build(deps): bump @angular/compiler from 20.3.13 to 20.3.18

[dependabot]

Bumps @angular/compiler from 20.3.13 to 20.3.18.

Release notes

Sourced from @​angular/compiler's releases.

20.3.18

compiler

Commit	Description
	disallow translations of iframe src

core

Commit	Description
	sanitize translated attribute bindings with interpolations
	sanitize translated form attributes

20.3.17

core

Commit	Description
	block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

• Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

  (cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

20.3.16

core

Commit	Description
	sanitize sensitive attributes on SVG script elements

20.3.15

compiler

Commit	Description
	prevent XSS via SVG animation attributeName and MathML/SVG URLs

20.3.14

http

Commit	Description
	prevent XSRF token leakage to protocol-relative URLs

Changelog

Sourced from @​angular/compiler's changelog.

20.3.18 (2026-03-12)

compiler

Commit	Type	Description
02fbf08890	fix	disallow translations of iframe src

core

Commit	Type	Description
72126f9a08	fix	sanitize translated attribute bindings with interpolations
626bc8bc20	fix	sanitize translated form attributes

22.0.0-next.3 (2026-03-12)

compiler

Commit	Type	Description
78dea55351	fix	disallow translations of iframe src

core

Commit	Type	Description
999c14eaab	fix	reverts "feat(core): add support for nested animations"
de0eb4c656	fix	sanitize translated form attributes

21.2.4 (2026-03-12)

compiler

Commit	Type	Description
ed2d324f9c	fix	disallow translations of iframe src

core

Commit	Type	Description
abbd8797bb	fix	reverts "feat(core): add support for nested animations"
d1dcd16c5b	fix	sanitize translated form attributes

22.0.0-next.2 (2026-03-11)

Breaking Changes

core

• createNgModuleRef was removed, use createNgModule instead

core

Commit	Type	Description
b918beda32	feat	allow debouncing signals

... (truncated)

Commits

• 02fbf08 fix(compiler): disallow translations of iframe src
• c2c2b4a fix(core): sanitize sensitive attributes on SVG script elements
• d1ca8ae fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
• See full diff in compare view