Upgrading @angular/platform-browser-dynamic 18 to 19
Breaking18.2.14 → 19.2.25Breaking95Security19Platform5New37Changed12Fixed222Other3
SecurityThrows on suspicious URLs and restricts protocol-relative URLs in platform-server.e2fb854d55 ↗
BreakingUpgrade verdict
88 breaking changes and 5 platform requirement changes and 18 security fixes.
In plain terms
- If a translation adds an attribute Angular does not recognize, it will no longer appear in the rendered output.
- On the server, apps must now pass a context object when starting up instead of relying on a shared global platform.
- In templates, writing `this.` before a variable name no longer reaches the template's own variables.
- New components, directives and pipes no longer need to be declared in an NgModule unless you opt out.
Must act Top 5 of 111 that need code or config changes
What you must change
Breaking88
Angular now only applies known HTML attributes in translated ICU content; unknown attributes are dropped and not rendered.
Server bootstrapping no longer relies on a global platform injector; bootstrapApplication now takes a BootstrapContext.
BootstrapContextbootstrapApplicationgetPlatform()destroyPlatform()this.foo property reads no longer refer to template context variables.Angular directives, components and pipes are now standalone by default.
standaloneExperimentalPendingTasks has been renamed to PendingTasks.ExperimentalPendingTasksPendingTaskscreateComponent now renders default fallback content with empty projectableNodes.createComponentprojectableNodesng-contentdocument.createTextNodeThe deprecated
factories property in KeyValueDiffers has been removed.KeyValueDiffersfactoriesThe
name option in the ng add @localize schematic has been removed in favor of the project option.nameprojectThe deprecated
BrowserModule.withServerTransition method has been removed.BrowserModule.withServerTransitionAPP_IDThe
Router.errorHandler property has been removed.Router.errorHandlerwithNavigationErrorHandlerprovideRouterRouterModule.forRooterrorHandlerresolveNavigationPromiseOnErrorDisables standalone by default on older versions of Angular.
Flips the default value for
standalone to true.standaloneTreats directives, pipes and components as standalone by default.
Falls back to default ng-content when projectable nodes are empty.
ng-contentElements switch to ComponentRef.setInput and remove the custom scheduler.
ComponentRef.setInputRemoves the deprecated
name option from localize.nameRemoves complete calls for migrated outputs.
Flips the default standalone flag in the route-lazy-loading migration.
Includes the output migration in the defaults of the signal migration.
Removes the deprecated
BrowserModule.withServerTransition method.BrowserModule.withServerTransitionRemoves the setter for
injector on OutletContext.OutletContextinjectorFixes
:host parsing in pseudo-selectors.:hostChanges timing of the
effect API: effects triggered outside change detection run as part of change detection instead of as a microtask.effectDoes not migrate next calls in templates if not an EventEmitter.
EventEmitternext()Effects triggered during change detection (e.g. by input signals) run earlier, before the component's template.
effectErrors thrown during
ApplicationRef.tick are now rethrown when using TestBed.ApplicationRef.tickTestBedComponentFixture.whenStablerethrowApplicationErrorsTestBed.configureTestingModuleZone coalescing and hybrid mode scheduling timers now run in the zone above Angular rather than the root zone.
fakeAsynctickflushChange detection timing around custom elements has changed subtly due to the hybrid scheduler.
Updates the
Resolve interface to include RedirectCommand like ResolveFn.ResolveResolveFnRedirectCommandAdds a compiler diagnostic for unused standalone imports.
Adds support for the
typeof keyword in template expressions.typeofMakes
this.a always refer to class property a.this.aAdds a more specific matcher for the hydrate never block.
Avoids having to duplicate the core environment.
Fixes incorrect projection of control flow nodes whose root is at the end.
Fixes multiline selectors.
Handles typeof expressions in the serializer.
typeofIgnores placeholder-only i18n messages.
Resolves
:host:host-context(.foo).:host:host-context()Transforms chained pseudo-selectors.
Adds the
strictStandalone flag, which enforces standalone components.strictStandaloneEnsures template style elements are preprocessed as inline styles.
Generates the HMR replacement module.
Stops failing fatally when references to a non-existent module are discovered.
Stops reporting unused declarations that come from an imported array.
Fixes incorrect relative file path generation on case-insensitive platforms.
Makes the unused imports diagnostic easier to read.
Reports individual diagnostics for unused imports.
Changes
effect() execution timing and makes allowSignalWrites a no-op.effect()allowSignalWritesCleans up the event contract once hydration is done.
ComponentFixture autoDetect now behaves like production.
ComponentFixtureEnsures the ViewContext is retained after closure minification.
ViewContextFixes issues with control flow and incremental hydration.
Prevents errors on contract cleanup.
Prevents trying to trigger incremental hydration on CSR.
Re-assigns error codes to be within core bounds (below 1000).
Resolves forward-referenced host directives during directive matching.
Schedulers now run in the zone above Angular rather than the root zone.
Sets encapsulation to None for empty component styles.
Elements support output()-shaped outputs.
output()Adds a combined migration for all signals APIs.
Adds a schematic to migrate to signal queries.
Captures output migration stats.
Exposes the output as function migration.
Introduces the signal input migration as an
ng generate schematic.ng generatePrints output migration stats in ng generate.
ng generateReplaces .next usage on outputs.
Adds the outputs migration to the combined shorthand.
Changes imports to be G3 compatible.
Makes the inject migration always insert generated variables before the super call.
Fixes the inject migration not inserting generated code after the super call in some cases.
Migrates more .next output usages.
Properly bundles shared compiler code into migrations.
Properly handles comments in the output migration.
Properly migrates output aliases.
Properly replaces imports across files.
Properly resolves tsconfig paths on Windows.
tsconfigReplaces removed NgModules in tests with their exports.
NgModulesCorrectly adds external stylesheets to ShadowDOM components.
Destroys
PlatformRef when an error happens during the bootstrap() phase.PlatformRefbootstrap()Adds a
routerOutletData input to the RouterOutlet directive.RouterOutletrouterOutletDataAligns the
RouterModule.forRoot errorHandler with the provider error handler.RouterModule.forRootAllows specifying
maxAge for the entire application in the service worker.maxAgeFinishes the implementation of the
refreshAhead feature in the service worker.refreshAheadErrors thrown during ApplicationRef.tick are now rethrown when using TestBed.
ApplicationRef.tickTestBedComponentFixture.whenStablerethrowApplicationErrorsTestBed.configureTestingModuleComponentFixture autoDetect now attaches the fixture to ApplicationRef, so automatic change detection errors go to ErrorHandler.ComponentFixtureautoDetectApplicationRefErrorHandlerFixes fixture.detectChanges when autoDetect is disabled and zoneless.
fixture.detectChangesMigrates .pipe calls in outputs used in tests.
Security18
Throws on suspicious URLs and restricts protocol-relative URLs in platform-server.
Sanitizes the placeholder value.
Sanitizes dynamic href and xlink:href bindings on SVG a elements.
hrefxlink:hrefStrips namespaced SVG script elements during template compilation.
Rejects script element as a dynamic component host.
Sanitizes meta selectors.
Synchronizes core sanitization schema with compiler.
Secures location and document initialization against SSRF and path hijack.
Disallows event attribute bindings in host bindings unconditionally.
Fixes platform-server SSRF bypasses involving protocol-relative and backslash URLs.
Disallows translations of iframe src in the compiler to prevent unsafe translated URLs.
iframesrcSanitizes translated attribute bindings that contain interpolations.
Sanitizes translated form attributes.
Blocks creation of sensitive URI attributes from ICU messages.
Sanitizes sensitive attributes on SVG script elements.
Prevents XSS via SVG animation attributeName and MathML/SVG URLs in the compiler.
attributeNamePrevents XSRF token leakage to protocol-relative URLs in http.
Addresses Trusted Types violations in @angular/upgrade.
@angular/upgradePlatform5
Supports TypeScript 5.8.
Supports TypeScript 5.7.
TypeScript versions less than 5.5 are no longer supported.
Drops support for TypeScript 5.4.
Adds support for TypeScript 5.6.
API changes
Generated by DepDelta from published .d.ts files. Not mixed with prose notes.
- removed:
const ɵplatformCoreDynamic: (extraProviders?: StaticProvider[]) => PlatformRef
- removed:
class ɵDOMTestComponentRenderer extends TestComponentRenderer - removed:
const ɵplatformCoreDynamicTesting: (extraProviders?: any[]) => PlatformRef - removed:
constructor ɵDOMTestComponentRenderer(_doc: any) - removed:
method ɵDOMTestComponentRenderer.insertRootElement(rootElId: string): void - removed:
method ɵDOMTestComponentRenderer.removeAllRootElements(): void - removed:
static property ɵDOMTestComponentRenderer.ɵfac: i0.ɵɵFactoryDeclaration<ɵDOMTestComponentRenderer, never> - removed:
static property ɵDOMTestComponentRenderer.ɵprov: i0.ɵɵInjectableDeclaration<ɵDOMTestComponentRenderer>