throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

prevent namespaced SVG <style> elements from being stripped

add upper bounds for digitsInfo

sanitize placeholder

normalize tag names with custom namespaces in DomElementSchemaRegistry

sanitize dynamic href and xlink:href bindings on SVG a elements

strip namespaced SVG script elements during template compilation

reject script element as a dynamic component host

sanitize meta selectors

support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation

synchronize core sanitization schema with compiler

wrap i18n dynamic element property updates in active index states

exclude withCredentials requests from transfer cache

skip TransferCache for cookie-bearing requests by default

normalize path parsing in ServerPlatformLocation

secure location and document initialization against SSRF and path hijack

preserve redirect policy on reconstructed asset requests

Preserves explicit 'credentials: omit' in asset requests

Preserves HTTP cache mode in asset group requests

disallow event attribute bindings in host bindings unconditionally

validate security-sensitive attributes in i18n bindings

add `allowedHosts` option to `renderModule` and `renderApplication`

ensure origin has a trailing slash when parsing url

prevent SSRF bypasses via protocol-relative and backslash URLs

disallow translations of iframe src

sanitize translated attribute bindings with interpolations

sanitize translated form attributes

block creation of sensitive URI attributes from ICU messages

sanitize sensitive attributes on SVG script elements

prevent XSS via SVG animation `attributeName` and MathML/SVG URLs

prevent XSRF token leakage to protocol-relative URLs

introduce `BootstrapContext` for improved server bootstrapping

lexer support for template literals in object literals

preserve comments when removing unused imports

avoid injecting ApplicationRef in FetchBackend

do not register service worker if app is destroyed before it is ready to register

cancel reader when app is destroyed

prevent reading chunks if app is destroyed

avoid conflicts between HMR code and local symbols

Always retain prior results for all files

avoid ECMAScript private field metadata emit

cleanup `rxResource` abort listener

cleanup testability subscriptions

enable stashing only when `withEventReplay()` is invoked

Testing should not throw when Zone does not patch test FW APIs

unregister `onDestroy` in `toSignal`.

speed up resolution of base

cleanup `updateLatestValue` if view is destroyed before promise resolves

missing useExisting providers throwing for optional calls

properly handle app stabilization with defer blocks

less aggressive ngServerMode cleanup

async EventEmitter error should not prevent stability

call DestroyRef on destroy callback if view is destroyed [patch]

prevent stash listener conflicts [patch]

make NgForm emit FormSubmittedEvent and FormResetEvent

issue a warning instead of an error when `NgOptimizedImage` exceeds the preload limit

inject migration: replace param with this.

Include HTTP status code and headers when HTTP requests errored in `httpResource`

error if rawText isn't estimated correctly

ensure HMR works with different output module type

fix docs for output migration

fix ng generate @angular/core:output-migration. Fixes angular#58650

reduce total memory usage of various migration schematics

Do not provide element completions in end tag

Ensure dollar signs are escaped in completions

step 6 tutorial docs

add missing peer dependency on `@angular/common`

throw for invalid "as" expression in if block

Produce fatal diagnostic on duplicate decorated properties

support relative imports to symbols outside `rootDir`

check ngDevMode for undefined

fix ng generate @angular/core:output-migration

fix regexp for event types

fixes #592882 ng generate @angular/core:signal-queries-migration

preserve comments in internal inject migration

prevent omission of deferred pipes in full compilation

Update adapter to log instead of throw errors

handle shorthand assignments in super call

inject migration not handling super parameter referenced via this

Add missing types to transition

assign initializing client's app version, when a request is for worker script

fix used templates are not deleted

handle @angular/build:karma in ng add

ensure `platformBrowserTesting` includes `platformBrowser` providers

report more accurate diagnostic for invalid import

catch hydration marker with implicit body tag

execute timer trigger outside zone

include input name in error message

ensure compiler is loaded before `@angular/common`

handle output emitters when downgrading a component

support equality function in httpResource

incorrect spans for template literals

handle transformed classes when generating HMR code

check whether application is destroyed before initializing event replay

ensures immediate trigger fires properly with lazy loaded routes

fix removal of a container reference used in the component file

add missing peer dependency for `rxjs`

update symbols

clean up `onUrlChange` listener when root scope is destroyed

ensure template IDs are not reused if a source file changes

cache ComponentRef inputs and outputs

prevent invoking replay listeners on disconnected nodes

prevents event replay from being called on comment nodes

Forward the tags for quick info from the type definition

introduce experimental `httpResource`

Add Skip Hydration diagnostic.

support untagged template literals in expressions

pass signal node to throwInvalidWriteToSignalErrorFn

support default value in `resource()`

support streaming resources

support TypeScript 5.8

add `hasValue` narrowing to `ResourceRef`

cancel in-progress request when same value is assigned

Defer afterRender until after first CD

Don't run effects in check no changes pass

fix `resource()`'s `previous.state`

fix race condition in resource()

preserve tracing snapshot until tick finishes

support type set in form validators

add migration to convert templates to use self-closing tags

automatically disable animations on the server

decouple server from animations module

Ensure future-proof correct initialization order

make types for HttpClient more readable

capture stack for HMR errors

provide correct rename info for elements

clean up `urlChanges` subscribers when root scope is destroyed

avoid crash in isolated transform operations

Fix typing on `FormRecord`.

handle tracking expressions requiring temporary variables

handle deferred blocks with shared dependencies correctly

invalidate HMR component if replacement throws an error

account for let declarations in control flow migration

count used dependencies inside existing control flow

gracefully fall back if const enum cannot be passed through

handle const enums used inside HMR data

handle enum members without initializers in partial evaluator

check whether application is destroyed before printing hydration stats

ensure type is preserved during HMR

fixes test timer-based test flakiness in CI

not setting initial value on signal-based input

prepend `baseHref` to `sourceMappingURL` in CSS content

Update pseudoevent created by createMouseSpecialEvent to populate `_originalEvent` property

Update pseudoevent created by createMouseSpecialEvent to populate `_originalEvent` property

Update pseudoevent created by createMouseSpecialEvent to populate `_originalEvent` property

prevent error handling when injector is destroyed

add missing `rxjs` peer dependency

handle :host-context with comma-separated child selector

extract parenthesized dependencies during HMR

handle conditional expressions when extracting dependencies

handle new expressions when extracting dependencies

capture self-referencing component during HMR

replace metadata in place during HMR

skip component ID collision warning during SSR

avoid applying the same replacements twice when cleaning up unused imports

clear renderer cache during HMR when using async animations

update `@ng/component` URL to be relative

disable tree shaking during HMR

animation sometimes renderer not being destroyed during HMR

change `Resource` to use explicit `undefined` in its typings

cleanup `_ejsa` when app is destroyed

cleanup stash listener when app is destroyed

handle shadow DOM encapsulated component with HMR

HMR not matching component that injects ViewContainerRef

treat exceptions in `equal` as part of computation

run HMR replacement in the zone

roll back HMR fix

expose component instance in NgComponentOutlet

allow $any in two-way bindings

use chunk origin in template HMR request URL

check event side of two-way bindings

add event listener options to renderer

add utility for resolving defer block information to ng global

extend the set of profiler events

set kind field on template and effect nodes

support TypeScript 5.7

Defer afterRender until after first CD

Don't run effects in check no changes pass

add schematic to clean up unused imports

resolve text replacement issue

avoid circular DI error in async renderer

complete router `events` on dispose

handle more node types when extracting dependencies

destroy renderer when replacing styles during HMR

incorrect stats when migrating queries with best effort mode

account for more expression types when determining HMR dependencies

preserve defer block dependencies during HMR when class metadata is disabled

Ensure that a destroyed `effect` never run.

avoid circular DI error in async renderer

styles not replaced during HMR when using animations renderer

avoid component ID collisions with user code

avoid triggering `on timer` and `on idle` on the server

Fix nested timer serialization

Warn user when transfer state happens more than once

consider pre-release versions when detecting feature support

error in unused standalone imports diagnostic

Fix a bug where snapshotted functions are being run twice if they return a nullish/falsey value.

collect external component styles from server rendering

account for multiple generated namespace imports in HMR

Explicitly manage TracingSnapshot lifecycle and dispose of it once it's been used.

class content being deleted in some edge cases

correctly strip away parameters surrounded by comments in inject migration

don't migrate classes with parameters that can't be injected

inject migration aggressively removing imports

inject migration dropping code if everything except super is removed

preserve type literals and tuples in inject migrations

remove peer dependency on animations

more accurate diagnostics for host binding parser errors

correctly clear template HMR internal renderer cache

correctly perform lazy routes migration for components with additional decorators

Ensure _tick is always run within the TracingSnapshot.

Ensure resource sets an error

make component id generation more stable between client and server builds

Prevents race condition of cleanup for incremental hydration

work around TypeScript 5.7 issue

add fix for individual unused imports

allow fixes to run without template info

fix provide-initializer migration when using useFactory

handle parameters with initializers in inject migration

Mark hoisted properties as removed in inject migration

add optional rounded transform support in cloudinary image loader

automatically use sizes auto in NgOptimizedImage

disable keyvalue sorting using null compareFn

add diagnostic for unused standalone imports

add support for the `typeof` keyword in template expressions.

`this.a` should always refer to class property `a`

add more specific matcher for hydrate never block

avoid having to duplicate core environment

control flow nodes with root at the end projected incorrectly

fix `:host` parsing in pseudo-selectors

fix multiline selectors

handle typeof expressions in serializer

ignore placeholder-only i18n messages

resolve `:host:host-context(.foo)`

transform chained pseudo-selectors

'strictStandalone' flag enforces standalone

ensure template style elements are preprocessed as inline styles

generate the HMR replacement module

disable standalone by default on older versions of Angular

do not fail fatal when references to non-existent module are discovered

do not report unused declarations coming from an imported array

incorrectly generating relative file paths on case-insensitive platforms

make the unused imports diagnostic easier to read

report individual diagnostics for unused imports

reduce duplicate component style resolution

Add a schematics to migrate to `standalone: false`.

Add async `run` method on `ExperimentalPendingTasks`

Add incremental hydration public api

Add rxjs operator prevent app stability until an event

add syntactic sugar for initializers

allow passing `undefined` without needing to include it in the type argument of `input`

allow running output migration on a subset of paths

change effect() execution timing & no-op `allowSignalWrites`

drop support for TypeScript 5.4

experimental `resource()` API for async dependencies

experimental impl of `rxResource()`

flipping the default value for `standalone` to `true`

initial version of the output migration

introduce `afterRenderEffect`

introduce debugName optional arg to framework signal functions

introduce the reactive linkedSignal

mark input, output and model APIs as stable

mark signal-based query APIs as stable

migrate ExperimentalPendingTasks to PendingTasks

promote `outputFromObservable` & `outputToObservable` to stable.

Promote `takeUntilDestroyed` to stable.

stabilize `@let` syntax

support TypeScript 5.6

treat directives, pipes, components as by default

allow signal write error

avoid breaking change with apps using rxjs 6.x

clean up event contract once hydration is done

ComponentFixture autoDetect feature works like production

Ensure the `ViewContext` is retained after closure minification

fallback to default ng-content with empty projectable nodes.

Fix fixture.detectChanges with autoDetect disabled and zoneless

fixes issues with control flow and incremental hydration

prevent errors on contract cleanup

Prevents trying to trigger incremental hydration on CSR

Re-assign error codes to be within core bounds (<1000)

resolve forward-referenced host directives during directive matching

rethrow errors during ApplicationRef.tick in TestBed

Schedulers run in zone above Angular rather than root

set encapsulation to `None` for empty component styles

remove deprecated `factories` Property in `KeyValueDiffers`

support `output()`-shaped outputs

switch to `ComponentRef.setInput` & remove custom scheduler

add ability to clear a FormRecord

fix FormRecord type inference

promote `withRequestsMadeViaParent` to stable.

preserve all headers from Headers object

add code fix for unused standalone imports

add code reactoring action to migrate `@Input` to signal-input

allow code refactorings to compute edits asynchronously

support converting to signal queries in VSCode extension

support migrating full classes to signal inputs in VSCode

support migrating full classes to signal queries

The suppress diagnostics option should work for external templates

remove deprecated `name` option.

add a combined migration for all signals APIs

add schematic to migrate to signal queries

capture output migration stats

expose output as function migration

introduce signal input migration as `ng generate` schematic

migrate .pipe calls in outputs used in tests

print output migration stats in ng generate

remove complete calls for migrated outputs

replace .next usage on outputs

add outputs migration to combined shorthand

change imports to be G3 compatible

do not migrate next calls in template if not an EventEmitter

flip the default standalone flag in route-lazy-loading migration

include the output migration in the defaults of the signal migration

inject migration always inserting generated variables before super call

inject migration not inserting generated code after super call in some cases

migrate more .next output usages

properly bundle shared compiler code into migrations

properly handle comments in output migration

properly migrate output aliases

properly replace imports across files

properly resolve tsconfig paths on windows

replace removed NgModules in tests with their exports

correctly add external stylesheets to ShadowDOM components

remove deprecated `BrowserModule.withServerTransition` method

destroy `PlatformRef` when error happens during the `bootstrap()` phase

Add `routerOutletData` input to `RouterOutlet` directive

Align RouterModule.forRoot errorHandler with provider error handler

remove setter for `injector` on `OutletContext`

Update Resolve interface to include RedirectCommand like ResolveFn

allow specifying maxAge for entire application

finish implementation of refreshAhead feature

add support for configuring trusted proxy headers via environment variable

allow all hosts in common engine rendering options to prevent validation errors

upgrade postcss to 8.5.12

update esbuild to `0.28.0`

introduce trustProxyHeaders option to safely validate and sanitize proxy headers

update vite to `6.4.2`

update picomatch to 4.0.4

update picomatch to 4.0.4

update picomatch to 4.0.4

update picomatch to 4.0.4

update `ajv` to `8.18.0`

update rollup to 4.59.0

prevent open redirect via X-Forwarded-Prefix header

validate host headers to prevent header-based SSRF

update webpack to 5.105.0

update vite to v6.4.1

prevent malicious URL from overriding host

update `vite` to `6.3.6`

avoid extra tick in SSR builds

avoid extra tick in SSR dev-server builds

introduce BootstrapContext for isolated server-side rendering

update dependency webpack-dev-server to v5.2.2

HMR requires AOT do not show HMR enabled when using JIT

include full metadata for AOT unit-testing

remove `background_color` and `theme_color` from manifest

properly handle Node.js `require()` errors with ESM modules

correctly set i18n subPath in webpack browser builder

avoid attempting to watch bundler internal files

avoid internal karma request cache for assets

fix unnecessary esbuild rebuilds

update vite to 6.2.7

update http-proxy-middleware to v3.0.5

pass `preserveSymlinks` option to Karma esbuild builder

support `getPrerenderParams` for wildcard routes

include `module` value check when adding custom conditions

prevent nested CSS in components

properly resolve transitive external dependencies in vite-dev-server

update vite to 6.2.6

include component test metadata in development builds

skip normalization of relative externals

properly resolve relative schematics when executed from a nested directory

correctly handle `false` value in server option

update vite to 6.2.4 due to a security issues

correct handling of response/request errors

handle undefined `getOrCreateAngularServerApp` during error compilation

normalize karma asset paths before lookup

update vite to 6.2.3