npm / @angular/cli

@angular/cli

What changed in @angular/cli 20 to 22, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

7 security1 new APIs and options1 performance1 behavior and defaults2 tooling14 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@angular/cli 2221 changes

Adds the CSP nonce to stylesheet and modulepreload link elements.
22.2.3release notes
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
20.3.36, 21.2.23, 22.1.7security advisory

Resolves asset patterns concurrently with bounded concurrency.
22.2.3release notes

Avoids invalidating the diagnostic cache when a stylesheet changes.
22.2.3release notes
Coalesces external watcher directories to avoid the macOS FSEvents limit.
22.2.3release notes
Accepts array indices with multiple digits.
22.2.3release notes
Continues to work when the package manager is not installed.
22.2.3release notes
Resolves package names in npm workspace members.
22.2.3release notes
Preserves preload metadata for nested empty-path routes.
22.2.3release notes
Resolves relative redirects against the parent route.
22.2.3release notes
Preserves query parameters on relative route redirects.
22.2.3release notes
Ensures Sass importers return global Promise instances.
22.2.3release notes
Avoids stack overflow when chaining many rules.
22.2.3release notes
The migration now keeps the workspace build version.
22.2.3release notes
Keeps the Vite server file watcher disabled in Vitest watch mode.
22.2.3release notes
The SSR dev server preserves the Host header when proxying.
22.2.2release notes
Glob entries in proxy configuration retain their order.
22.2.2release notes

Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
19.2.25, 20.3.25, 21.2.9security advisory
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
20.3.21, 21.2.3security advisory
Angular SSR has an Open Redirect via X-Forwarded-Prefix
19.2.21, 20.3.17, 21.1.5security advisory
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
19.2.21, 20.3.17, 21.1.5security advisory

Angular SSR has a Server-Side Request Forgery (SSRF) flaw
19.2.18, 20.3.6security advisory