# What changed in @angular/cli

> 355 changes in @angular/cli 20 to 22 from its official release notes, upgrade guides and advisories: 31 breaking, 7 deprecations, 15 security, 23 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@angular/cli/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @angular/cli 22

### Breaking changes

- A prerendering failure now fails the build and excludes the affected routes. (22.1.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.7)
- The CLI no longer searches the current directory for bare executable names on Windows. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- Updating catalog packages now aborts and guides developers through manual mitigation when needed. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- The CLI no longer allows a registry environment variable to override Yarn's registry during updates. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- All route parameters are replaced when resolving relative redirects. (22.0.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.6)
- Removes the unused outDir setting from the generated app tsconfig. (22.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.5)
- The default workspace VS Code mcp.json configuration is removed. (22.0.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.3)
- Options now take precedence over environment variables. (22.0.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.2)
- Application builder output paths are restricted to the output directory. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)
- SSR no longer falls back to CSR for requests that fail host validation; unrecognized Host headers return 400, so valid hosts must be configured. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The package is no longer available; the architect CLI tool has moved to @angular-devkit/architect. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The experimental Jest builder has been removed. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The experimental Web Test Runner builder has been removed. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- istanbul-lib-instrument is now an optional peer dependency; Karma projects using code coverage must ensure it is installed. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- Node.js v20 is no longer supported; the minimum supported versions are v22.22.0 and v24.13.1. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The application builder option experimentalPlatform is renamed to platform. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The dev server gives PORT highest priority, overriding angular.json port settings and the --port flag, including the default port 4200. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- Proxy headers require explicit opt-in; when trustProxyHeaders is true, all X-Forwarded-* headers are supported. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)

### Security

- Adds the CSP nonce to stylesheet and modulepreload link elements. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows (20.3.36, 21.2.23, 22.1.7) — [security advisory](https://github.com/advisories/GHSA-7G7C-H8RR-7P6Q), [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.7), [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.23), [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.36)
- The loader preserves integrity and crossorigin attributes. (22.1.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.5)
- The best-practices tool enforces MCP roots and throws when a workspace is outside them; it also handles errors from isAllowedWorkspacePath. (22.1.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.5)
- The builder prevents OS command injection. (22.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.5)
- Dynamically loaded modules receive subresource integrity validation. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)

### Deprecations

- The splitting option is deprecated because disabling code splitting is no longer needed with Vitest 5. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- This API is deprecated; use the standard Web API TextDecoder instead. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- This API is deprecated; use the standard Web API TextEncoder instead. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- CommonEngine APIs are deprecated in favor of AngularNodeAppEngine or AngularAppEngine. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The @ngtools/webpack loader and plugin are deprecated; use @angular/build instead. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- Webpack builders in build-angular and build-webpack are deprecated; use @angular/build builders instead. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)

### New APIs and options

- Array-form proxy configurations support a string context. (22.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.2)
- The Vitest browser provider ng-add now adds the browsers option to angular.json. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Adds the --root command-line option to mcp. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- The unit-test builder gains an option to enable code splitting. (22.1.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.7)
- Vitest isolation can now be disabled from the builder. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)
- The headers option can configure Access-Control-Allow-Origin. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The unit-test builder adds an isolate option. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The unit-test builder adds a quiet option to suppress build noise in unit tests. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)

### Performance

- Resolves asset patterns concurrently with bounded concurrency. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Aggregate worker allocation is bounded across dominant files. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Concurrent worker allocation is bounded for dominant files. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- The worker no longer loads compiler-cli and TypeScript. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Chokidar no longer scans unimported node_modules in watch mode. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Reduces watcher debounce latency for faster incremental rebuilds. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- Updating the sourcemap ignore list avoids full JSON parsing. (22.1.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.8)
- Prerender routes are batched and in-memory server bundles are shared. (22.1.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.6)
- Releases build resources earlier when not running in watch mode. (22.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.3)
- Avoids buffering the request body when sanitizing headers. (22.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.3)
- Semaphore backpressure throttling is implemented in JavaScriptTransformer. (22.0.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.2)
- Registry query counts are optimized by fetching package metadata lazily. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)

### Behavior and default changes

- Always uses AOT when extracting i18n messages. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Uses the chokidar watcher when followSymlinks is enabled. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- Defaults preloadInitial to false when serviceWorker is enabled. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- Recursively ignores output and cache paths while watching. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- Temporary package installations are isolated from a parent Yarn workspace. (22.1.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.7)
- Supports case-insensitive and alternative license file names. (22.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.3)
- Always installs the package to inspect its manifest on disk for schematics. (22.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.3)
- Chunk optimization now uses Rolldown by default. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- Angular SSR now supports the standard Forwarded header. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- The persistent build cache is shared across Git worktrees. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- Chunk optimization is now enabled for server builds. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- The Istanbul coverage provider is favored when browser testing is enabled. (22.0.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.8)
- The semantic affected-file walk is skipped when type checking is disabled. (22.0.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.8)
- The Karma runner now falls back to the build target’s preserveSymlinks option. (22.0.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.6)
- The unit-test builder now inherits preserveSymlinks from the build target. (22.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.5)
- Non-SSG page lookups are no longer cached. (22.0.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.2)
- Semaphore backpressure throttling is implemented in PackageManager. (22.0.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.2)
- JSON imports are excluded from Vite dependency optimization. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)
- Migrations of the same version are no longer sorted alphabetically. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)
- On the first run, schematic detection falls back to the local package.json. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)
- Chunk optimization is enabled by default with heuristics. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- Generated components now default to OnPush change detection. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- Generated workspaces rely on the strict template default. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)

### Tooling

- Disables Vitest fsModuleCache in the unit-test builder. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Sorts discovered unit-test files for deterministic builds. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Emitted HTML assets are now served in the dev-server. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- The migration tool now skips components that have a change detection strategy. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Supports splitting browser and server stats JSON files for easier consumption. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- Pre-compiles critical CSS plans at build time. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- Compiles only included test files. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- Code splitting is enabled for Vitest browser tests. (22.1.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.7)
- The dev-server Vite cache is kept local to each worktree. (22.1.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.7)
- Side-effect annotations are ignored in unit test builds. (22.1.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.6)
- The refactor-jasmine-vitest schematic transforms fail() calls to expect.fail(). (22.1.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.5)
- The i18n inliner traverses the AST with an iterative post-order walker. (22.1.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.5)
- Code splitting is disabled for unit test builds. (22.1.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.5)
- The Angular schematic generates CLAUDE.md for Claude Code instead of AGENTS.md. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- A target is set for Rolldown dependency prebundling in the Vite dev server. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- Packages with built-in schematics are added to devDependencies only. (22.1.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.2)
- The CLI supports npm 12 metadata arrays and error formats, improving compatibility when using npm 12. (22.1.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.1)
- The generated AI configuration now includes Angular MCP server configuration. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- A built-in SQLite cache store is available as a fallback. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- Builds emit debug IDs to support stable subresource integrity hashes. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- Declare devserver_start as not read-only, allowing tools to treat it as a state-changing operation. (22.0.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.9)
- Declare devserver_stop as not read-only, allowing tools to treat it as a state-changing operation. (22.0.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.9)
- Dependency resolution now supports subproject dependencies in pnpm workspaces. (22.0.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.7)
- Library unit tests now automatically inject localize/init. (22.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.5)
- Library unit tests now load zone.js dynamically. (22.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.5)
- Registry metadata fetching is supported when using the bun package manager. (21.2.15, 22.0.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.2), [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.15)
- The migration now uses null objects and callbacks. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)
- The Karma-to-Vitest migration converts fakeAsync fake timers and migrates flush behavior when used in beforeEach. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The Vitest runner supports Istanbul coverage. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- An update migration is added to migrate Karma to Vitest. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- ng generate uses the service decorator. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- Angular CLI adds support for Node.js 26.0.0. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)
- The Vitest unit test runner supports runtime Zone.js detection. (22.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.0)

### Fixes and other changes

- Avoids invalidating the diagnostic cache when a stylesheet changes. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Coalesces external watcher directories to avoid the macOS FSEvents limit. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Accepts array indices with multiple digits. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Continues to work when the package manager is not installed. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Resolves package names in npm workspace members. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Preserves preload metadata for nested empty-path routes. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Resolves relative redirects against the parent route. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Preserves query parameters on relative route redirects. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Ensures Sass importers return global Promise instances. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Avoids stack overflow when chaining many rules. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- The migration now keeps the workspace build version. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- Keeps the Vite server file watcher disabled in Vitest watch mode. (22.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.3)
- The SSR dev server preserves the Host header when proxying. (22.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.2)
- Glob entries in proxy configuration retain their order. (22.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.2)
- The compiler is now loaded for Vitest TestBed initialization. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- The loader now encodes script type. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Spurious polling change events are now deduplicated. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Component updates are reset on each dev-server SSR page request. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- The cache now preserves nested workspace paths. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Intermediate files are no longer sharded under worker surplus. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Batch locales are processed sequentially in the worker. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- CLI options now correctly parse inline boolean values. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Standalone expression statements are no longer incorrectly marked as pure. (22.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.1)
- Includes inline component stylesheets among referenced watch files. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- Runs setup file hooks for each spec file when coverage is enabled. (22.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.2.0)
- Auto-CSP supports standard JavaScript MIME types and case insensitivity. (22.1.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.9)
- Unknown options are now named in schema validation errors, making configuration problems easier to identify. (22.1.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.9)
- strictPort is disabled when port 0 is used in the dev-server. (22.1.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.8)
- The pathname is decoded when constructing the server asset path. (22.1.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.7)
- Binary values are preserved in the SQLite cache store. (22.1.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.7)
- The web request signal is aborted when the corresponding Node.js request is aborted. (22.1.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.6)
- The error message for top-level await is corrected to avoid misleading developers. (22.1.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.5)
- The build prevents syntax corruption for Crockford-style enum IIFEs. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- The build counts statically imported chunks in the initial total. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- The build returns direct file contents for non-Angular TypeScript files. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- The build prevents syntax corruption in the oxc transform. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- The platform is destroyed when the response stream is cancelled. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- Paths in setupFiles are normalized to POSIX for the Vitest runner. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- The build returns only the lowest version per target engine. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- The guard generator imports UrlSegment instead of using subPath. (22.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.4)
- Prevents the build process from hanging after an unhandled error. (22.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.3)
- Retains watched files when an error occurs in the load result cache. (22.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.3)
- Correctly reports available package updates when running ng update without arguments. (22.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.3)
- Discovers migrations from installed packages when registry metadata omits them. (22.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.3)
- Settles when the client disconnects. (22.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.3)
- Prevents IIFE wrappers from interleaving for adjacent classes in minified files. (22.1.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.2)
- Paths from sandboxed execroots are rewritten when running under Bazel. (22.1.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.1)
- Update resolution now respects client-side release age settings. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- Updates now resolve the correct registry name when package dependencies use npm alias syntax. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- The CLI now reverts package.json changes if installation tasks fail during an update. (22.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.1.0)
- Safeguard the Karma builder stream controller when it is closed. (22.0.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.9)
- Import map integrity keys are now validated as URL-like specifiers. (22.0.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.8)
- MCP devserver tool names now conform to the spec regex. (22.0.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.8)
- Metafile paths are remapped when the workspace root is a symlink or junction. (22.0.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.8)
- Custom config options are preserved in runnerConfig for Vitest. (22.0.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.8)
- Drive letter casing is canonicalized for the workspace root on Windows. (22.0.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.8)
- Temporary installs now copy the packageManager field and Yarn configuration. (22.0.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.7)
- Builder-injected i18n locale data is no longer externalized. (22.0.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.6)
- All Vite ID prefixes are stripped from minified code when external dependencies are present. (22.0.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.6)
- Update bootstrapping now respects the release age policy. (21.2.18, 22.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.5), [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.18)
- The command handler now handles package manager errors gracefully. (22.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.5)
- Response headers are preserved during redirects. (22.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.5)
- The refactor-jasmine-vitest schematic now maps the browserMode option correctly. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)
- The registry option is now validated as a URL. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)
- Temporary package installation is isolated from the parent pnpm workspace. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)
- The schematic now safely comments out multiline statements during refactoring. (22.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v22.0.1)

## @angular/cli 21

### Breaking changes

- Removes forceAuth and unscoped credential parsing from registry credential handling. (21.2.15) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.15)
- Asset input paths are asserted to be within the workspace root. (21.2.13) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.13)
- The webpack dev-server no longer applies an unconditional CORS wildcard. (21.2.13) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.13)
- Values of x-forwarded-prefix that start with a backslash are disallowed. (20.3.21, 21.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.21), [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.3)
- Invalid package manager versions are now rejected with an error. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Using Vitest runtime mocking now fails explicitly. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- The library tsconfig template no longer includes inlineSources. (21.0.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.4)
- ng commands no longer automatically detect and use cnpm; use .npmrc to configure npm to use the cnpm registry. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- The Less javascriptEnabled option is no longer supported; stylesheets using inline JavaScript must be refactored. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- TypeScript versions older than 5.9 are no longer supported. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Vitest test isolation is disabled by default, and explicit test isolation configuration is removed. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)

### Security

- MCP workspace access is restricted to allowed client roots during resolution. (21.2.10) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.10)
- Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix (19.2.25, 20.3.25, 21.2.9) — [security advisory](https://github.com/advisories/GHSA-69XR-M8H6-H664)
- Adds an option to safely validate and sanitize proxy headers. (19.2.25, 20.3.25, 21.2.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v19.2.25), [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.9), [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.25)
- Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR (20.3.21, 21.2.3) — [security advisory](https://github.com/advisories/GHSA-VFX2-HV2G-XJ5F)
- Angular SSR has an Open Redirect via X-Forwarded-Prefix (19.2.21, 20.3.17, 21.1.5) — [security advisory](https://github.com/advisories/GHSA-XH43-G2FQ-WJRJ), [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.5), [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.17), [release notes](https://github.com/angular/angular-cli/releases/tag/v19.2.21)
- Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline (19.2.21, 20.3.17, 21.1.5) — [security advisory](https://github.com/advisories/GHSA-X288-3778-4HHX)
- Validates host headers to prevent header-based SSRF. (19.2.21, 20.3.17, 21.1.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.5), [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.17), [release notes](https://github.com/angular/angular-cli/releases/tag/v19.2.21)

### Deprecations

- The matcher now warns about loose matching. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)

### New APIs and options

- Adds support for configuring trusted proxy headers via an environment variable. (19.2.27, 20.3.27, 21.2.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.27), [release notes](https://github.com/angular/angular-cli/releases/tag/v19.2.27), [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.9)
- The MCP devserver start tool supports a custom port. (21.2.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.5)
- Introduces a DI token to signal the route discovery process. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- The unit-test builder now supports a headless option. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- The jasmine-vitest schematic adds a browserMode option. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- The SSR SSL plugin supports the NODE_EXTRA_CA_CERTS environment variable. (21.0.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.3)
- The Vitest coverage reportsDirectory option can now be overridden. (21.0.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.2)
- The library schematic now supports the testRunner option. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- Adds the addTypeToClassName option to relevant schematics. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Adds a define option to the dev-server. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- ng new supports different file name style guides. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Adds an include option to the jasmine-to-vitest schematic. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Adds JSON output to ng version, which also reports more details. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Unit tests can use a custom runner configuration file, including an absolute path. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Adds a Tailwind CSS option to the application schematic and ng new. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)

### Performance

- Avoids redundant package version resolution. (21.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.2)
- Package manager discovery now uses stat-based probing. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)

### Behavior and default changes

- External packages are used for polyfills only when no local files are present. (21.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.3)
- Custom headers are now supported in redirect responses. (20.3.21, 21.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.21), [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.3)
- Process environment variables are passed to prerender workers. (20.3.20, 21.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.2), [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.20)
- Extensionless assets are now served without transformation. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Argument parsing now infers boolean types for the string values 'true' and 'false'. (21.1.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.2)
- Argument parsing now infers boolean types for the string values 'true' and 'false'. (21.1.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.2)
- Vitest dependency checks are loosened when runnerConfig is used. (21.1.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.2)
- Allows application assets to be located in the workspace root. (21.1.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.1)
- Uses a project-local temporary directory. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- SSR processing is skipped for well-known non-Angular URLs such as favicon.ico. (21.0.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.4)
- Management of the Vitest UI option is now conditional. (21.0.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.4)
- The migration now silently skips build targets that already use one of the new builders. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- The MCP documentation search tool now accounts for the Angular version. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Promotes the MCP find_examples tool to stable and adds version-aware search with structured output. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- The MCP tool now accounts for the Angular version. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- New applications are zoneless by default. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Promotes the zoneless migration MCP tool to stable. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)

### Tooling

- The update schematic expands package groups for newly added peer dependencies. (21.2.14) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.14)
- Initial package manager workspace awareness is introduced. (21.2.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.9)
- The MCP test tool uses the headless option. (21.2.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.8)
- MCP tools dynamically resolve the project’s Angular CLI executable. (21.2.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.8)
- Vitest validates V8 coverage support for browsers. (21.2.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.8)
- Compatibility checks are simplified, with special handling for local builds of new major versions. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- MCP tools now use standardized workspace and project options. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Prettier's formatting list now includes Markdown files. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Generated workspaces now include a .prettierrc file and Prettier as a dev dependency. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Files modified by schematics are now formatted automatically. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- File formatting is now integrated into update migrations. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- The Angular schematic now supports adding Vitest browser providers. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- The schematic now provides actionable feedback. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Vitest browser runs with Playwright using the operating system theme. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Warns when the production configuration is missing for a service worker. (21.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.3)
- Coverage thresholds can now be merged with Vitest runnerConfig. (21.1.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.2)
- Improves file system traversal and symlink handling in the MCP tool. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- New workspaces include an MCP configuration file. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- Adds MCP tools for testing, end-to-end testing, building, and running dev servers, and adds an experimental all tool group. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- The unit-test builder directly supports ng-packagr. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- Simplifies SSL handling when serving with SSR. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- The migration generates a detailed report of its changes. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- Adds signal forms lessons. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- TestBed teardown is disabled during debugging in Vitest. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- Injects source-map-support for browser tests. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- Module-based application schematics now use provideZoneChangeDetection in the root module. (21.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.5)
- Custom middleware presents an Angular-tailored message. (21.0.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.3)
- Testing polyfills are injected in the Karma unit-test executor. (21.0.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.3)
- The built-in test main file conditionally provides Zone.js change detection. (21.0.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.3)
- Filename truncation was added to test discovery. (21.0.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.2)
- The Jasmine-to-Vitest migration now includes mock names in its createSpyObj transformation. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- The ai-config schematic supports AGENTS.md. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Adds an ai-tutor MCP tool. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Introduces a schematic to refactor unit tests from Jasmine to Vitest, including transformations for spy APIs, matchers, and other constructs. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Adds builder information, style-language and unit-test-framework detection, and improved workspace discovery in monorepos. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Adds advanced filtering, snippet support, and multi-database search to the MCP example search tool. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Adds a migration to update moduleResolution to bundler. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Adds fallback support for packages without direct ng add functionality and provides detailed peer dependency conflict errors. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Dry runs show planned actions; dependency lookups are cached and peer dependency checks are parallelized. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- Overhauls command output with more details, including Vitest. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- New projects set packageManager in package.json. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- New projects are configured for Vitest and can choose a test runner. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- The unit-test builder supports .test.ts files by default and adds options for listing and filtering tests, coverage, reporters, and browser viewport. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)
- zone.js is optional in server and app-shell builders. (21.0.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.0)

### Fixes and other changes

- Prevents the esbuild service from leaking child processes. (21.2.14) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.14)
- Virtual esbuild paths with (disabled) are ignored. (21.2.12) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.12)
- npm manifests represented as arrays are now parsed robustly. (21.2.11) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.11)
- The refactor adds missing imports for the focus and skip APIs. (21.2.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.9)
- Route segments are decoded when building and matching the route tree. (21.2.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.9)
- The router normalizes URLs for comparison. (21.2.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.9)
- The app-shell route format is fixed. (21.2.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.8)
- HMR component update path resolution uses rootDir. (21.2.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.8)
- MCP project scans ignore EBADF file system errors. (21.2.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.8)
- The prerender builder ensures routes have a leading slash. (21.2.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.8)
- Handles a missing package manager during analytics initialization. (21.2.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.7)
- Scopes the Chrome executable path to individual Playwright instances. (21.2.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.6)
- Preserves error stack traces during prerendering. (21.2.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.6)
- Ensures errors from transitive SCSS partials are tracked in watch mode. (21.2.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.6)
- Fixes sourceRoot resolution for the MCP projects tool. (21.2.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.6)
- Ensures Vitest mock patching runs only once. (21.2.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.6)
- Console methods are restored after the logger completes. (21.2.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.4)
- Migrate-only updates use the parsed package name. (21.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.3)
- Redirect responses now ensure unique values in the Vary header. (20.3.21, 21.2.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.21), [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.3)
- The vitest Playwright provider now allows any CHROME_BIN value. (21.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.2)
- Line endings are normalized when generating CSP hashes. (21.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.2)
- Assets are resolved correctly during i18n prerendering. (21.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.2)
- Package names are quoted conditionally based on host requirements when adding dependencies. (21.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.2)
- Preserves the exact requested version when adding a package. (21.2.2) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.2)
- The unit-test builder treats an empty browsers array as undefined. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- Polyfills are bundled to preserve their execution order in the development server. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- Improves header validation logic in SSR. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- When the minimal option is enabled, schematics no longer add test dependencies. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- Corrects dev dependency detection when running ng add. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- Fixes a memory leak when serving applications with i18n. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- Ensures group members are updated to the targeted version. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- Formatting schematic changes now ignores unknown files. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- The unit-test builder resolves style include paths relative to ng-package.json. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- Non-relative imports are conditionally allowed with vi.mock. (21.2.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.1)
- The dev-server now normalizes allowedHosts. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Complex range specifiers are now quoted when passed to the package manager. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Prettier execution now enables the shell option on Windows. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Renamed files are now identified by their new path. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Scoped packages in Yarn Classic list output are now parsed correctly. (21.2.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.2.0)
- Absolute setup file paths are now resolved correctly in Vitest. (21.1.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.4)
- Addresses the Node.js deprecation DEP0190. (21.1.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.3)
- Prevents incorrect catch binding removal when downleveling for-await code. (21.1.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.1)
- Removes special characters from the jasmine-vitest report filename. (21.1.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.1)
- Removes a nonexistent link from the MCP response. (21.1.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.1)
- Corrects the VS Code MCP configuration generated for new projects. (21.1.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.1)
- Correctly spawns package managers on Windows. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- Normalizes roots to POSIX to improve Windows compatibility. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- Resolves test files correctly on Windows when using non-C drives. (21.1.0) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.1.0)
- Handles platform destruction during rendering. (21.0.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.6)
- Project targeting is corrected during Vitest debugging. (21.0.5) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.5)
- Non-prefixed requests are allowed when using SSR with a base href. (21.0.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.4)
- The status code is propagated to redirects. (21.0.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.4)
- Tests run when a compilation error is resolved. (21.0.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.4)
- The resolver now includes the browser condition for Vitest. (21.0.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.4)
- Well-known non-Angular URLs receive a leading slash. (21.0.4) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.4)
- The locale base href retains its leading slash. (21.0.3) — [release notes](https://github.com/angular/angular-cli/releases/tag/v21.0.3)
- The Jasmine-to-Vitest refactor now handles createSpyObj calls without a base name. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- The Jasmine-to-Vitest migration improves the safety of transforming done callbacks. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- Redirects no longer enter a loop with encoded query parameters. (20.3.12, 21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1), [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.12)
- Paths passed with --include are now normalized to POSIX format. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- The migration now adds missing imports for lifecycle hooks, so migrated tests can reference those hooks. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- The Jasmine-to-Vitest migration now handles jasmine.clock().mockDate() correctly. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- The migration no longer sets esModuleInterop or moduleResolution when module is preserve. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- The CLI now resolves dependencies correctly for the node modules directory check. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- The Vitest runner now configures headless mode correctly per browser. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- URL joining for prerender routes is now handled correctly. (20.3.12, 21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1), [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.12)
- The dev server now uses HTTP/1.1 when SSR is used with SSL. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- Coverage paths now resolve correctly for JSDOM on Windows. (21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1)
- Redirects now handle X-Forwarded-Prefix and APP_BASE_HREF. (20.3.12, 21.0.1) — [release notes](https://github.com/angular/angular-cli/releases/tag/21.0.1), [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.12)

## @angular/cli 20

### Breaking changes

- forceAuth is removed. (20.3.28) — [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.28)
- Unscoped credential parsing is removed. (20.3.28) — [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.28)

### Security

- Angular SSR has a Server-Side Request Forgery (SSRF) flaw (19.2.18, 20.3.6) — [security advisory](https://github.com/advisories/GHSA-Q63Q-PGMF-MXHR)
- Prevents a malicious URL from overriding the host. (19.2.18, 20.3.6) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.6), [release notes](https://github.com/angular/angular-cli/releases/tag/19.2.18)

### Behavior and default changes

- When resolving version ranges, deprecated versions are now used as a fallback if no non-deprecated version is found. (20.3.28) — [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.28)

### Tooling

- Version 30 is now allowed for jest. (20.3.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.8)
- Version 30 is now allowed for jest-environment-jsdom. (20.3.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.8)

### Fixes and other changes

- Common engine rendering options now allow all hosts to prevent validation errors. (19.2.26, 20.3.26) — [release notes](https://github.com/angular/angular-cli/releases/tag/v20.3.26), [release notes](https://github.com/angular/angular-cli/releases/tag/v19.2.26)
- Prevents removing @angular/localize when external packages are present. (20.3.10) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.10)
- Corrects the include configuration for spec files. (20.3.10) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.10)
- Locale handling in app-engine is improved. (20.3.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.9)
- Route matching for wildcard routes is improved. (20.3.9) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.9)
- Redirects from guards are now handled during prerendering. (20.3.8) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.8)
- The Angular locale data namespace is resolved correctly in esbuild. (20.3.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.7)
- Schematics now respect --force when a schematic contains host.create. (20.3.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.7)
- SSR now correctly handles routes with matrix parameters. (20.3.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.7)
- Server-side navigation now triggers a redirect. (20.3.7) — [release notes](https://github.com/angular/angular-cli/releases/tag/20.3.7)