chore(deps): bump @angular/platform-server from 20.3.21 to 20.3.24

[dependabot]

Bumps @angular/platform-server from 20.3.21 to 20.3.24.

Release notes

Sourced from @​angular/platform-server's releases.

20.3.24

platform-server

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

20.3.23

compiler

Commit	Description
	prevent namespaced SVG elements from being stripped

20.3.22

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68926)
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68926)
	strip namespaced SVG script elements during template compilation (#68926)

core

Commit	Description
	normalize tag names in runtime i18n attribute security context lookup (#68926)
	reject script element as a dynamic component host (#68926)
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68926)
	synchronize core sanitization schema with compiler (#68926)

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Description
	preserve redirect policy on reconstructed asset requests
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

Changelog

Sourced from @​angular/platform-server's changelog.

20.3.24 (2026-06-02)

platform-server

Commit	Type	Description
6ca433e56b	fix	throw on suspicious URLs and restrict protocol-relative URLs
8680b5152f	fix	update domino to latest version

21.2.15 (2026-05-28)

common

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

compiler

Commit	Type	Description
0b07f47bd6	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
eb1cbbf2eb	fix	prevent namespaced SVG elements from being stripped
cc1378d54b	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
782e01594e	fix	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Type	Description
ff12fe55ac	fix	normalize tag names in runtime i18n attribute security context lookup (#68925)
e6fe77cc97	fix	sanitize meta selectors
daaf32937f	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
dada86e43d	fix	synchronize core sanitization schema with compiler (#68925)

http

Commit	Type	Description
582a417bd2	fix	exclude withCredentials requests from transfer cache
5c6d6df34b	fix	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Type	Description
37e8aadf87	fix	prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e	fix	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Type	Description
b8bd49341d	fix	Preserves explicit 'credentials: omit' in asset requests
ca32fc1000	fix	Preserves HTTP cache mode in asset group requests

19.2.24 (2026-05-28)

... (truncated)

Commits

• 6ca433e fix(platform-server): throw on suspicious URLs and restrict protocol-relative...
• c99d9f0 refactor(platform-server): extract parseUrl regex and add comments for URL pa...
• 49a60f6 fix(platform-server): secure location and document initialization against SSR...
• See full diff in compare view

[just1and0]

@dependabot rebase