Angular

Summary

Core and compiler updates replace hasOwnProperty with Object.hasOwn, add readonly array support for metadata decorators, expose debuggableFn for signal nodes, and improve hydration error handling.

Summary

Event handler attributes (e.g., onclick) are no longer allowed on <meta> elements.

Summary

Disallows inline event handler attributes (e.g., onclick) in <meta> tags.

Summary

Fixed optional chaining expression generation and corrected symbol resolution for SafePropertyRead in the compiler CLI.

Summary

Sanitized host bindings on concrete hosts to improve security and data integrity

Summary

Sanitize host bindings on concrete hosts to improve security

Summary

Added template type‑checking that supports inline typecheck blocks

Summary

Added post‑runtime hydration triggers and enabled root interceptors in the terminal request chain.

Summary

Restricts i18n event attributes and limits event handler checks to property names longer than two characters.

Summary

Added extensive foreign‑component support and CSS‑var namespacing, including logical containers, host‑binding sanitization, and correct anchor ordering.

Summary

Disallow i18n event attributes and restrict event handler checks to property names longer than two characters

Summary

Preserve crossorigin attribute on image preloads and make SVG animation attributeName checks case‑insensitive

Summary

Added support for static attributes on explicit input transforms, multiple async validators, and preservation of intermediate number values in signal forms.

Summary

Updated Babel dependencies to v7 core and fixed caching bugs: missing locale data and Set-Cookie responses are no longer cached.

Summary

Updated Babel to latest v7 core in the compiler CLI

Summary

Added optional chaining for safe function calls in TCBs and made extractValue reactive for AbstractControl migrations.

Summary

Updated I18nSelectPipe to use Object.hasOwn for safer handling of null‑prototype objects and shadowed mappings.

Summary

Fix migration failure when tsconfig specifies a rootDir

Summary

Compiler improves JIT partial‑declarations handling and removes unused imports; CLI, Core, and HTTP add resilience by reporting diagnostics for malformed host bindings, avoiding uncaught promise errors in injectAsync, and preventing cach...

Summary

Skip transfer cache for uncacheable HTTP traffic and credentialed fetch requests, and add distinct handling for repeated transfer cache parameters.

Summary

Resolve relative workspace tsdk paths to absolute in VSCode extension

Summary

Hardened security by using SHA‑256 for cache keys, sanitizing MathML href attributes, stripping sensitive headers on cross‑origin redirects, and rejecting non‑HTTP(S) URLs in JSONP requests; added protections against prototype‑pollution ...

Summary

Hardened transfer cache and platform security by using SHA‑256 keys, skipping cache for uncacheable or credentialed requests, validating origin and stripping sensitive headers on cross‑origin redirects.

Summary

Improved security hardening: SHA‑256 transfer cache keys, TransferState DOM clobbering protection, lowercase SVG animation validation, JSONP URL restrictions, SSR origin checks, and service worker removal of sensitive headers on cross‑or...

Summary

Bundle updated to TypeScript 6.0, breaking existing configs because strict mode now defaults to true – adjust tsconfig or tsdk accordingly.

Summary

Breaking changes include new nullish diagnostics (nullishCoalescingNotNullable, optionalChainNotNullable) that cause compile errors, removal of duplicate input/output handling, compile‑time errors for multiple matching selectors, droppin...

Summary

Stripped literal “/index.html” suffix from URLs in the common module (minor/bugfix).

Summary

Added validation to throw errors for suspicious URLs and restrict protocol-relative URLs.

Summary

Add error handling for suspicious URLs

Summary

Disabled the VSCode language server in untrusted workspaces and added confirmation prompts before loading a workspace TypeScript SDK

Summary

Enhanced sanitization and tag name normalization across compiler, runtime, and SVG handling, syncing core sanitization schema.

Summary

Updated the compiler to retain namespaced SVG <style> elements during processing.

Summary

Prevent namespaced SVG <style> elements from being stripped during compilation

Summary

Added comprehensive sanitization and namespace handling: upper‑bounds for digitsInfo, normalized tag names (including custom namespaces) in compiler and runtime, and stripped/filtered unsafe SVG/script elements.

Summary

Added extensive sanitization updates: upper bounds for digitsInfo, normalized tag names, SVG href/xlink sanitization, stripping namespaced SVG script elements, rejecting script elements as component hosts, and synchronized core sanitizat...

Summary

Compiler and core tighten security: strip namespaced SVG script elements, reject script elements as dynamic component hosts, and make resource URL sanitizer lookup case‑insensitive.

Summary

Disallow event attribute bindings in host bindings, enforcing stricter security and potentially breaking existing code

Summary

Core now rejects event attribute bindings in host bindings, enforcing stricter rules (potential breaking change).

Summary

Added allowedHosts option to renderModule

Summary

Added explicit read generics for signal input transforms and enhanced signal migration support (e.g., visiting ngLet expression values).

Summary

Core: Disallow event attribute bindings in host bindings unconditionally, tightening security.

Summary

Fixed focus handling for scrollToAnchor and corrected declaration span range in the compiler.

Summary

Improved link formatting in the "Animating your Application with CSS" documentation.

Summary

Fix SSRF bypasses by rejecting protocol‑relative URLs

Summary

Prevented SSRF bypasses using protocol‑relative URLs.

Summary

Escape forward slashes in TransferState and normalize multiple leading slashes in URL parsing to improve crawler handling and routing consistency.

Summary

Compiler updates: support nested brackets in host object bindings and fix errors with type parameter declarations.

Summary

Add several security hardenings: register SVG animation attributes in the URL security context, block unsafe SVG animation bindings, treat object[data] as a resource URL, and validate locales to prevent path‑traversal.

Summary

Avoid redundant image fetches on destroy with auto sizes compiler

Summary

Fixed compiler code generation: proper parsing of digit-containing HTML entities, escaped template literals in TCB, and corrected generic type handling in type checks.

Summary

Disallow translation of iframe src attributes to block unsafe URLs

Summary

Disallows translation of iframe src attributes to block unsafe URLs

Summary

Disallow translations of iframe `src` attribute in the compiler.

Summary

Performed internal code refactorings with no visible changes to functionality

Summary

Ensured core definitions compile correctly.

Summary

Prevent mutation of the children array in RecursiveVisitor to ensure stable traversal

Summary

Update the VSCode extension to bundle TypeScript 5.9 internally

Summary

Added a transfer cache to httpResource to improve hydration handling and cache blob responses correctly.

Summary

Added lightweight project warmup for Angular analysis in the language service.

Summary

Core Angular now sanitizes ICU message translations by only applying known HTML attributes, dropping unknown ones.

Summary

Blocks creation of sensitive URI attributes within ICU message translations.

Summary

Added numerous compiler and runtime features: 'outlet' injector option for ngTemplateOutlet, ChangeDetectionStrategy.Eager alias, support for instanceof operator, nested animations, TypeScript 6, and enhanced ImageLoaderConfig.

Summary

Fix LCP image detection when duplicate URLs are present

Summary

Fix VSCode extension highlighting for optional chaining in function calls and for class bindings with brackets.

Summary

No user‑facing changes in this release.

Summary

Added geolocation element to core schema and support for signal‑based schemas in validation

Summary

Fixed linkedSignal.update to propagate errors, resolved debounce promise on abort and added a URL parser recursion limit to prevent stack overflow.

Summary

Forms now submit only visible, interactive fields

Summary

Add syntax highlighting for arrow functions in the VSCode extension

Summary

Compiler CLI drops the .tsx extension for generated relative imports.

Summary

Added custom image transformation support for Cloudflare, Cloudinary, ImageKit and Imgix loaders, plus multiple switch‑case matching and spread syntax handling

Summary

Adjusted control instruction order to follow other bindings.

Summary

Fixed conversion of enum member kind in VSCode extension completion items

Summary

Fixed memory leak caused by event replay

Summary

Sanitizes potentially dangerous attributes on SVG <script> elements

Summary

Added sanitization for sensitive attributes within SVG <script> elements.

Summary

- Enhanced compiler type accuracy (AST nodes, typeof/void spans, map key locations) and fixed component import diagnostics.

Summary

Prevent language service crashes caused by suggestion diagnostic errors

Summary

Updated SignalFormsConfig.classes to accept a Field directive instead of FieldState, introducing a breaking change for forms implementations.

Summary

Prevent false positive deprecation warnings when using InjectionToken with factory-only providers.

Summary

Extended compiler CLI with chain query creation and dynamic type support for native controls.

Summary

Compiler and core fixes: avoid signal allocation in production, ensure radio button values are strings, run animation queue in injector context, and fix viewProviders injection with host directives.

Summary

Added sanitization to block XSS vectors through SVG animation 'attributeName' attributes.

Summary

Fixed XSS vulnerability in SVG animation attributeName handling

Summary

Sanitized SVG animation attributeName to block XSS vectors.

Summary

Fixed XSRF token leakage in protocol‑relative URLs

Summary

Prevent XSRF token leakage to protocol‑relative URLs.

Summary

Added DI option for classes on the Field directive and enabled dynamic type bindings for signal form controls.

Summary

Fix memory leak in the language service when creating a project.

Summary

Added experimental Navigation API support, signal‑based forms, and many compiler/template enhancements (host binding type checking, IntersectionObserver options, regex in templates).

Summary

Added deeper nesting and complex selector support for :host and :nth‑child, including commas and an extra nesting level.

Summary

Reduced noise in required inputs diagnostics for the compiler CLI.

Summary

Block IPv6 localhost from preconnect checks

Summary

Fixed multiple bugs across animations, compiler, core, and router modules, including handling Element.animate exceptions, correct compilation of long numeric HTML entities, and false-negative diagnostics for missing structural directives.

Summary

Update animation scheduling in the core module.

Summary

Added metadata capture for undecorated fields and improved router scroll restoration with instant behavior

Summary

Fix animation handling: missing leave animations no longer queue, undefined CSS time values are safely parsed, and early exit from leave animations when multiple transitions are present is prevented.

Summary

Compiler now recovers template literals with broken expressions.

Summary

Added metadata capture for undecorated fields and improved import alias resolution in defer blocks and migrations.

Summary

Add support for the aria-invalid attribute in the compiler and improve CLI binding to only microsyntax inputs for structural directives.

Summary

Introduced `BootstrapContext` to replace the global platform injector in server-side bootstrapping.

Summary

Introduced BootstrapContext for improved server-side bootstrapping.

Summary

Removed the Refresh button from the Transfer State tab.

Summary

Fixed inject migration schematics to correctly handle destructured property migrations.

Summary

Fixed regression in event parsing and animate prefix handling.

Summary

Fixed animation handling for elements with structural directives, ensuring @for loop animations are not cancelled.

Summary

Compiler now retains parentheses when handling nullish coalescing combined with Boolean expressions.

Summary

Add a new currentNavigation signal to Router and deprecate Router.getCurrentNavigation, deprecate the animations package and related component field, and introduce numerous animation enhancements (enter/leave instructions, ARIA attribute...

Summary

Fixed error when ng-content fallback contains translated children

Summary

Fixed incorrect AST spans for input values with leading spaces in the compiler

Summary

Corrected type checking for host listeners in the compiler CLI and fixed core detection of failed fetch responses during JIT loading of external resources.

Summary

Exclude additional safe‑read expressions from two‑way binding in the compiler

Summary

Fix change tracking for Resource hasValue

Summary

Fixed detection of directive dependencies in JIT compilation.

Summary

Compiler fixes: corrected binary operation span handling, added permissive @‑character parsing, and CLI now infers event target types for void elements.

Summary

Add extensive support for fetch‑based HTTP options (cache, priority, credentials, keepalive, mode, redirect, timeout) and improve HttpClient diagnostics;

Summary

Updated compiler CLI to use the proper diagnostic type name.

Summary

Added pipe‑missing suggestion and improved initializer API handling in the compiler CLI.

Summary

Fixed template outlet hydration and ensured APP ID injection occurs before injector disposal

Summary

Fixed traversal marking causing reactive context reset in components (PR #61663)

Summary

- Compiler parser improvements: moved defer trigger assertions out of the parser and added recovery for invalid parenthesized expressions.

Summary

Removed legacy APIs and introduced breaking changes: dropped TypeScript <5.8 support, removed InjectFlags from injector/TestBed, eliminated TestBed.flushEffects (use TestBed.tick), renamed afterRender to afterEveryRender, renamed and alt...

Summary

Add lexer support for template literals inside object literals

Summary

Prevented injection of ApplicationRef into FetchBackend to avoid unnecessary dependencies.

Summary

Fix reader cancellation and prevent chunk reads after app destruction

Summary

Fixed updateLatestValue to safely handle destroyed views before promise resolution

Summary

Async EventEmitter errors are now isolated to avoid destabilizing the app.

Summary

NgForm now emits a FormSubmittedEvent

Summary

NgOptimizedImage now logs a warning instead of throwing an error when the preload limit is exceeded.

Summary

Fixed compiler rawText estimation error and language service completion bugs (end‑tag and dollar‑sign escaping).

Summary

Updated tutorial docs (step 6) and added missing peer dependency on @angular/common.

Summary

Fix core bug where used templates were not deleted (60459).

Summary

Improved diagnostics and error messages for invalid imports and missing input names.

Summary

Added equality support to httpResource and enhanced HMR generation for transformed classes.

Summary

Clean up onUrlChange listener removal on root scope destruction and add caching for ComponentRef inputs/outputs.

Summary

Introduced experimental httpResource, added streaming support, default values, cancel‑on‑duplicate request handling, and updated compatibility to TypeScript 5.8.

Summary

Fixed initialization order and added stack capture for HMR errors, improving runtime stability.

Summary

Cleaned up urlChanges subscribers when root scope is destroyed.

Summary

Updated compiler to support tracking expressions requiring temporary variables and correctly handle deferred blocks with shared dependencies

Summary

Gracefully fallback when const enums cannot be passed through

Summary

Improved stability by checking for destroyed applications before printing hydration stats, preserving types during HMR, and preventing error handling when the injector is destroyed.

Summary

Improved HMR handling: support for :host selector with comma-separated child selectors, capture self‑referencing components, replace metadata in place, and clear renderer cache for async animations

Summary

Enhanced HMR support: disabled tree shaking, added handling for shadow‑DOM components, and fixed mismatched components with ViewContainerRef.

Summary

Implemented HMR replacement execution within Angular zones for the platform-browser.

Summary

Expose component instance in NgComponentOutlet and add event listener options to the renderer.

Summary

Extend dependency extraction to support additional node types in compiler CLI

Summary

Enhanced HMR support by handling additional expression types, preserving defer block dependencies when class metadata is disabled, and fixing style replacement with animation renderer.

Summary

Avoid triggering on timer and idle on the server

Summary

CLI now recognizes pre‑release versions when checking feature support.

Summary

No changelog details provided for this release.

Summary

Fix HMR to handle multiple generated namespace imports in the compiler CLI

Summary

Fixed test failures caused by importing both HttpClientModule and HttpClientTestingModule.

Summary

Enhanced compiler CLI diagnostics for host binding parser errors.

Summary

Breaking: Core directives, components, and pipes are now standalone by default; remove deprecated APIs like BrowserModule.withServerTransition, Router.errorHandler, and KeyValueDiffers.factories, and note that this.foo no longer refers t...

Summary

Fix generic extraction from type aliases in the compiler CLI.

Summary

Avoid slow stringification when checking for duplicate entries in development mode, improving performance.

Summary

Fixed pseudo-selector transformation for the encapsulated view.

Summary

Compiler CLI now emits a diagnostic when an NgModule imports or exports itself.

Summary

Add support for multiple and nested :host selectors and combinators inside pseudo-selectors, preserving attributes and specificity

Summary

Fix image handling bugs: remove placeholder when already loaded, prevent duplicate oversize warnings, and skip SVG oversize checks

Summary

Version 18.2.6 released on 2024-09-25.

Summary

Fixed extended diagnostics to correctly validate ICU messages

Summary

Compiler now emits clearer, less noisy errors when parsing control flow.

Summary

Updated internal request handling to dynamically invoke the global fetch implementation.

Summary

Fixed memory leak on component creation errors and stopped capture event bubbling.

Summary

Enable zoneless scheduler to run inside fakeAsync tests

Summary

Compiler adds new diagnostics (uncalled functions, unused lets, template attributes) and supports JIT transforms on classes and NgModules when `jit: true` is set.

Summary

Compiler CLI now generates valid TypeScript 5.6 type‑checking code.

Summary

Reduced naming conflicts between generated factories and local variables

Summary

Reduced conflicts between generated factories and local variables.

Summary

Compiler now caps the number of chained instructions and adds a CLI warning for unused `let` declarations.

Summary

Fixed several compiler and core bugs: preconnect assertion on server, JIT host directive handling, strict equality for code comparison, and callback registration issues.

Summary

Fixed JIT mode misinterpreting host directive configuration during partial compilation.

Summary

Enhanced compiler diagnostics: added warnings for uncalled functions, improved let‑declaration handling (precedence, conflict detection, nested checks) and displayed template syntax errors locally.

Summary

Fixed CSS animation rule scoping issue.

Summary

Fixed server-side preconnect assertion in common module.

Summary

Updated documentation for afterRender hooks.

Summary

Insert constant statements after the first import group in the compiler CLI.

Summary

Fixed headless Chrome browser name handling and several stability issues (EventEmitter, signals tracking, migration errors)

Summary

Prevent migration of HttpClientModule imports on components and fix alias variable generation in migrations.

Summary

No new features or changes documented for this release.