angular/angular

Fix

TransferState security fix

Closed a prototype pollution vulnerability in server-side state transfer that could let attackers tamper with app behavior.

Fix

Prototype collision hardening

Core and common packages were updated so objects can't accidentally collide with built-in JavaScript prototype members.

Fix

Standalone bootstrap migration fix

The migration tool no longer drops registerLocaleData calls when converting apps to standalone bootstrap.

Fix

Language service quote-style imports

Auto-generated imports in your editor now respect your preferred quote style.

Fix

Deferred import deduplication

The compiler now avoids duplicating lazy-loaded imports when the same module appears in multiple defer blocks.

Fix

VS Code extension security fix

Patched a command URI injection vulnerability in the TypeScript SDK approval flow of the Angular VS Code extension.

Fix

Oversized response cancellation

HTTP requests now cancel fetch responses whose bodies exceed size limits instead of hanging.

Fix

HTTP charset handling

JSON responses are always decoded as UTF-8, and the fetch backend now respects content-type character sets.

Fix

Cookie parsing fixes

Cookie parsing strips stray quote characters and handles malformed values without crashing.

Fix

Clearer hydration errors

Missing hydration nodes now produce a descriptive error message instead of an unexplained crash.

Fix

Nested CSS scoping fixes

Component styles now correctly scope nested CSS rules and skip encapsulation when ::ng-deep is present.

Fix

Friendlier hydration mismatch errors

Element hydration mismatches now throw a proper Angular error code instead of a raw TypeError.

Fix

Radio input sync fix

Radio buttons stay correctly selected when their option values change dynamically.

Fix

HTTP interceptor ordering

Root-level interceptors now run at the correct point in the request chain.