npm / @angular/compiler-cli

@angular/compiler-cli

What changed in @angular/compiler-cli 19 to 22, from its official release notes, upgrade guides and advisories. Also covers @angular/language-service, @angular/platform-server. Sources checked 2026-10-18.

6 breaking39 security1 new APIs and options23 tooling20 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@angular/compiler-cli 2233 changes

Security 15

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
20.3.32, 21.2.24, 22.2.0security advisory
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
20.3.31, 21.2.23, 22.1.6security advisory
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
20.3.30, 21.2.22, 22.1.4security advisory
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
20.3.30, 21.2.22, 22.1.4security advisory
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
20.3.30, 21.2.22, 22.1.4security advisory
Angular: Information Leak via HttpTransferCache Bypass When Using withRequestsMadeViaParent
20.3.28, 21.2.20, 22.1.1security advisory
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
20.3.28, 21.2.20, 22.1.0security advisory
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
20.3.27, 21.2.19, 22.0.7security advisory
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
20.3.27, 21.2.19, 22.0.2security advisory
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
20.3.25, 21.2.17, 22.0.1security advisory
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
20.3.25, 21.2.17, 22.0.1security advisory
@angular/common: Weak 32-Bit Cache Key Hashing in HttpTransferCache Leading to Cross-Request Data Leakage and State Poisoning
20.3.25, 21.2.17, 22.0.1security advisory
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
20.3.25, 21.2.17, 22.0.1security advisory
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
20.3.27, 21.2.19, 22.0.1security advisory
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
20.3.25, 21.2.17, 22.0.1security advisory

New APIs and options 1

Adds strictUnclaimedEventNames to the angularCompilerOptions schema so it is recognized by the language service.
22.2.2release notes

Tooling 12

The language service supports @boundary blocks in templates.
22.2.0release notes
Generated imports now honor the quote style preference.
22.1.4release notes
The language service typechecks templates that require inline typecheck blocks.
22.1.0release notes
The language service compiles non-exported classes when they are standalone.
22.1.0release notes
The language service now accounts for strictTemplates being enabled by default.
22.1.0release notes
Safe function calls in type-checking blocks now use a regular optional chaining expression, affecting template type-checking results.
22.0.6release notes
Uninvoked signals in bound expressions using a ternary are now detected, improving template diagnostics.
22.0.6release notes
The possible event handler check is restricted to property names longer than 2 characters.
20.3.27, 21.2.19, 22.0.2release notes release notes release notes
Adds inlay hints support for Angular templates in the language service.
22.0.0release notes
Adds Document Symbols support for Angular templates in the language service.
22.0.0release notes
Adds language-service support for idle timeouts in defer blocks.
22.0.0release notes
Adds language-service support for @Input properties with transforms.
22.0.0release notes

Fixes and other changes 5

Wraps the collection expression before appending a non-null assertion, fixing generated type-checking code for @for collections.
22.1.7release notes
The uninvoked track function check no longer flags callable objects with zero parameters.
22.1.6release notes
The language server now recovers the project for external templates in solution-style workspaces.
22.1.3release notes
Fixes migration failure when tsconfig specifies rootDir.
22.0.4release notes
External template inlay hints no longer appear in TypeScript files.
22.0.1release notes

@angular/compiler-cli 2145 changes

Breaking changes 2

The compiler disallows i18n event attributes.
20.3.27, 21.2.19release notes release notes
Renames the signal form binding from field to formField.
21.0.9release notes

Security 18

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
19.2.25, 20.3.24, 21.2.16security advisory
@angular/platform-server: Missing <noscript> Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
19.2.25, 20.3.24, 21.2.16security advisory
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
19.2.23, 20.3.22, 21.2.15security advisory
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
19.2.23, 20.3.22, 21.2.15security advisory
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
19.2.23, 20.3.22, 21.2.15security advisory
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
19.2.23, 20.3.22, 21.2.15security advisory
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
19.2.23, 20.3.22, 21.2.15security advisory
@angular/service-worker: Request Credential & Cache Policy Stripping
19.2.23, 20.3.22, 21.2.15security advisory
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
19.2.22, 20.3.22, 21.2.15security advisory
@angular/platform-server: SSRF via Hostname Hijacking
19.2.22, 20.3.21, 21.2.13security advisory
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
19.2.21, 20.3.19, 21.2.9security advisory
Angular vulnerable to XSS in i18n attribute bindings
19.2.20, 20.3.18, 21.2.4security advisory
Translated attribute bindings with interpolations are sanitized.
20.3.18, 21.2.3release notes release notes
Angular i18n vulnerable to Cross-Site Scripting
19.2.19, 20.3.17, 21.1.6security advisory
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
19.2.18, 20.3.16, 21.0.7security advisory
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
19.2.17, 20.3.15, 21.0.2security advisory
Prevents XSS via SVG animation attributeName and MathML/SVG URLs.
19.2.17, 20.3.15, 21.0.2release notes release notes release notes
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
19.2.16, 20.3.14, 21.0.1security advisory

Tooling 11

Quick info at local variable locations now aligns with TypeScript semantics and supports type narrowing.
21.2.8release notes
Signal string representations now include debug names, making signals easier to identify.
21.2.3release notes
Adds JSON schema support for angularCompilerOptions, helping developers configure compiler options with schema assistance.
21.2.0release notes
Uses lightweight project warmup for Angular analysis.
21.2.0release notes
Adds linked editing ranges for synchronizing HTML tags.
21.2.0release notes
Adds the geolocation element to the schema, so it is recognized during template checking.
21.1.4release notes
Detects the local project version when the language service is created.
21.1.2release notes
The compiler now provides location information for literal map keys, improving language-service features that rely on source locations.
21.0.7release notes
The compiler now produces accurate source spans for typeof and void expressions, improving language-service locations based on those spans.
21.0.7release notes
The compiler now supports qualified names in typeof type references, improving language-service handling of those references.
21.0.7release notes
Expanded the type for native controls with a dynamic type, affecting template type checking and language-service diagnostics.
21.0.4release notes

Fixes and other changes 14

Generic types are now filled out correctly in type check blocks, improving template type checking.
21.2.5release notes
Named HTML entities containing digits are now parsed correctly in templates.
21.2.5release notes
Template literals are now escaped in type check blocks, fixing generated template type-checking code.
21.2.5release notes
Object literals in type-check blocks are now always parenthesized, fixing generated type-check code.
21.2.2release notes
Correctly caches blob responses in transfer cache.
21.2.1release notes
Prevents child animation elements from being orphaned.
21.2.1release notes
Prevents elements from being removed during drag and drop.
21.2.1release notes
Adds transfer cache support to httpResource to fix hydration.
21.2.1release notes
Ensures the control instruction comes after other bindings.
21.0.9release notes
Component import diagnostics are now reported within the imports expression, improving diagnostic locations in the language service.
21.0.7release notes
Avoids interpolation highlighting inside @let declarations.
21.0.6release notes
Prevents the language service from crashing on suggestion diagnostic errors.
21.0.6release notes
Avoids a false-positive deprecation when using InjectionToken with a factory only.
21.0.5release notes
Fixes a type error in signal forms.
21.0.5release notes

@angular/compiler-cli 208 changes

Breaking changes 3

Event handler attributes are disallowed in Meta.
20.3.29release notes
Translations of iframe src are disallowed.
20.3.18release notes
Only known HTML attributes are applied in translated ICU content; unknown attributes are dropped and not rendered.
19.2.19, 20.3.17release notes release notes

Security 4

Prevents SSRF bypasses via protocol-relative and backslash URLs.
20.3.19release notes
Translated form attributes are sanitized.
20.3.18release notes
Prevents XSS via MathML/SVG URLs.
20.3.15release notes
Prevents XSRF tokens from leaking to protocol-relative URLs.
19.2.16, 20.3.14release notes release notes

Fixes and other changes 1

Prevents namespaced SVG <style> elements from being stripped.
19.2.24, 20.3.23release notes release notes

@angular/compiler-cli 193 changes

Breaking changes 1

Event attribute bindings in host bindings are now unconditionally disallowed.
19.2.22release notes

Security 2

Security-sensitive attributes in i18n bindings are now validated.
19.2.22release notes
Sensitive attributes on SVG script elements are now sanitized.
19.2.18release notes