Upgrading @angular/router 21 to 22

Removes dedicated support for legacy shadow DOM selectors.

Removes deprecated shadow CSS encapsulation polyfills.

Renames TestBed.getFixture to TestBed.getLastFixture and updates the implementation.

Removes checkNoChanges from the public API.

Removes createNgModuleRef.

Removes ComponentFactoryResolver and ComponentFactory from the API surface.

Removes string support from min and max validation rules.

Removes the Hammer integration.

Removes the deprecated provideRoutes function.

Deprecated getAngularLib/setAngularLib are removed; use getAngularJSGlobal/setAngularJSGlobal instead.

paramsInheritanceStrategy now defaults to 'always' instead of 'emptyOnly', so route parameters are inherited from all parent routes.

provideRoutes() is removed; use provideRouter() or the ROUTES multi token instead.

Removes string value support from the min and max validation rules; bound values must be numbers or null.

The second argument of appRef.bootstrap no longer accepts any; the element passed must not be nullable.

Removes styles when they appear no longer used by an associated host, which may leave other DOM unstyled.

Removes Hammer integration.

Removes createNgModuleRef; use createNgModule instead.

Uses FetchBackend as the default HttpBackend implementation.

The return type of TitleStrategy.getResolvedTitleForRoute now reflects that it returns only string or undefined.

The currentSnapshot parameter in CanMatchFn and the canMatch method of CanMatch is now required.

Disables the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on ng update, which now trigger on existing projects.

Elements with multiple matching selectors now throw at compile time.

Reverts support for nested animations in core.

Hardens param encoding against prototype pollution.

Hardens JIT against prototype pollution.

Blocks dangerous data: and vbscript: URLs in the URL sanitizer.

Extends the data: URL allowlist for non-executable MIME types.

@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

Rejects prefixed SVG script hosts.

Prevents TransferState prototype pollution.

Disallows event handler attributes in Meta.

Rejects prefixed SVG script hosts.

Hardens platform location origin validation during SSR.

Prevents ReDoS in SOURCEMAP_URL_REGEXP in platform-browser.

Guards against DOM clobbering in declareExperimentalWebMcpTool.

Treats iframe credentialless as security-sensitive.

Prevents prototype pollution in formatDateTime.

Uses cryptographically secure SHA-256 for transfer cache key generation.

Sanitizes href and xlink:href attributes of any element in the MathML namespace.

Sanitizes two-way properties.

Hardens TransferState restoration against DOM clobbering.

Hardens FormGroup control lookups against prototype shadowing.

Hardens platform location origin validation during SSR.

Strips sensitive headers on cross-origin redirects in service-worker.

Sanitizes dynamic href and xlink:href bindings on SVG a elements.

Uses Object.create(null) for LOCALE_DATA as a hardening measure.

Throws on suspicious URLs and restricts protocol-relative URLs in platform-server.

Prevents SSRF bypasses via backslash URLs in HttpClient.

Secures location and document initialization against SSRF and path hijack.

Validates security-sensitive attributes in i18n bindings.

Prevents SSRF bypasses via protocol-relative and backslash URLs.

Validates the locale in getOutputPathFn to prevent path traversal.

Sanitizes translated form attributes in core.

Sanitizes translated attribute bindings with interpolations.

Adds support for Node.js 26.0.0.

Drops support for TypeScript 5.9.

Drops Node.js v20 support; minimum supported Node.js versions are now v22.22.0 and v24.13.1.

Deprecates JSONP support.

Deprecates HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes and functions in favor of standard HTTP requests.

Deprecates JSONP support in HttpClient.

Deprecates ServerXhr in @angular/platform-server.

Deprecates XHR support in @angular/platform-server in favor of standard fetch APIs.

withFetch is now deprecated and can be safely removed.

The reportProgress option is deprecated; use reportUploadProgress and reportDownloadProgress instead.