Bumps the npm_and_yarn group with 2 updates in the /demos/activated-route-delay-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/activated-route-destroy-race-condition-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/alligator-theme-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/app-initializer-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/autofocus-angular5 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/axios-http-client-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/bind-once-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/chained-keydown-events-angular9 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/css-keyframes-not-scoped-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /demos/date-add-angular11 directory: @angular/common, @angular/core and tar.
Bumps the npm_and_yarn group with 3 updates in the /demos/date-helper-angular11 directory: @angular/common, @angular/core and tar.
Bumps the npm_and_yarn group with 2 updates in the /demos/direct-click-plugin-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/drag-shield-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/element-scroll-directive-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/embedded-config-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/embracing-dom-access-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/event-plugin-data-angular5 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/event-prevent-default-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/file-upload-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 1 update in the /demos/file-upload-form-angular7 directory: @angular/common.
Bumps the npm_and_yarn group with 2 updates in the /demos/flexy-tabs-angular9 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/global-key-combos-angular5 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/hello-world-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/hide-scrollbars-until-hover-angular9 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/html2canvas-meme-angular9 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/lazy-load-intersection-observer-angular5 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/less-fade-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/location-hash-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/message-bus-actions-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/multi-use-existing-angular5 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/multiple-selectors-single-directive-angular5 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/named-route-outlet-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/nav-trigger-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/ng-on-init-may-not-be-called-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/pipe-component-method-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/pipe-component-method-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/prevent-secondary-view-on-refresh-angular5 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/recursive-components-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/recursive-templates-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/renderless-components-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/retro-location-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/route-redirect-sink-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/router-playground-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/router-retain-scroll-polyfill-angular7/with-polyfill directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/router-retain-scroll-polyfill-angular7/without-polyfill directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/runtime-abstraction2-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/rxjs-ngzone-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/send-statsd-from-browser-angular5 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/shared-style-urls-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/sticky-header-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/style-child-view-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/svg-icons-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/trap-scroll-angular4 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/trigger-dom-events-angular5 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/url-shortcuts2-view-angular7 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/webpack4-angular6 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/webpack4-angular6-aot directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/webpack4-angular9-cli directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/word-search-generator-angular9 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 2 updates in the /demos/wrap-3rd-party-libs-angular9 directory: @angular/common and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /demos/wrapping-arrays-for-calculations-angular10 directory: @angular/common, @angular/core and tar.
Bumps the npm_and_yarn group with 2 updates in the /demos/zone-sanity-check-angular5 directory: @angular/common and @angular/core.
Updates @angular/common from 4.4.6 to 20.3.25
Release notes
Sourced from @angular/common's releases.
20.3.25
common
| Commit |
Description |
 |
Limits date format string length |
 |
skip transfer cache for uncacheable HTTP traffic |
 |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
 |
sanitize two-way properties |
core
| Commit |
Description |
 |
harden TransferState restoration against DOM clobbering |
 |
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Description |
 |
preserve empty referrer option in HttpRequest |
 |
Rejects non-HTTP(S) URLs in JSONP requests |
 |
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Description |
 |
harden platform location origin validation during SSR |
 |
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Description |
 |
Strips sensitive headers on cross-origin redirects |
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
20.3.24
platform-server
| Commit |
Description |
 |
throw on suspicious URLs and restrict protocol-relative URLs |
 |
update domino to latest version |
20.3.23
compiler
| Commit |
Description |
 |
prevent namespaced SVG elements from being stripped |
20.3.22
common
... (truncated)
Changelog
Sourced from @angular/common's changelog.
20.3.25 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
common
| Commit |
Type |
Description |
| 9f443bc24c |
fix |
Limits date format string length |
| 566ad05f20 |
fix |
skip transfer cache for uncacheable HTTP traffic |
| 1a62130a6b |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| a68ec702a0 |
fix |
sanitize two-way properties |
core
| Commit |
Type |
Description |
| 768a349e6e |
fix |
harden TransferState restoration against DOM clobbering |
| ca48b4728d |
fix |
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Type |
Description |
| 06be298267 |
fix |
preserve empty referrer option in HttpRequest |
| fa940e1f4d |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
| e2ef1ce72a |
fix |
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Type |
Description |
| 49368c1859 |
fix |
harden platform location origin validation during SSR |
| d55c94ad81 |
refactor |
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Type |
Description |
| d65a5f457b |
fix |
Strips sensitive headers on cross-origin redirects |
22.0.0 (2026-06-03)
Blog post "Announcing Angular v22".
Breaking Changes
compiler
- This change will trigger the
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
- data prefixed attribute no-longer bind inputs nor outputs.
- The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
in variables will throw in template expressions.
compiler-cli
... (truncated)
Commits
06be298 fix(http): preserve empty referrer option in HttpRequest9f443bc fix(common): Limits date format string lengthfa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...566ad05 fix(common): skip transfer cache for uncacheable HTTP traffice2ef1ce fix(http): skip transfer cache for fetch credentialed requests3d135ce fix(common): add upper bounds for digitsInfo39a4b4c fix(common): sanitize placeholderde7b2a6 fix(http): exclude withCredentials requests from transfer cache4233188 fix(http): skip TransferCache for cookie-bearing requests by default- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by google-wombot, a new releaser for @angular/common since your current version.
Updates @angular/core from 4.4.6 to 20.3.25
Release notes
Sourced from @angular/core's releases.
20.3.25
common
| Commit |
Description |
|
Limits date format string length |
|
skip transfer cache for uncacheable HTTP traffic |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
sanitize two-way properties |
core
| Commit |
Description |
|
harden TransferState restoration against DOM clobbering |
|
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Description |
|
preserve empty referrer option in HttpRequest |
|
Rejects non-HTTP(S) URLs in JSONP requests |
|
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Description |
|
harden platform location origin validation during SSR |
|
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Description |
|
Strips sensitive headers on cross-origin redirects |
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
20.3.24
platform-server
| Commit |
Description |
|
throw on suspicious URLs and restrict protocol-relative URLs |
|
update domino to latest version |
20.3.23
compiler
| Commit |
Description |
|
prevent namespaced SVG elements from being stripped |
20.3.22
common
... (truncated)
Changelog
Sourced from @angular/core's changelog.
20.3.25 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
common
| Commit |
Type |
Description |
| 9f443bc24c |
fix |
Limits date format string length |
| 566ad05f20 |
fix |
skip transfer cache for uncacheable HTTP traffic |
| 1a62130a6b |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| a68ec702a0 |
fix |
sanitize two-way properties |
core
| Commit |
Type |
Description |
| 768a349e6e |
fix |
harden TransferState restoration against DOM clobbering |
| ca48b4728d |
fix |
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Type |
Description |
| 06be298267 |
fix |
preserve empty referrer option in HttpRequest |
| fa940e1f4d |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
| e2ef1ce72a |
fix |
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Type |
Description |
| 49368c1859 |
fix |
harden platform location origin validation during SSR |
| d55c94ad81 |
refactor |
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Type |
Description |
| d65a5f457b |
fix |
Strips sensitive headers on cross-origin redirects |
22.0.0 (2026-06-03)
Blog post "Announcing Angular v22".
Breaking Changes
compiler
- This change will trigger the
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
- data prefixed attribute no-longer bind inputs nor outputs.
- The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
in variables will throw in template expressions.
compiler-cli
... (truncated)
Commits
ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...49368c1 fix(platform-server): harden platform location origin validation during SSR566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic768a349 fix(core): harden TransferState restoration against DOM clobbering7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...6595409 test(core): update golden symbols and host bindings sanitization spec (#68926)d86e4e7 fix(core): reject script element as a dynamic component host (#68926)b8f1f72 test(core): remove obsolete blockquote cite host binding tests (#68926)36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by google-wombot, a new releaser for @angular/core since your current version.
Updates @angular/common from 4.4.6 to 20.3.25
Release notes
Sourced from @angular/common's releases.
20.3.25
common
| Commit |
Description |
|
Limits date format string length |
|
skip transfer cache for uncacheable HTTP traffic |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
sanitize two-way properties |
core
| Commit |
Description |
|
harden TransferState restoration against DOM clobbering |
|
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Description |
|
preserve empty referrer option in HttpRequest |
|
Rejects non-HTTP(S) URLs in JSONP requests |
|
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Description |
|
harden platform location origin validation during SSR |
|
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Description |
|
Strips sensitive headers on cross-origin redirects |
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
20.3.24
platform-server
| Commit |
Description |
|
throw on suspicious URLs and restrict protocol-relative URLs |
|
update domino to latest version |
20.3.23
compiler
| Commit |
Description |
|
prevent namespaced SVG elements from being stripped |
20.3.22
common
... (truncated)
Changelog
Sourced from @angular/common's changelog.
20.3.25 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
common
| Commit |
Type |
Description |
| 9f443bc24c |
fix |
Limits date format string length |
| 566ad05f20 |
fix |
skip transfer cache for uncacheable HTTP traffic |
| 1a62130a6b |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| a68ec702a0 |
fix |
sanitize two-way properties |
core
| Commit |
Type |
Description |
| 768a349e6e |
fix |
harden TransferState restoration against DOM clobbering |
| ca48b4728d |
fix |
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Type |
Description |
| 06be298267 |
fix |
preserve empty referrer option in HttpRequest |
| fa940e1f4d |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
| e2ef1ce72a |
fix |
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Type |
Description |
| 49368c1859 |
fix |
harden platform location origin validation during SSR |
| d55c94ad81 |
refactor |
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Type |
Description |
| d65a5f457b |
fix |
Strips sensitive headers on cross-origin redirects |
22.0.0 (2026-06-03)
Blog post "Announcing Angular v22".
Breaking Changes
compiler
- This change will trigger the
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
- data prefixed attribute no-longer bind inputs nor outputs.
- The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
in variables will throw in template expressions.
compiler-cli
... (truncated)
Commits
06be298 fix(http): preserve empty referrer option in HttpRequest9f443bc fix(common): Limits date format string lengthfa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...566ad05 fix(common): skip transfer cache for uncacheable HTTP traffice2ef1ce fix(http): skip transfer cache for fetch credentialed requests3d135ce fix(common): add upper bounds for digitsInfo39a4b4c fix(common): sanitize placeholderde7b2a6 fix(http): exclude withCredentials requests from transfer cache4233188 fix(http): skip TransferCache for cookie-bearing requests by default- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by google-wombot, a new releaser for @angular/common since your current version.
Updates @angular/core from 4.4.6 to 20.3.25
Release notes
Sourced from @angular/core's releases.
20.3.25
common
| Commit |
Description |
|
Limits date format string length |
|
skip transfer cache for uncacheable HTTP traffic |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
sanitize two-way properties |
core
| Commit |
Description |
|
harden TransferState restoration against DOM clobbering |
|
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Description |
|
preserve empty referrer option in HttpRequest |
|
Rejects non-HTTP(S) URLs in JSONP requests |
|
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Description |
|
harden platform location origin validation during SSR |
|
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Description |
|
Strips sensitive headers on cross-origin redirects |
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
20.3.24
platform-server
| Commit |
Description |
|
throw on suspicious URLs and restrict protocol-relative URLs |
|
update domino to latest version |
20.3.23
compiler
| Commit |
Description |
|
prevent namespaced SVG elements from being stripped |
20.3.22
common
... (truncated)
Changelog
Sourced from @angular/core's changelog.
20.3.25 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
common
| Commit |
Type |
Description |
| 9f443bc24c |
fix |
Limits date format string length |
| 566ad05f20 |
fix |
skip transfer cache for uncacheable HTTP traffic |
| 1a62130a6b |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| a68ec702a0 |
fix |
sanitize two-way properties |
core
| Commit |
Type |
Description |
| 768a349e6e |
fix |
harden TransferState restoration against DOM clobbering |
| ca48b4728d |
fix |
validate lowercase SVG animation attribute names (#69270) |
http
| Commit |
Type |
Description |
| 06be298267 |
fix |
preserve empty referrer option in HttpRequest |
| fa940e1f4d |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
| e2ef1ce72a |
fix |
skip transfer cache for fetch credentialed requests |
platform-server
| Commit |
Type |
Description |
| 49368c1859 |
fix |
harden platform location origin validation during SSR |
| d55c94ad81 |
refactor |
deprecate ServerXhr (#69256) |
service-worker
| Commit |
Type |
Description |
| d65a5f457b |
fix |
Strips sensitive headers on cross-origin redirects |
22.0.0 (2026-06-03)
Blog post "Announcing Angular v22".
Breaking Changes
compiler
- This change will trigger the
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
- data prefixed attribute no-longer bind inputs nor outputs.
- The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
in variables will throw in template expressions.
compiler-cli
... (truncated)
Commits
ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...49368c1 fix(platform-server): harden platform location origin validation during SSR566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic768a349 fix(core): harden TransferState restoration against DOM clobbering- Description has been truncated
![dependabot[bot]](https://github.com/dependabot.png){kind=small}
dependabot[bot]