# What changed in @angular/compiler-cli

> 89 changes in @angular/compiler-cli 19 to 22 from its official release notes, upgrade guides and advisories: 6 breaking, 39 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@angular/compiler-cli/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @angular/compiler-cli 22

### Security

- Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters (20.3.32, 21.2.24, 22.2.0) — [security advisory](https://github.com/advisories/GHSA-FF3F-86QR-9CV3)
- Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (20.3.31, 21.2.23, 22.1.6) — [security advisory](https://github.com/advisories/GHSA-F67J-2JQW-JPQ7)
- Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements (20.3.30, 21.2.22, 22.1.4) — [security advisory](https://github.com/advisories/GHSA-J3R3-MXQP-R2P4)
- Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements (20.3.30, 21.2.22, 22.1.4) — [security advisory](https://github.com/advisories/GHSA-V3P8-WHQ6-R5JG)
- Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR (20.3.30, 21.2.22, 22.1.4) — [security advisory](https://github.com/advisories/GHSA-F6MR-PJWC-34M4)
- Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent` (20.3.28, 21.2.20, 22.1.1) — [security advisory](https://github.com/advisories/GHSA-P297-FM68-3Q8C)
- Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler (20.3.28, 21.2.20, 22.1.0) — [security advisory](https://github.com/advisories/GHSA-HH8M-FM6V-7CVG)
- Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) (20.3.27, 21.2.19, 22.0.7) — [security advisory](https://github.com/advisories/GHSA-VPX6-8PJR-4G3V)
- Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning (20.3.27, 21.2.19, 22.0.2) — [security advisory](https://github.com/advisories/GHSA-JHPW-976M-542J)
- Angular Client Hydration DOM Clobbering & Response-Cache Poisoning (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-RGJC-H3X7-9MWG)
- @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate) (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-48R7-HPM6-GFXM)
- @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-39PV-4J6C-2G6V)
- @angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS) (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-58W9-8G37-X9V5)
- Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes (20.3.27, 21.2.19, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-JJ27-H5HQ-8X99)
- @angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-QXH6-94W6-9R5P)

### New APIs and options

- Adds strictUnclaimedEventNames to the angularCompilerOptions schema so it is recognized by the language service. (22.2.2) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2222-2026-10-08)

### Tooling

- The language service supports @boundary blocks in templates. (22.2.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2220-2026-09-23)
- Generated imports now honor the quote style preference. (22.1.4) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2214-2026-08-26)
- The language service typechecks templates that require inline typecheck blocks. (22.1.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2210-2026-07-29)
- The language service compiles non-exported classes when they are standalone. (22.1.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2210-2026-07-29)
- The language service now accounts for strictTemplates being enabled by default. (22.1.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2210-2026-07-29)
- Safe function calls in type-checking blocks now use a regular optional chaining expression, affecting template type-checking results. (22.0.6) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2206-2026-07-08)
- Uninvoked signals in bound expressions using a ternary are now detected, improving template diagnostics. (22.0.6) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2206-2026-07-08)
- The possible event handler check is restricted to property names longer than 2 characters. (20.3.27, 21.2.19, 22.0.2) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#21219-2026-07-29), [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20327-2026-07-29), [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2202-2026-06-17)
- Adds inlay hints support for Angular templates in the language service. (22.0.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2200-2026-06-03)
- Adds Document Symbols support for Angular templates in the language service. (22.0.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2200-2026-06-03)
- Adds language-service support for idle timeouts in defer blocks. (22.0.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2200-2026-06-03)
- Adds language-service support for @Input properties with transforms. (22.0.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2200-2026-06-03)

### Fixes and other changes

- Wraps the collection expression before appending a non-null assertion, fixing generated type-checking code for @for collections. (22.1.7) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2217-2026-09-16)
- The uninvoked track function check no longer flags callable objects with zero parameters. (22.1.6) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2216-2026-09-09)
- The language server now recovers the project for external templates in solution-style workspaces. (22.1.3) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2213-2026-08-19)
- Fixes migration failure when tsconfig specifies rootDir. (22.0.4) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2204-2026-06-26)
- External template inlay hints no longer appear in TypeScript files. (22.0.1) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2201-2026-06-10)

## @angular/compiler-cli 21

### Breaking changes

- The compiler disallows i18n event attributes. (20.3.27, 21.2.19) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#21219-2026-07-29), [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20327-2026-07-29)
- Renames the signal form binding from field to formField. (21.0.9) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2109-2026-01-14)

### Security

- @angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (19.2.25, 20.3.24, 21.2.16) — [security advisory](https://github.com/advisories/GHSA-HQR9-C56F-3X7F)
- @angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR (19.2.25, 20.3.24, 21.2.16) — [security advisory](https://github.com/advisories/GHSA-GXX4-3XCV-F8QX)
- @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-P3VC-36G9-X9GR)
- @angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-Q6F4-QQRG-JV6X)
- @angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS) (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-692R-GRFM-V8X7)
- @angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-XRXM-CP7J-8XF6)
- Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-GV2Q-MQQV-365M)
- @angular/service-worker: Request Credential & Cache Policy Stripping (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-95QP-CMMW-MGQV)
- Angular: Template and Attribute Namespace Sanitization Bypass (XSS) (19.2.22, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-F3M7-GQXR-G87X)
- @angular/platform-server: SSRF via Hostname Hijacking (19.2.22, 20.3.21, 21.2.13) — [security advisory](https://github.com/advisories/GHSA-RFH7-FXQC-Q52V)
- Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server (19.2.21, 20.3.19, 21.2.9) — [security advisory](https://github.com/advisories/GHSA-45Q2-GJVG-7973)
- Angular vulnerable to XSS in i18n attribute bindings (19.2.20, 20.3.18, 21.2.4) — [security advisory](https://github.com/advisories/GHSA-G93W-MFHG-P222)
- Translated attribute bindings with interpolations are sanitized. (20.3.18, 21.2.3) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20318-2026-03-12), [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2123-2026-03-11)
- Angular i18n vulnerable to Cross-Site Scripting (19.2.19, 20.3.17, 21.1.6) — [security advisory](https://github.com/advisories/GHSA-PRJF-86W9-MFQV)
- Angular has XSS Vulnerability via Unsanitized SVG Script Attributes (19.2.18, 20.3.16, 21.0.7) — [security advisory](https://github.com/advisories/GHSA-JRMJ-C5CX-3CW6)
- Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes (19.2.17, 20.3.15, 21.0.2) — [security advisory](https://github.com/advisories/GHSA-V4HV-RGFQ-GP49)
- Prevents XSS via SVG animation attributeName and MathML/SVG URLs. (19.2.17, 20.3.15, 21.0.2) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2102-2025-12-01), [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20315-2025-12-01), [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#19217-2025-12-01)
- Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client (19.2.16, 20.3.14, 21.0.1) — [security advisory](https://github.com/advisories/GHSA-58C5-G7WP-6W37)

### Tooling

- Quick info at local variable locations now aligns with TypeScript semantics and supports type narrowing. (21.2.8) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2128-2026-04-08)
- Signal string representations now include debug names, making signals easier to identify. (21.2.3) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2123-2026-03-11)
- Adds JSON schema support for angularCompilerOptions, helping developers configure compiler options with schema assistance. (21.2.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2120-2026-02-25)
- Uses lightweight project warmup for Angular analysis. (21.2.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2120-2026-02-25)
- Adds linked editing ranges for synchronizing HTML tags. (21.2.0) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2120-2026-02-25)
- Adds the geolocation element to the schema, so it is recognized during template checking. (21.1.4) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2114-2026-02-11)
- Detects the local project version when the language service is created. (21.1.2) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2112-2026-01-28)
- The compiler now provides location information for literal map keys, improving language-service features that rely on source locations. (21.0.7) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2107-2026-01-07)
- The compiler now produces accurate source spans for typeof and void expressions, improving language-service locations based on those spans. (21.0.7) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2107-2026-01-07)
- The compiler now supports qualified names in typeof type references, improving language-service handling of those references. (21.0.7) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2107-2026-01-07)
- Expanded the type for native controls with a dynamic type, affecting template type checking and language-service diagnostics. (21.0.4) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2104-2025-12-10)

### Fixes and other changes

- Generic types are now filled out correctly in type check blocks, improving template type checking. (21.2.5) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2125-2026-03-18)
- Named HTML entities containing digits are now parsed correctly in templates. (21.2.5) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2125-2026-03-18)
- Template literals are now escaped in type check blocks, fixing generated template type-checking code. (21.2.5) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2125-2026-03-18)
- Object literals in type-check blocks are now always parenthesized, fixing generated type-check code. (21.2.2) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2122-2026-03-09)
- Correctly caches blob responses in transfer cache. (21.2.1) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2121-2026-03-04)
- Prevents child animation elements from being orphaned. (21.2.1) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2121-2026-03-04)
- Prevents elements from being removed during drag and drop. (21.2.1) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2121-2026-03-04)
- Adds transfer cache support to httpResource to fix hydration. (21.2.1) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2121-2026-03-04)
- Ensures the control instruction comes after other bindings. (21.0.9) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2109-2026-01-14)
- Component import diagnostics are now reported within the imports expression, improving diagnostic locations in the language service. (21.0.7) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2107-2026-01-07)
- Avoids interpolation highlighting inside @let declarations. (21.0.6) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2106-2025-12-17)
- Prevents the language service from crashing on suggestion diagnostic errors. (21.0.6) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2106-2025-12-17)
- Avoids a false-positive deprecation when using InjectionToken with a factory only. (21.0.5) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2105-2025-12-11)
- Fixes a type error in signal forms. (21.0.5) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#2105-2025-12-11)

## @angular/compiler-cli 20

### Breaking changes

- Event handler attributes are disallowed in Meta. (20.3.29) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20329-2026-08-19)
- Translations of iframe src are disallowed. (20.3.18) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20318-2026-03-12)
- Only known HTML attributes are applied in translated ICU content; unknown attributes are dropped and not rendered. (19.2.19, 20.3.17) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20317-2026-02-25), [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#19219-2026-02-25)

### Security

- Prevents SSRF bypasses via protocol-relative and backslash URLs. (20.3.19) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20319-2026-04-15)
- Translated form attributes are sanitized. (20.3.18) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20318-2026-03-12)
- Prevents XSS via MathML/SVG URLs. (20.3.15) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20315-2025-12-01)
- Prevents XSRF tokens from leaking to protocol-relative URLs. (19.2.16, 20.3.14) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#19216-2025-11-26), [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20314-2025-11-25)

### Fixes and other changes

- Prevents namespaced SVG <style> elements from being stripped. (19.2.24, 20.3.23) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#20323-2026-05-28), [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#19224-2026-05-28)

## @angular/compiler-cli 19

### Breaking changes

- Event attribute bindings in host bindings are now unconditionally disallowed. (19.2.22) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#19222-2026-05-12)

### Security

- Security-sensitive attributes in i18n bindings are now validated. (19.2.22) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#19222-2026-05-12)
- Sensitive attributes on SVG script elements are now sanitized. (19.2.18) — [release notes](https://github.com/angular/angular/blob/92e5aa8f154096a756757d0e295cde4299788650/CHANGELOG.md#19218-2026-01-07)