- Improved security hardening: SHA‑256 transfer cache keys, TransferState DOM clobbering protection, lowercase SVG animation validation, JSONP URL restrictions, SSR origin checks, and service worker removal of sensitive headers on cross‑or...
- Enhanced HTTP handling: limits on date format string length, preservation of empty referrer in HttpRequest, and skipping transfer cache for uncacheable or credentialed fetch requests.
- Deprecated Angular platform server XHR (ServerXhr) in favor of standard fetch APIs, marking it as a breaking change.