Angular: v22.0.1 Release

common

| Commit | Description | | -- | -- | | | escape CSS string-terminating characters in escapeCssUrl | | | Limits date format string length | | | prevent prototype pollution in formatDateTime | | | use cryptographically secure SHA-256 for transfer cache key generation |

compiler

| Commit | Description | | -- | -- | | | disallow i18n event attributes | | | more robust logic to check if regex can be optimized | | | sanitize href/xlink:href attributes of any element of the MathML namespace | | | sanitize two-way properties |

compiler-cli

| Commit | Description | | -- | -- | | | bind switch exhaustive check expressions |

core

| Commit | Description | | -- | -- | | | disable WebMCP during SSR | | | Handle synchronous errors in PendingTasks.run function | | | harden TransferState restoration against DOM clobbering | | | prevent dangling prevConsumer reference from leaking destroyed views (#68681) | | | require WebMCP tool descriptions | | | update comment for Default change detection | | | use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray | | | validate lowercase SVG animation attribute names |

forms

| Commit | Description | | -- | -- | | | delay mcp reading the form model by a tick | | | harden FormGroup control lookups against prototype shadowing | | | remove animationstart listener on component destroy to prevent memory leak | | | set additionalProperties: false on generated WebMCP form |

http

| Commit | Description | | -- | -- | | | ensure query parameters are inserted before URL fragments | | | pass down the reportUploadProgress and reportDownloadProgress on post/patch requests | | | preserve empty referrer option in HttpRequest | | | Rejects non-HTTP(S) URLs in JSONP requests |

language-service

| Commit | Description | | -- | -- | | | prevent external template inlay hints from appearing in TS files |

platform-server

| Commit | Description | | -- | -- | | | harden platform location origin validation during SSR | | | deprecate ServerXhr |

router

| Commit | Description | | -- | -- | | | use native URL object for navigation boundary and comparison |

service-worker

| Commit | Description | | -- | -- | | | Strips sensitive headers on cross-origin redirects |

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)