Upgrading @angular/platform-browser-dynamic 21 to 22
Breaking21.2.25 → 22.2.4Breaking41Security30Platform4Deprecated7New81Changed26Fixed380Other4
Fetching 57 releases from GitHub…56 / 57
BreakingUpgrade verdict
35 breaking changes and 4 platform requirement changes and 29 security fixes.
In plain terms
- Templates using old shadow DOM selector syntax are no longer supported.
- The old polyfills that emulated shadow CSS encapsulation are gone.
- Removes checkNoChanges from the public API.
- Removes createNgModuleRef.
Must act Top 5 of 75 that need code or config changes
Node.js requirement changed in 22.0.0-rc.2: ^20.19.0 || ^22.12.0 || >=24.0.0 → ^22.22.3 || ^24.15.0 || >=26.0.0.
What you must change
Breaking35
Removes dedicated support for legacy shadow DOM selectors.
Removes deprecated shadow CSS encapsulation polyfills.
Removes checkNoChanges from the public API.
checkNoChangesRemoves createNgModuleRef.
createNgModuleRefRemoves
ComponentFactoryResolver and ComponentFactory; pass the component class directly.ComponentFactoryResolverComponentFactoryViewContainerRef.createComponentcreateComponentFunctioncreateComponentRemoves string support from min and max validation rules.
minmaxRemoves the Hammer integration.
HammerSets the default
paramsInheritanceStrategy to 'always'.paramsInheritanceStrategyRemoves the deprecated
provideRoutes function.provideRoutesDeprecated
getAngularLib/setAngularLib are removed; use getAngularJSGlobal/setAngularJSGlobal instead.getAngularLibsetAngularLibgetAngularJSGlobalsetAngularJSGlobalData prefixed attributes no longer bind inputs or outputs.
The second argument of
appRef.bootstrap no longer accepts any; the element must not be nullable.appRef.bootstrapLeave animations are no longer limited to the element being removed.
Components with undefined
changeDetection now default to OnPush.changeDetectionChangeDetectionStrategy.EagerRemoves
createNgModuleRef; use createNgModule instead.createNgModuleRefcreateNgModuleRemoves styles that appear unused by an associated host, which may leave other DOM unstyled.
ViewEncapsulation.EmulatedRemoves Hammer.js integration; use your own implementation.
paramsInheritanceStrategy now defaults to 'always' instead of 'emptyOnly', so route parameters are inherited from all parent routes.paramsInheritanceStrategyprovideRoutes() has been removed; use provideRouter() or the ROUTES multi token instead.provideRoutes()provideRouter()ROUTESRemoves unused styles when associated host is dropped, which may leave other DOM unstyled.
ViewEncapsulation.EmulatedhostRemoves the Hammer integration from platform-browser.
Removes createNgModuleRef; use createNgModule instead.
createNgModuleRefcreateNgModuleUses
FetchBackend as the default HttpBackend implementation.FetchBackendHttpBackendTitleStrategy.getResolvedTitleForRoute return type is now string or undefined instead of any.TitleStrategy.getResolvedTitleForRouteThe
currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required.CanMatchFnCanMatchcanMatchcurrentSnapshotTriggers
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on existing projects.nullishCoalescingNotNullableoptionalChainNotNullableThe compiler throws when inputs, outputs or model bind to the same input/output.
in variables throw in template expressions.Elements with multiple matching selectors now throw at compile time.
Changes the
AnimationCallbackEvent.animationComplete signature.AnimationCallbackEvent.animationCompleteRemoves
ChangeDetectorRef.checkNoChanges; use fixture.detectChanges() in tests.ChangeDetectorRef.checkNoChangesfixture.detectChanges()stream Resource (including rxResource) now resolves synchronously when the stream returns synchronously.ResourcerxResourceUse
HttpXhrBackend with provideHttpClient(withXhr) to keep upload progress reports.HttpXhrBackendprovideHttpClientwithXhrDisables nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on ng update, triggering them on existing projects.
nullishCoalescingNotNullableoptionalChainNotNullableReverts support for nested animations in core.
Security29
Hardens parameter encoding against prototype pollution.
Hardens JIT against prototype pollution.
Blocks dangerous data: and vbscript: URLs in the URL sanitizer.
Extends the data: URL allowlist for non-executable MIME types.
Prevents TransferState prototype pollution.
TransferStateHardens platform location origin validation during SSR.
Prevents ReDoS in SOURCEMAP_URL_REGEXP.
SOURCEMAP_URL_REGEXPPrevents prototype pollution in formatDateTime.
formatDateTimeUses cryptographically secure SHA-256 for transfer cache key generation.
Sanitizes href and xlink:href attributes of any element in the MathML namespace.
hrefxlink:hrefSanitizes two-way properties.
Hardens TransferState restoration against DOM clobbering.
TransferStateHardens FormGroup control lookups against prototype shadowing.
FormGroupRejects non-HTTP(S) URLs in JSONP requests.
JSONPHardens platform location origin validation during SSR.
Strips sensitive headers on cross-origin redirects in service-worker.
Sanitizes dynamic
href and xlink:href bindings on SVG a elements.hrefxlink:hrefUses Object.create(null) for LOCALE_DATA as a hardening measure.
LOCALE_DATAThrows on suspicious URLs and restricts protocol-relative URLs in platform-server.
Sanitizes placeholder values in common.
Sanitizes meta selectors.
Prevents SSRF bypasses via backslash URLs in HttpClient.
HttpClientSecures location and document initialization against SSRF and path hijack.
Validates security-sensitive attributes in i18n bindings.
Prevents SSRF bypasses via protocol-relative and backslash URLs in platform-server.
Treats object[data] as a resource URL context in core.
object[data]Validates the locale in getOutputPathFn to prevent path traversal in localize.
getOutputPathFnSanitizes translated form attributes.
Sanitizes translated attribute bindings with interpolations.
Platform4
Adds support for Node.js 26.0.0.
Drops support for TypeScript 5.9.
Drops support for TypeScript versions older than 6.0.
Raises the minimum supported Node.js versions to v22.22.0 and v24.13.1, dropping Node.js v20 support.
Deprecations to plan for
Deprecated7
Deprecates JSONP support.
Deprecates
HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions.HttpClient.jsonpHttpClientJsonpModuleDeprecates JSONP support in HttpClient.
HttpClient.jsonpHttpClientJsonpModuleDeprecates ServerXhr in platform-server.
ServerXhrDeprecates XHR support in @angular/platform-server in favor of standard fetch APIs.
@angular/platform-serverwithFetch is now deprecated and can be safely removed.withFetchThe
reportProgress option is deprecated; use reportUploadProgress and reportDownloadProgress instead.reportProgressreportUploadProgressreportDownloadProgress