#18016)

• fix: reschedule new effects in prior batches (Description has been truncated