chore(deps): bump @angular/router from 13.3.11 to 21.2.16

[dependabot]

Bumps @angular/router from 13.3.11 to 21.2.16.

Release notes

Sourced from @​angular/router's releases.

21.2.16

common

Commit	Description
	only strip a literal /index.html suffix from URLs

compiler

Commit	Description
	move projection attributes into constants

core

Commit	Description
	harden inherit definition feature against polluted prototypes
	use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

21.2.15

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
	prevent namespaced SVG elements from being stripped
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Description
	normalize tag names in runtime i18n attribute security context lookup (#68925)
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
	synchronize core sanitization schema with compiler (#68925)

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	prevent SSRF bypasses via backslash URLs in HttpClient
	secure location and document initialization against SSRF and path hijack

... (truncated)

Changelog

Sourced from @​angular/router's changelog.

21.2.16 (2026-06-03)

common

Commit	Type	Description
f6d8e642b0	fix	only strip a literal /index.html suffix from URLs

compiler

Commit	Type	Description
ae1c8a1f7a	fix	move projection attributes into constants

core

Commit	Type	Description
3fd6897a67	fix	harden inherit definition feature against polluted prototypes
7e38336dc7	fix	use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

Commit	Type	Description
66821c4ed5	fix	throw on suspicious URLs and restrict protocol-relative URLs
d3170031b6	fix	update domino to latest version

19.2.25 (2026-06-02)

platform-server

Commit	Type	Description
e2fb854d55	fix	throw on suspicious URLs and restrict protocol-relative URLs
0a8befb493	fix	update domino to latest version

20.3.24 (2026-06-02)

platform-server

Commit	Type	Description
6ca433e56b	fix	throw on suspicious URLs and restrict protocol-relative URLs
8680b5152f	fix	update domino to latest version

22.0.0-rc.3 (2026-06-01)

common

Commit	Type	Description
4795b35d5b	fix	only strip a literal /index.html suffix from URLs

compiler

| Commit | Type | Description |

... (truncated)

Commits

• 099bf57 fix(router): skip scroll-to-top on initial navigation when hydrating
• 161d98e docs: correct "Angular JS" to "AngularJS"
• fbe080f docs(router): Fix method name for retrieving stored handles
• 1be52ad docs: Align Router API docs with inject based DI
• fa4eff3 docs(docs-infra): Validate case-sensitive API symbol links in @link
• 580212c fix(router): restore internal URL on popstate when browserUrl is used
• 684e9fd fix(router): normalize multiple leading slashes in URL parser
• 0960592 fix(router): pass outlet context to split to fix empty path named outlets
• a21be36 refactor: prepare for required changeDetection prop on G3.
• 84adb2f refactor(router): Permit deferring commit of traversal navigations
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #371.