Upgrading @angular/platform-browser-dynamic 19 to 20
Breaking19.2.25 → 20.3.34Breaking24Security27Platform6Deprecated16New81Changed19Fixed291Other1
BreakingUpgrade verdict
20 breaking changes and 6 platform requirement changes and 27 security fixes.
In plain terms
- If your translated ICU messages rely on custom or unknown HTML attributes, those attributes will no longer appear in the output.
- Server-side apps must pass a BootstrapContext to bootstrapApplication. On the server, getPlatform() now returns null and destroyPlatform() does nothing.
- The debug check-no-changes provider is renamed, now applies to all checkNoChanges runs, and drops the useNgZoneOnStable option.
- The InjectFlags enum is no longer part of the public API.
Must act Top 5 of 67 that need code or config changes
Node.js requirement changed in 20.0.0-rc.2: ^18.19.1 || ^20.11.1 || >=22.0.0 → ^20.19.0 || ^22.12.0 || >=24.0.0.
What you must change
Breaking20
Angular now only applies known HTML attributes from translated ICU content; unknown attributes are dropped and not rendered.
Server bootstrapping no longer relies on a global platform injector;
getPlatform() returns null and destroyPlatform() is a no-op on the server.bootstrapApplicationBootstrapContextgetPlatform()destroyPlatform()Renames provideExperimentalCheckNoChangesForDebug to provideCheckNoChangesConfig and changes its behavior.
provideExperimentalCheckNoChangesForDebugprovideCheckNoChangesConfiguseNgZoneOnStableintervalRemoves InjectFlags from the public API.
InjectFlagsRemoves TestBed.get.
TestBed.getRenames afterRender to afterEveryRender and stabilizes it.
afterRenderafterEveryRenderRemoves TestBed.flushEffects(); use TestBed.tick() instead.
TestBed.flushEffects()TestBed.tick()Renames provideExperimentalZonelessChangeDetection to provideZonelessChangeDetection.
provideExperimentalZonelessChangeDetectionprovideZonelessChangeDetectionRemoves InjectFlags and stops inject, Injector.get, EnvironmentInjector.get, TestBed.get and TestBed.inject from accepting it.
InjectFlagsinjectInjector.getEnvironmentInjector.getTestBed.getTestBed.injectPendingTasks.run no longer returns the async function result; use PendingTasks.add to re-implement.PendingTasks.runPendingTasks.addRoute guards arrays no longer include any; union uses functional guards and ProviderToken<T>|string.RouteInjector.getProviderTokeninjector.getApplicationRef.tick no longer catches and reports errors to ErrorHandler; errors are thrown to callers.ApplicationRef.tickErrorHandlerDetects the Y formatter (week-numbering year) without w (week number) as a suspicious date pattern.
YwyAsyncPipe now catches unhandled errors in subscriptions and promises and reports them to ErrorHandler.
AsyncPipeErrorHandler'in' in an expression now refers to the operator.
invoid in an expression now refers to the operator instead of a component property.
voidUncaught listener errors are now also reported to Angular's internal error handling and rethrown by default in tests.
ErrorHandlerconfigureTestingModulerethrowApplicationErrorsAnimations are now guaranteed to be flushed during automatic change detection and
ApplicationRef.tick.ApplicationRef.tickRedirectFn can now return Observable or Promise; direct callers may need adjustment.RedirectFnObservablePromiseRouter public API methods that required writable arrays now accept readonly arrays when no mutation occurs.
Security27
Disallows event handler attributes in Meta.
MetaSanitizes host bindings on concrete hosts.
Rejects dynamic script host elements in core.
Prevents caching of HTTP responses that carry Set-Cookie headers.
Uses cryptographically secure SHA-256 for transfer cache key generation.
Sanitizes two-way properties in the compiler.
Hardens TransferState restoration against DOM clobbering.
TransferStateRejects non-HTTP(S) URLs in JSONP requests.
Hardens platform location origin validation during SSR.
Strips sensitive headers on cross-origin redirects in service-worker.
Throws on suspicious URLs and restricts protocol-relative URLs in platform-server.
Sanitizes the placeholder value.
Sanitizes dynamic href and xlink:href bindings on SVG a elements.
hrefxlink:hrefStrips namespaced SVG script elements during template compilation.
Normalizes tag names in runtime i18n attribute security context lookup.
Rejects script element as a dynamic component host.
Sanitizes meta selectors.
Secures location and document initialization against SSRF and path hijack.
Validates security-sensitive attributes in i18n bindings.
Fixes SSRF bypasses in platform-server via protocol-relative and backslash URLs.
Disallows translations of iframe src in the compiler.
Sanitizes translated attribute bindings that contain interpolations.
Sanitizes translated form attributes.
Blocks creation of sensitive URI attributes from ICU messages.
Sanitizes sensitive attributes on SVG script elements.
Fixes an XSS vulnerability via SVG animation attributeName and MathML/SVG URLs in the compiler.
attributeNamePrevents XSRF token leakage to protocol-relative URLs.
Platform6
Updates minimum Node.js support to 20.19, 22.12, and 24.0.
Drops support for TypeScript older than 5.8.
Updates supported Node.js versions.
Updates minimum Node.js support to 20.19, 22.12, and 24.0.
Drops support for TypeScript versions less than 5.8.
Drops Node.js v18 and Node.js 22.0 to 22.10 support; requires at least Node.js 20.11.1.
Deprecations to plan for
Deprecated14
Deprecates ServerXhr in platform-server.
ServerXhrDeprecates XHR support in @angular/platform-server in favor of standard fetch APIs.
@angular/platform-serverDeprecates the animations package.
Deprecates the animations field on the component interface.
animationsDeprecates @angular/animations.
@angular/animationsDeprecates Router.getCurrentNavigation in favor of the Router.currentNavigation signal.
Router.getCurrentNavigationRouter.currentNavigationDeprecates
ngIf, ngFor and ngSwitch in favor of control flow blocks @for, @if and @switch.ngIfngForngSwitch@for@if@switchDeprecates the platform-browser-dynamic package.
platform-browser-dynamicDeprecates the HammerJS integration.
HammerJSDeprecates the platform-server testing entry point.
Deprecates
ng-reflect-* attributes and stops producing them by default; adds provideNgReflectAttributes().provideNgReflectAttributes()ng-reflect-*Deprecates all entries of
@angular/platform-browser-dynamic.@angular/platform-browser-dynamicDeprecates HammerJS support, to be removed in a future major version.
HammerJSDeprecates
@angular/platform-server/testing; use e2e tests to verify SSR behavior instead.@angular/platform-server/testingAPI changes
Generated by DepDelta from published .d.ts files. Not mixed with prose notes.
- removed:
const ɵINTERNAL_BROWSER_DYNAMIC_PLATFORM_PROVIDERS: StaticProvider[]