npm / @angular/core

@angular/core

What changed in @angular/core 20 to 22, from its official release notes, upgrade guides and advisories. Also covers @angular/compiler, @angular/localize. Sources checked 2026-10-20.

3 breaking35 security1 performance1 behavior and defaults1 tooling7 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@angular/core 2225 changes

Breaking changes 1

The compiler disallows i18n event attributes, affecting which template attributes developers can mark for localization.
20.3.27, 21.2.19, 22.0.1release notes release notes security advisory

Security 16

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
20.3.33, 21.2.25, 22.2.1security advisory
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
20.3.33, 21.2.25, 22.2.1security advisory
Avoids dense elements allocation for numeric URL keys.
20.3.32, 21.2.24, 22.2.0release notes security advisory
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
20.3.31, 21.2.23, 22.1.6security advisory
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
20.3.30, 21.2.22, 22.1.4security advisory
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
20.3.30, 21.2.22, 22.1.4security advisory
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
20.3.30, 21.2.22, 22.1.4security advisory
Angular: Information Leak via HttpTransferCache Bypass When Using withRequestsMadeViaParent
20.3.28, 21.2.20, 22.1.1security advisory
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
20.3.28, 21.2.20, 22.1.0security advisory
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
20.3.27, 21.2.19, 22.0.7security advisory
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
20.3.27, 21.2.19, 22.0.2security advisory
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
20.3.25, 21.2.17, 22.0.1security advisory
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
20.3.25, 21.2.17, 22.0.1security advisory
@angular/common: Weak 32-Bit Cache Key Hashing in HttpTransferCache Leading to Cross-Request Data Leakage and State Poisoning
20.3.25, 21.2.17, 22.0.1security advisory
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
20.3.25, 21.2.17, 22.0.1security advisory
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
20.3.25, 21.2.17, 22.0.1security advisory

Performance 1

The runtime translations map is built with a null prototype, avoiding inherited-property lookups.
22.0.7release notes

Behavior and default changes 1

Compile-time i18n attribute validation now supports prefix-insensitive DOM schema lookups.
20.3.22, 21.2.15, 22.0.0release notes release notes release notes

Fixes and other changes 6

Reserved characters are stripped from translations.
22.2.2release notes
Avoids hitting TypeScript limits when a template contains many translations.
22.1.8release notes
Make i18n_util hasOwnProperty checks safe for property renaming.
22.1.2release notes
Placeholder lookup uses Object.hasOwn, avoiding inherited-property matches.
22.0.7release notes
Resolves a migration failure when tsconfig specifies rootDir.
22.0.4release notes
Tag names are normalized during runtime i18n attribute security context lookup.
20.3.22, 21.2.15, 22.0.0release notes release notes release notes

@angular/core 2122 changes

Breaking changes 2

Translations of iframe src are disallowed.
19.2.20, 20.3.18, 21.2.4release notes release notes release notes
Angular applies only known HTML attributes in translated ICU content; unknown attributes are dropped and not rendered, blocking creation of sensitive URI attributes.
19.2.19, 20.3.17, 21.1.6release notes release notes release notes security advisory

Security 19

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
19.2.25, 20.3.24, 21.2.16security advisory
@angular/platform-server: Missing <noscript> Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
19.2.25, 20.3.24, 21.2.16security advisory
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
19.2.23, 20.3.22, 21.2.15security advisory
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
19.2.23, 20.3.22, 21.2.15security advisory
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
19.2.23, 20.3.22, 21.2.15security advisory
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
19.2.23, 20.3.22, 21.2.15security advisory
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
19.2.23, 20.3.22, 21.2.15security advisory
@angular/service-worker: Request Credential & Cache Policy Stripping
19.2.23, 20.3.22, 21.2.15security advisory
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
19.2.22, 20.3.22, 21.2.15security advisory
@angular/platform-server: SSRF via Hostname Hijacking
19.2.22, 20.3.21, 21.2.13security advisory
Security-sensitive attributes in i18n bindings are now validated.
19.2.22, 20.3.20, 21.2.12release notes release notes release notes
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
19.2.21, 20.3.19, 21.2.9security advisory release notes
Validates the locale to prevent path traversal when determining an output path.
21.2.7release notes
Angular vulnerable to XSS in i18n attribute bindings
19.2.20, 20.3.18, 21.2.4security advisory
Translated form attributes are sanitized.
19.2.20, 20.3.18, 21.2.4release notes release notes release notes
Translated attribute bindings that contain interpolations are sanitized.
19.2.20, 20.3.18, 21.2.3release notes release notes release notes
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
19.2.18, 20.3.16, 21.0.7security advisory release notes
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
19.2.17, 20.3.15, 21.0.2security advisory release notes release notes release notes
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
19.2.16, 20.3.14, 21.0.1security advisory

Tooling 1

The ng-add schematic now supports the unit-test builder.
21.1.3release notes

@angular/core 201 changes

Fixes and other changes 1

Namespaced SVG <style> elements are no longer stripped by the compiler.
19.2.24, 20.3.23release notes release notes