# What changed in @angular/core

> 48 changes in @angular/core 20 to 22 from its official release notes, upgrade guides and advisories: 3 breaking, 35 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/@angular/core/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @angular/core 22

### Breaking changes

- The compiler disallows i18n event attributes, affecting which template attributes developers can mark for localization. (20.3.27, 21.2.19, 22.0.1) — [release notes](https://github.com/angular/angular/releases/tag/v21.2.19), [release notes](https://github.com/angular/angular/releases/tag/v20.3.27), [security advisory](https://github.com/advisories/GHSA-JJ27-H5HQ-8X99)

### Security

- @angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) (20.3.33, 21.2.25, 22.2.1) — [security advisory](https://github.com/advisories/GHSA-W739-GVWX-GRC3)
- @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) (20.3.33, 21.2.25, 22.2.1) — [security advisory](https://github.com/advisories/GHSA-62VG-58RM-QFF7)
- Avoids dense elements allocation for numeric URL keys. (20.3.32, 21.2.24, 22.2.0) — [release notes](https://github.com/angular/angular/releases/tag/v21.2.24), [security advisory](https://github.com/advisories/GHSA-FF3F-86QR-9CV3)
- Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (20.3.31, 21.2.23, 22.1.6) — [security advisory](https://github.com/advisories/GHSA-F67J-2JQW-JPQ7)
- Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements (20.3.30, 21.2.22, 22.1.4) — [security advisory](https://github.com/advisories/GHSA-J3R3-MXQP-R2P4)
- Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements (20.3.30, 21.2.22, 22.1.4) — [security advisory](https://github.com/advisories/GHSA-V3P8-WHQ6-R5JG)
- Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR (20.3.30, 21.2.22, 22.1.4) — [security advisory](https://github.com/advisories/GHSA-F6MR-PJWC-34M4)
- Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent` (20.3.28, 21.2.20, 22.1.1) — [security advisory](https://github.com/advisories/GHSA-P297-FM68-3Q8C)
- Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler (20.3.28, 21.2.20, 22.1.0) — [security advisory](https://github.com/advisories/GHSA-HH8M-FM6V-7CVG)
- Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) (20.3.27, 21.2.19, 22.0.7) — [security advisory](https://github.com/advisories/GHSA-VPX6-8PJR-4G3V)
- Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning (20.3.27, 21.2.19, 22.0.2) — [security advisory](https://github.com/advisories/GHSA-JHPW-976M-542J)
- Angular Client Hydration DOM Clobbering & Response-Cache Poisoning (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-RGJC-H3X7-9MWG)
- @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate) (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-48R7-HPM6-GFXM)
- @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-39PV-4J6C-2G6V)
- @angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS) (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-58W9-8G37-X9V5)
- @angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker (20.3.25, 21.2.17, 22.0.1) — [security advisory](https://github.com/advisories/GHSA-QXH6-94W6-9R5P)

### Performance

- The runtime translations map is built with a null prototype, avoiding inherited-property lookups. (22.0.7) — [release notes](https://github.com/angular/angular/releases/tag/v22.0.7)

### Behavior and default changes

- Compile-time i18n attribute validation now supports prefix-insensitive DOM schema lookups. (20.3.22, 21.2.15, 22.0.0) — [release notes](https://github.com/angular/angular/releases/tag/v22.0.0), [release notes](https://github.com/angular/angular/releases/tag/v21.2.15), [release notes](https://github.com/angular/angular/releases/tag/v20.3.22)

### Fixes and other changes

- Reserved characters are stripped from translations. (22.2.2) — [release notes](https://github.com/angular/angular/releases/tag/v22.2.2)
- Avoids hitting TypeScript limits when a template contains many translations. (22.1.8) — [release notes](https://github.com/angular/angular/releases/tag/v22.1.8)
- Make i18n_util hasOwnProperty checks safe for property renaming. (22.1.2) — [release notes](https://github.com/angular/angular/releases/tag/v22.1.2)
- Placeholder lookup uses Object.hasOwn, avoiding inherited-property matches. (22.0.7) — [release notes](https://github.com/angular/angular/releases/tag/v22.0.7)
- Resolves a migration failure when tsconfig specifies rootDir. (22.0.4) — [release notes](https://github.com/angular/angular/releases/tag/v22.0.4)
- Tag names are normalized during runtime i18n attribute security context lookup. (20.3.22, 21.2.15, 22.0.0) — [release notes](https://github.com/angular/angular/releases/tag/v22.0.0), [release notes](https://github.com/angular/angular/releases/tag/v21.2.15), [release notes](https://github.com/angular/angular/releases/tag/v20.3.22)

## @angular/core 21

### Breaking changes

- Translations of iframe src are disallowed. (19.2.20, 20.3.18, 21.2.4) — [release notes](https://github.com/angular/angular/releases/tag/v21.2.4), [release notes](https://github.com/angular/angular/releases/tag/v20.3.18), [release notes](https://github.com/angular/angular/releases/tag/v19.2.20)
- Angular applies only known HTML attributes in translated ICU content; unknown attributes are dropped and not rendered, blocking creation of sensitive URI attributes. (19.2.19, 20.3.17, 21.1.6) — [release notes](https://github.com/angular/angular/releases/tag/v21.1.6), [release notes](https://github.com/angular/angular/releases/tag/v20.3.17), [release notes](https://github.com/angular/angular/releases/tag/v19.2.19), [security advisory](https://github.com/advisories/GHSA-PRJF-86W9-MFQV)

### Security

- @angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (19.2.25, 20.3.24, 21.2.16) — [security advisory](https://github.com/advisories/GHSA-HQR9-C56F-3X7F)
- @angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR (19.2.25, 20.3.24, 21.2.16) — [security advisory](https://github.com/advisories/GHSA-GXX4-3XCV-F8QX)
- @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-P3VC-36G9-X9GR)
- @angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-Q6F4-QQRG-JV6X)
- @angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS) (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-692R-GRFM-V8X7)
- @angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-XRXM-CP7J-8XF6)
- Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-GV2Q-MQQV-365M)
- @angular/service-worker: Request Credential & Cache Policy Stripping (19.2.23, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-95QP-CMMW-MGQV)
- Angular: Template and Attribute Namespace Sanitization Bypass (XSS) (19.2.22, 20.3.22, 21.2.15) — [security advisory](https://github.com/advisories/GHSA-F3M7-GQXR-G87X)
- @angular/platform-server: SSRF via Hostname Hijacking (19.2.22, 20.3.21, 21.2.13) — [security advisory](https://github.com/advisories/GHSA-RFH7-FXQC-Q52V)
- Security-sensitive attributes in i18n bindings are now validated. (19.2.22, 20.3.20, 21.2.12) — [release notes](https://github.com/angular/angular/releases/tag/v19.2.22), [release notes](https://github.com/angular/angular/releases/tag/v21.2.12), [release notes](https://github.com/angular/angular/releases/tag/v20.3.20)
- Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server (19.2.21, 20.3.19, 21.2.9) — [security advisory](https://github.com/advisories/GHSA-45Q2-GJVG-7973), [release notes](https://github.com/angular/angular/releases/tag/v20.3.19)
- Validates the locale to prevent path traversal when determining an output path. (21.2.7) — [release notes](https://github.com/angular/angular/releases/tag/v21.2.7)
- Angular vulnerable to XSS in i18n attribute bindings (19.2.20, 20.3.18, 21.2.4) — [security advisory](https://github.com/advisories/GHSA-G93W-MFHG-P222)
- Translated form attributes are sanitized. (19.2.20, 20.3.18, 21.2.4) — [release notes](https://github.com/angular/angular/releases/tag/v21.2.4), [release notes](https://github.com/angular/angular/releases/tag/v20.3.18), [release notes](https://github.com/angular/angular/releases/tag/v19.2.20)
- Translated attribute bindings that contain interpolations are sanitized. (19.2.20, 20.3.18, 21.2.3) — [release notes](https://github.com/angular/angular/releases/tag/v20.3.18), [release notes](https://github.com/angular/angular/releases/tag/v19.2.20), [release notes](https://github.com/angular/angular/releases/tag/v21.2.3)
- Angular has XSS Vulnerability via Unsanitized SVG Script Attributes (19.2.18, 20.3.16, 21.0.7) — [security advisory](https://github.com/advisories/GHSA-JRMJ-C5CX-3CW6), [release notes](https://github.com/angular/angular/releases/tag/v19.2.18)
- Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes (19.2.17, 20.3.15, 21.0.2) — [security advisory](https://github.com/advisories/GHSA-V4HV-RGFQ-GP49), [release notes](https://github.com/angular/angular/releases/tag/21.0.2), [release notes](https://github.com/angular/angular/releases/tag/20.3.15), [release notes](https://github.com/angular/angular/releases/tag/19.2.17)
- Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client (19.2.16, 20.3.14, 21.0.1) — [security advisory](https://github.com/advisories/GHSA-58C5-G7WP-6W37)

### Tooling

- The ng-add schematic now supports the unit-test builder. (21.1.3) — [release notes](https://github.com/angular/angular/releases/tag/v21.1.3)

## @angular/core 20

### Fixes and other changes

- Namespaced SVG <style> elements are no longer stripped by the compiler. (19.2.24, 20.3.23) — [release notes](https://github.com/angular/angular/releases/tag/v20.3.23), [release notes](https://github.com/angular/angular/releases/tag/v19.2.24)