chore(deps): bump the npm_and_yarn group across 3 directories with 16 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the /vision/sample-apps/V-Start directory: jws and path-to-regexp.
Bumps the npm_and_yarn group with 13 updates in the /gemini/sample-apps/quickbot/website-search-using-agent-builder/frontend directory:

Package	From	To
cookie	0.4.2	0.7.2
@angular/common	15.2.10	21.2.15
@angular/compiler	15.2.10	21.2.15
@angular/core	15.2.10	21.2.15
ajv	6.12.6	6.15.0
picomatch	2.3.1	2.3.2
minimatch	3.1.2	3.1.5
protobufjs	6.11.4	7.6.1
ip-address	9.0.5	10.2.0
firebase	9.23.0	11.10.0
tar	6.2.1	7.5.15
flatted	3.3.1	3.4.2
follow-redirects	1.15.6	1.16.0

Bumps the npm_and_yarn group with 13 updates in the /gemini/sample-apps/quickbot/text-to-image-using-imagen3/frontend directory:

Package	From	To
path-to-regexp	0.1.12	0.1.13
@angular/common	15.2.10	21.2.15
@angular/compiler	15.2.10	21.2.15
@angular/core	15.2.10	21.2.15
ajv	6.12.6	6.15.0
picomatch	2.3.1	2.3.2
minimatch	3.1.2	3.1.5
protobufjs	6.11.4	7.6.1
ip-address	9.0.5	10.2.0
firebase	9.23.0	11.10.0
tar	6.2.1	7.5.15
flatted	3.3.2	3.4.2
follow-redirects	1.15.9	1.16.0

Updates jws from 4.0.0 to 4.0.1

Release notes

Sourced from jws's releases.

v4.0.1

Changed

• Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
• Upgrading JWA version to 2.0.1, addressing a compatibility issue for Node >= 25.

Changelog

Sourced from jws's changelog.

[4.0.1]

Changed

• Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
• Upgrading JWA version to 2.0.1, adressing a compatibility issue for Node >= 25.

[3.2.3]

Changed

• Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
• Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.

[3.0.0]

Changed

• BREAKING: jwt.verify now requires an algorithm parameter, and jws.createVerify requires an algorithm option. The "alg" field signature headers is ignored. This mitigates a critical security flaw in the library which would allow an attacker to generate signatures with arbitrary contents that would be accepted by jwt.verify. See https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ for details.

2.0.0 - 2015-01-30

Changed

• BREAKING: Default payload encoding changed from binary to utf8. utf8 is a is a more sensible default than binary because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. ([6b6de48])

• Code reorganization, thanks [@​fearphage]! (7880050)

Added

• Option in all relevant methods for encoding. For those few users that might be depending on a binary encoding of the messages, this is for them. ([6b6de48])

... (truncated)

Commits

• 34c45b2 Merge commit from fork
• 49bc39b version 4.0.1
• d42350c Enhance tests for HMAC streaming sign and verify
• 5cb007c Improve secretOrKey initialization in VerifyStream
• f9a2e1c Improve secret handling in SignStream
• b9fb8d3 Merge pull request #102 from auth0/SRE-57-Upload-opslevel-yaml
• 95b75ee Upload OpsLevel YAML
• 8857ee7 test: remove unused variable (#96)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.

Updates path-to-regexp from 0.1.12 to 0.1.13

Release notes

Sourced from path-to-regexp's releases.

0.1.13

Important

• Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

Full Changelog: pillarjs/path-to-regexp@v0.1.12...v.0.1.13

Changelog

Sourced from path-to-regexp's changelog.

0.1.13 / 2026-03-26

• Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

0.1.7 / 2015-07-28

• Fixed regression with escaped round brackets and matching groups.

0.1.6 / 2015-06-19

• Replace index feature by outputting all parameters, unnamed and named.

0.1.5 / 2015-05-08

• Add an index property for position in match result.

0.1.4 / 2015-03-05

• Add license information

0.1.3 / 2014-07-06

• Better array support
• Improved support for trailing slash in non-ending mode

0.1.0 / 2014-03-06

• add options.end

0.0.2 / 2013-02-10

• Update to match current express
• add .license property to component.json

Commits

• 9fd0c87 0.1.13 (#425)
• 7ccf02c fix: CVE-2026-4867
• See full diff in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for path-to-regexp since your current version.

Updates cookie from 0.4.2 to 0.7.2

Release notes

Sourced from cookie's releases.

v0.7.2

Fixed

• Fix object assignment of hasOwnProperty (#177) bc38ffd

jshttp/cookie@v0.7.1...v0.7.2

0.7.1

Fixed

• Allow leading dot for domain (#174)
  • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
• Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)

jshttp/cookie@v0.7.0...v0.7.1

0.7.0

• perf: parse cookies ~10% faster (#144 by @​kurtextrem and #170)
• fix: narrow the validation of cookies to match RFC6265 (#167 by @​bewinsnw)
• fix: add main to package.json for rspack (#166 by @​proudparrot2)

jshttp/cookie@v0.6.0...v0.7.0

0.6.0

• Add partitioned option

0.5.0

• Add priority option
• Fix expires option to reject invalid dates
• pref: improve default decode speed
• pref: remove slow string split in parse

Commits

• d19eaa1 0.7.2
• bc38ffd Fix object assignment of hasOwnProperty (#177)
• cf4658f 0.7.1
• 6a8b8f5 Allow leading dot for domain (#174)
• 58015c0 Remove more code and perf wins (#172)
• ab057d6 0.7.0
• 5f02ca8 Migrate history to GitHub releases
• a5d591c Migrate history to GitHub releases
• 51968f9 Skip isNaN
• 9e7ca51 perf(parse): cache length, return early (#144)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.

Updates @angular/common from 15.2.10 to 21.2.15

Release notes

Sourced from @​angular/common's releases.

21.2.15

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
	prevent namespaced SVG elements from being stripped
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Description
	normalize tag names in runtime i18n attribute security context lookup (#68925)
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
	synchronize core sanitization schema with compiler (#68925)

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	prevent SSRF bypasses via backslash URLs in HttpClient
	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Description
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

21.2.14

compiler

Commit	Description
	strip namespaced SVG script elements during template compilation

core

Commit	Description
	do not insert todo when migrating void @​Output
	makes resource URL sanitizer lookup case-insensitive
	reject script element as a dynamic component host
	visit ICU expressions in signal migration schematics

router

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

21.2.15 (2026-05-28)

common

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

compiler

Commit	Type	Description
0b07f47bd6	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
eb1cbbf2eb	fix	prevent namespaced SVG elements from being stripped
cc1378d54b	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
782e01594e	fix	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Type	Description
ff12fe55ac	fix	normalize tag names in runtime i18n attribute security context lookup (#68925)
e6fe77cc97	fix	sanitize meta selectors
daaf32937f	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
dada86e43d	fix	synchronize core sanitization schema with compiler (#68925)

http

Commit	Type	Description
582a417bd2	fix	exclude withCredentials requests from transfer cache
5c6d6df34b	fix	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Type	Description
37e8aadf87	fix	prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e	fix	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Type	Description
b8bd49341d	fix	Preserves explicit 'credentials: omit' in asset requests
ca32fc1000	fix	Preserves HTTP cache mode in asset group requests

19.2.24 (2026-05-28)

compiler

Commit	Type	Description
6ea6379123	fix	prevent namespaced SVG elements from being stripped

20.3.23 (2026-05-28)

compiler

... (truncated)

Commits

• 582a417 fix(http): exclude withCredentials requests from transfer cache
• 5c6d6df fix(http): skip TransferCache for cookie-bearing requests by default
• 300f61f fix(common): sanitize placeholder
• 7f4ac78 fix(common): add upper bounds for digitsInfo
• 30cf85f refactor(common): update deprecation message
• 42d57c3 refactor(common): fix viewport tests
• 10ad3c0 fix(common): prevent focus from scrollToAnchor
• 540536c fix(http): add CSP nonce support to JsonpClientBackend
• 8102331 test(http): disable XSRF and mock location in HttpClient tests to avoid Domin...
• 13f050d test: construct local Date objects to fix timezone flakiness
• Additional commits viewable in compare view

Updates @angular/compiler from 15.2.10 to 21.2.15

Release notes

Sourced from @​angular/compiler's releases.

21.2.15

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
	prevent namespaced SVG elements from being stripped
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Description
	normalize tag names in runtime i18n attribute security context lookup (#68925)
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
	synchronize core sanitization schema with compiler (#68925)

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	prevent SSRF bypasses via backslash URLs in HttpClient
	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Description
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

21.2.14

compiler

Commit	Description
	strip namespaced SVG script elements during template compilation

core

Commit	Description
	do not insert todo when migrating void @​Output
	makes resource URL sanitizer lookup case-insensitive
	reject script element as a dynamic component host
	visit ICU expressions in signal migration schematics

router

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.15 (2026-05-28)

common

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

compiler

Commit	Type	Description
0b07f47bd6	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
eb1cbbf2eb	fix	prevent namespaced SVG elements from being stripped
cc1378d54b	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
782e01594e	fix	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Type	Description
ff12fe55ac	fix	normalize tag names in runtime i18n attribute security context lookup (#68925)
e6fe77cc97	fix	sanitize meta selectors
daaf32937f	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
dada86e43d	fix	synchronize core sanitization schema with compiler (#68925)

http

Commit	Type	Description
582a417bd2	fix	exclude withCredentials requests from transfer cache
5c6d6df34b	fix	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Type	Description
37e8aadf87	fix	prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e	fix	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Type	Description
b8bd49341d	fix	Preserves explicit 'credentials: omit' in asset requests
ca32fc1000	fix	Preserves HTTP cache mode in asset group requests

19.2.24 (2026-05-28)

compiler

Commit	Type	Description
6ea6379123	fix	prevent namespaced SVG elements from being stripped

20.3.23 (2026-05-28)

compiler

... (truncated)

Commits

• eb1cbbf fix(compiler): prevent namespaced SVG <style> elements from being stripped
• 29ceeff docs: fix typos in source code comments
• 782e015 fix(compiler): strip namespaced SVG script elements during template compilati...
• ff12fe5 fix(core): normalize tag names in runtime i18n attribute security context loo...
• 0b07f47 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
• cc1378d fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
• daaf329 fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
• 68282df fix(compiler): strip namespaced SVG script elements during template compilation
• 6652ec0 refactor(core): align namespaced attribute validation and security schema con...
• baf92da test: remove invalid css that was causing issues with the postcss parser
• Additional commits viewable in compare view

Updates @angular/core from 15.2.10 to 21.2.15

Release notes

Sourced from @​angular/core's releases.

21.2.15

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
	prevent namespaced SVG elements from being stripped
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Description
	normalize tag names in runtime i18n attribute security context lookup (#68925)
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
	synchronize core sanitization schema with compiler (#68925)

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	prevent SSRF bypasses via backslash URLs in HttpClient
	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Description
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

21.2.14

compiler

Commit	Description
	strip namespaced SVG script elements during template compilation

core

Commit	Description
	do not insert todo when migrating void @​Output
	makes resource URL sanitizer lookup case-insensitive
	reject script element as a dynamic component host
	visit ICU expressions in signal migration schematics

router

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

21.2.15 (2026-05-28)

common

Commit	Type	Description
7f4ac78994	fix	add upper bounds for digitsInfo
300f61feb3	fix	sanitize placeholder

compiler

Commit	Type	Description
0b07f47bd6	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
eb1cbbf2eb	fix	prevent namespaced SVG elements from being stripped
cc1378d54b	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
782e01594e	fix	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Type	Description
ff12fe55ac	fix	normalize tag names in runtime i18n attribute security context lookup (#68925)
e6fe77cc97	fix	sanitize meta selectors
daaf32937f	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
dada86e43d	fix	synchronize core sanitization schema with compiler (#68925)

http

Commit	Type	Description
582a417bd2	fix	exclude withCredentials requests from transfer cache
5c6d6df34b	fix	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Type	Description
37e8aadf87	fix	prevent SSRF bypasses via backslash URLs in HttpClient
72696e244e	fix	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Type	Description
b8bd49341d	fix	Preserves explicit 'credentials: omit' in asset requests
ca32fc1000	fix	Preserves HTTP cache mode in asset group requests

19.2.24 (2026-05-28)

compiler

Commit	Type	Description
6ea6379123	fix	prevent namespaced SVG elements from being stripped

20.3.23 (2026-05-28)

compiler

... (truncated)

Commits

• 29ceeff docs: fix typos in source code comments
• 251c8f2 test(core): remove obsolete SVG script sanitization translation test (#68925)
• dada86e fix(core): synchronize core sanitization schema with compiler (#68925)
• 782e015 fix(compiler): strip namespaced SVG script elements during template compilati...
• ff12fe5 fix(core): normalize tag names in runtime i18n attribute security context loo...
• 0b07f47 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
• cc1378d fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
• daaf329 fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
• 1d6e71d docs: clarify ngDoCheck invocation behavior with OnPush strategy
• 49113ac fix(core): visit ICU expressions in signal migration schematics
• Additional commits viewable in compare view

Updates prismjs from 1.29.0 to 1.30.0

Release notes

Sourced from prismjs's releases.

v1.30.0

What's Changed

• check that currentScript is set by a script tag by @​lkuechler in PrismJS/prism#3863

New Contributors

• @​lkuechler made their first contribution in PrismJS/prism#3863

Full Changelog: PrismJS/prism@v1.29.0...v1.30.0

Changelog

Sourced from prismjs's changelog.

Prism Changelog

Commits

• 76dde18 Release 1.30.0
• 93cca40 npm pkg fix
• 99c5ca9 Add release script
• 8e8b935 check that currentScript is set by a script tag (#3863)
• f894dc2 Fix logo in the footer
• ac38dce Delete CNAME
• 9b5b09a Enable CORS
• See full diff in compare view

Maintainer changes

This version was pushed to npm by dmitrysharabin, a new releaser for prismjs since your current version.

Updates ajv from 6.12.6 to 6.15.0

Commits

• 184bc32 6.15.0
• fea46af test/fix prototype pollution via $data ref with format keyword (#2606)
• e3af0a7 6.14.0
• b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
• 72f2286 docs: update v7 info
• 231e52b Merge pull request #1320 from philsturgeon/patch-1
• d3475fc Add spectral, an AJV util from a sponsor
• 413afe0 docs: v7.0.0-beta.3
• 11e997b update readme for v7
• See full diff in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from