Upgrading @angular/common 21 to 22

paramsInheritanceStrategy now defaults to 'always' instead of 'emptyOnly'.

Removes dedicated support for legacy shadow DOM selectors.

Removes deprecated shadow CSS encapsulation polyfills.

Removes checkNoChanges from the public API.

Removes createNgModuleRef.

Removes ComponentFactoryResolver and ComponentFactory from the API surface.

Removes string support from min and max validation rules.

Removes the Hammer integration.

Removes the deprecated provideRoutes function.

Removes deprecated getAngularLib/setAngularLib; use getAngularJSGlobal/setAngularJSGlobal instead.

Removes provideRoutes(); use provideRouter() or the ROUTES multi token instead.

Removes string value support from min and max validation rules; bound values must be numbers or null.

Changes the default paramsInheritanceStrategy to 'always'.

The second argument of appRef.bootstrap no longer accepts any; the element passed must not be nullable.

Removes ComponentFactoryResolver and ComponentFactory from the API surface.

Removing unused styles may leave other DOM unstyled if not using ViewEncapsulation.Emulated or if styles are used outside Angular.

Removes Hammer integration from platform-browser.

Leave animations are no longer limited to the element being removed.

Removes createNgModuleRef; use createNgModule instead.

Uses FetchBackend as the default HttpBackend implementation.

Changes the return type of TitleStrategy.getResolvedTitleForRoute from any to string | undefined.

The currentSnapshot parameter in CanMatchFn and the canMatch method of CanMatch is now required.

Changes TitleStrategy.getResolvedTitleForRoute return type from any to string or undefined.

Disables nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on ng update, which now trigger on existing projects.

Removes ChangeDetectorRef.checkNoChanges; in tests use fixture.detectChanges() instead.

Hardens parameter encoding against prototype pollution.

Hardens JIT compilation against prototype pollution.

Blocks dangerous data: and vbscript: URLs in the URL sanitizer.

Extends the data: URL allowlist for non-executable MIME types.

Prevents TransferState prototype pollution.

Prevents TransferState prototype pollution.

Angular: Information Leak via HttpTransferCache Bypass When Using withRequestsMadeViaParent

Hardens platform location origin validation during SSR.

Prevents ReDoS in SOURCEMAP_URL_REGEXP.

Guards against DOM clobbering in declareExperimentalWebMcpTool.

Treats iframe credentialless as security-sensitive.

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Limits date format string length.

Prevents prototype pollution in formatDateTime.

Uses cryptographically secure SHA-256 for transfer cache key generation.

Sanitizes href and xlink:href attributes of any element in the MathML namespace.

Sanitizes two-way properties.

Hardens TransferState restoration against DOM clobbering.

Hardens FormGroup control lookups against prototype shadowing.

Hardens platform location origin validation during SSR.

Strips sensitive headers on cross-origin redirects in service-worker.

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

@angular/common: Weak 32-Bit Cache Key Hashing in HttpTransferCache Leading to Cross-Request Data Leakage and State Poisoning

Sanitizes dynamic href and xlink:href bindings on SVG a elements.

Uses Object.create(null) for LOCALE_DATA as a hardening measure.

Throws on suspicious URLs and restricts protocol-relative URLs in platform-server.

Sanitizes placeholder in @angular/common.

Sanitizes meta selectors.

Prevents SSRF bypasses via backslash URLs in HttpClient.

Secures location and document initialization against SSRF and path hijack.

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

Validates security-sensitive attributes in i18n bindings.

Prevents SSRF bypasses via protocol-relative and backslash URLs.

Treats object[data] as a resource URL context in core.

Validates the locale in getOutputPathFn to prevent path traversal in localize.

Sanitizes translated form attributes.

Sanitizes translated attribute bindings with interpolations.

Adds support for Node.js 26.0.0.

Drops support for TypeScript 5.9.

Drops Node.js v20 support; minimum supported Node.js versions are now v22.22.0 and v24.13.1.

Deprecates JSONP support.

Deprecates HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes and functions in favor of standard HTTP requests.

Deprecates JSONP support in HttpClient.

Deprecates ServerXhr in @angular/platform-server.

Deprecates XHR support in @angular/platform-server in favor of standard fetch APIs.

Deprecates withFetch, which can be safely removed.

Deprecates the reportProgress option in favor of reportUploadProgress and reportDownloadProgress.