npm / @angular/localize

@angular/localize

What changed in @angular/localize 21 to 22, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

31 security1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@angular/localize 2216 changes

Security 15

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
20.3.32, 21.2.24, 22.2.0security advisory
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
20.3.31, 21.2.23, 22.1.6security advisory
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
20.3.30, 21.2.22, 22.1.4security advisory
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
20.3.30, 21.2.22, 22.1.4security advisory
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
20.3.30, 21.2.22, 22.1.4security advisory
Angular: Information Leak via HttpTransferCache Bypass When Using withRequestsMadeViaParent
20.3.28, 21.2.20, 22.1.1security advisory
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
20.3.28, 21.2.20, 22.1.0security advisory
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
20.3.27, 21.2.19, 22.0.7security advisory
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
20.3.27, 21.2.19, 22.0.2security advisory
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
20.3.25, 21.2.17, 22.0.1security advisory
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
20.3.25, 21.2.17, 22.0.1security advisory
@angular/common: Weak 32-Bit Cache Key Hashing in HttpTransferCache Leading to Cross-Request Data Leakage and State Poisoning
20.3.25, 21.2.17, 22.0.1security advisory
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
20.3.25, 21.2.17, 22.0.1security advisory
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
20.3.27, 21.2.19, 22.0.1security advisory
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
20.3.25, 21.2.17, 22.0.1security advisory

Fixes and other changes 1

Reserved characters are stripped from translations.
22.2.2release notes

@angular/localize 2116 changes

Security 16

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
19.2.25, 20.3.24, 21.2.16security advisory
@angular/platform-server: Missing <noscript> Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
19.2.25, 20.3.24, 21.2.16security advisory
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
19.2.23, 20.3.22, 21.2.15security advisory
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
19.2.23, 20.3.22, 21.2.15security advisory
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
19.2.23, 20.3.22, 21.2.15security advisory
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
19.2.23, 20.3.22, 21.2.15security advisory
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
19.2.23, 20.3.22, 21.2.15security advisory
@angular/service-worker: Request Credential & Cache Policy Stripping
19.2.23, 20.3.22, 21.2.15security advisory
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
19.2.22, 20.3.22, 21.2.15security advisory
@angular/platform-server: SSRF via Hostname Hijacking
19.2.22, 20.3.21, 21.2.13security advisory
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
19.2.21, 20.3.19, 21.2.9security advisory
Angular vulnerable to XSS in i18n attribute bindings
19.2.20, 20.3.18, 21.2.4security advisory
Angular i18n vulnerable to Cross-Site Scripting
19.2.19, 20.3.17, 21.1.6security advisory
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
19.2.18, 20.3.16, 21.0.7security advisory
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
19.2.17, 20.3.15, 21.0.2security advisory
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
19.2.16, 20.3.14, 21.0.1security advisory