Upgrading @angular/platform-browser 21 to 22
Breaking21.2.25 → 22.2.4Breaking42Security31Platform4Deprecated7New87Changed25Fixed380Other3
Fetching 57 releases from GitHub…56 / 57
BreakingUpgrade verdict
36 breaking changes and 4 platform requirement changes and 31 security fixes.
In plain terms
- Legacy shadow DOM selector syntax is no longer supported.
- The deprecated shadow CSS encapsulation polyfills are gone.
- Components now default to OnPush change detection instead of Default.
- The test helper is renamed to getLastFixture with a new implementation.
Must act Top 5 of 78 that need code or config changes
Node.js requirement changed in 22.0.0-rc.2: ^20.19.0 || ^22.12.0 || >=24.0.0 → ^22.22.3 || ^24.15.0 || >=26.0.0.
What you must change
Breaking36
Removes dedicated support for legacy shadow DOM selectors.
Removes deprecated shadow CSS encapsulation polyfills.
Sets the default Component changeDetection strategy to OnPush.
ComponentChangeDetectionStrategy.OnPushRenames TestBed.getFixture to TestBed.getLastFixture and updates the implementation.
TestBed.getFixtureTestBed.getLastFixtureRemoves checkNoChanges from the public API.
checkNoChangesRemoves createNgModuleRef.
createNgModuleRefRemoves
ComponentFactoryResolver and ComponentFactory.ComponentFactoryResolverComponentFactoryViewContainerRef.createComponentcreateComponentFunctioncreateComponentRemoves string support from min and max validation rules.
minmaxRemoves the Hammer integration.
HammerRemoves the deprecated
provideRoutes function.provideRoutesDeprecated
getAngularLib/setAngularLib have been removed; use getAngularJSGlobal/setAngularJSGlobal.getAngularLibsetAngularLibgetAngularJSGlobalsetAngularJSGlobalData prefixed attributes no longer bind inputs or outputs.
The second argument of
appRef.bootstrap no longer accepts any.appRef.bootstrapLeave animations are no longer limited to the element being removed.
Components with undefined
changeDetection are now OnPush by default.changeDetectionChangeDetectionStrategy.EagerRemoves
ChangeDetectorRef.checkNoChanges.ChangeDetectorRef.checkNoChangesfixture.detectChanges()Removes
createNgModuleRef; use createNgModule instead.createNgModuleRefcreateNgModuleRemoves styles that appear no longer used by an associated
host.ViewEncapsulation.EmulatedRemoves the Hammer.js integration.
paramsInheritanceStrategy now defaults to 'always' instead of 'emptyOnly'.paramsInheritanceStrategyprovideRoutes() has been removed; use provideRouter() or the ROUTES multi token instead.provideRoutes()provideRouter()ROUTESChanges the default paramsInheritanceStrategy from 'emptyOnly' to 'always'.
paramsInheritanceStrategyparamsInheritanceStrategy now defaults to 'always' instead of 'emptyOnly'.
paramsInheritanceStrategyRemoves the Hammer integration.
Uses
FetchBackend as the default HttpBackend implementation.FetchBackendHttpBackendThe
currentSnapshot parameter in CanMatchFn and the canMatch method of CanMatch is now required.CanMatchFnCanMatchcanMatchcurrentSnapshotTriggers
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on existing projects.nullishCoalescingNotNullableoptionalChainNotNullabletsconfigThe compiler throws when inputs, outputs or model bind to the same input/output.
in variables throw in template expressions.Elements with multiple matching selectors now throw at compile time.
Changes the
AnimationCallbackEvent.animationComplete signature.AnimationCallbackEvent.animationCompletestream Resource (including rxResource) now resolves synchronously when the stream returns synchronously.ResourcerxResourceUpload progress reports require
HttpXhrBackend with provideHttpClient(withXhr).HttpXhrBackendprovideHttpClientwithXhrChanges the return type of
TitleStrategy.getResolvedTitleForRoute to string or undefined.TitleStrategy.getResolvedTitleForRouteDisables nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on ng update, which will now trigger on existing projects.
nullishCoalescingNotNullableoptionalChainNotNullableReverts support for nested animations in core.
Security31
Hardens param encoding against prototype pollution.
Hardens JIT against prototype pollution.
URL sanitizer blocks dangerous data: and vbscript: URLs.
Extends the data: URL allowlist to non-executable MIME types.
Prevents TransferState prototype pollution.
TransferStatePrevents TransferState prototype pollution.
TransferStateRejects prefixed SVG script hosts.
Hardens platform location origin validation during SSR.
Prevents ReDoS in SOURCEMAP_URL_REGEXP.
SOURCEMAP_URL_REGEXPGuards against DOM clobbering in declareExperimentalWebMcpTool.
declareExperimentalWebMcpToolTreats iframe credentialless as security-sensitive.
Prevents prototype pollution in formatDateTime.
formatDateTimeUses cryptographically secure SHA-256 for transfer cache key generation.
Sanitizes href and xlink:href attributes of any element in the MathML namespace.
hrefxlink:hrefSanitizes two-way properties.
Hardens TransferState restoration against DOM clobbering.
TransferStateHardens FormGroup control lookups against prototype shadowing.
FormGroupRejects non-HTTP(S) URLs in JSONP requests.
JSONPHardens platform location origin validation during SSR.
Strips sensitive headers on cross-origin redirects in the service worker.
Sanitizes dynamic href and xlink:href bindings on SVG a elements.
hrefxlink:hrefUses Object.create(null) for LOCALE_DATA as a hardening measure.
LOCALE_DATAObject.create()Throws on suspicious URLs and restricts protocol-relative URLs in platform-server.
Sanitizes placeholder values.
Sanitizes meta selectors.
Prevents SSRF bypasses via backslash URLs in HttpClient.
HttpClientSecures location and document initialization against SSRF and path hijack.
Validates security-sensitive attributes in i18n bindings.
Prevents SSRF bypasses via protocol-relative and backslash URLs.
Sanitizes translated form attributes.
Sanitizes translated attribute bindings with interpolations.
Platform4
Adds support for Node.js 26.0.0.
Drops support for TypeScript 5.9.
TypeScript versions older than 6.0 are no longer supported.
Drops Node.js v20 support; minimum supported Node.js versions are now v22.22.0 and v24.13.1.
Deprecations to plan for
Deprecated7
Deprecates JSONP support.
jsonpDeprecates
HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes and functions.HttpClient.jsonpHttpClientJsonpModuleDeprecates JSONP support in HttpClient.
HttpClient.jsonpHttpClientJsonpModuleDeprecates ServerXhr in @angular/platform-server.
ServerXhrDeprecates XHR support in @angular/platform-server in favor of standard fetch APIs.
@angular/platform-serverwithFetch is now deprecated and can be safely removed.withFetchThe
reportProgress option is deprecated; use reportUploadProgress and reportDownloadProgress instead.reportProgressreportUploadProgressreportDownloadProgress