// GitHub

angular/angular

Angular SSR MathML TemplateRef projection bypasses SVG animation validation and enables XSS after 7168bed

Open

Open issue "Angular SSR MathML TemplateRef projection bypasses SVG animation validation and enables XSS after 7168bed" (#70743)
on 16 September 2026 by meanknt

docs: update compiler-cli and core reference skills

Open

Open PR "docs: update compiler-cli and core reference skills" (#70742)
on 15 September 2026 by SkyZeroZx

fix(http): skip transfer cache for URLs containing NUL

Open

Open PR "fix(http): skip transfer cache for URLs containing NUL" (#70741)
on 15 September 2026 by Adyej999

fix(core): apply minimum URL sanitization fallback in ɵɵsanitizeUrlOrResourceUrl for custom elements

Merged or Closed

Closed or merged PR "fix(core): apply minimum URL sanitization fallback in ɵɵsanitizeUrlOrResourceUrl for custom elements" (#70740)
on 15 September 2026 by dynamo-pentester

fix(core): ɵɵsanitizeUrlOrResourceUrl unsafe fallback bypasses URL sanitization on custom elements via hostDirectives (incomplete fix for CVE-2026-88057)

Closed

Closed issue "fix(core): ɵɵsanitizeUrlOrResourceUrl unsafe fallback bypasses URL sanitization on custom elements via hostDirectives (incomplete fix for CVE-2026-88057)" (#70739)
on 15 September 2026 by dynamo-pentester

fix(http): use unambiguous framing for transfer cache keys

Merged or Closed

Closed or merged PR "fix(http): use unambiguous framing for transfer cache keys" (#70715)
on 15 September 2026 by Adyej999

HttpTransferCache cache-key framing is ambiguous when NUL shifts the URL/body boundary

Open

Open issue "HttpTransferCache cache-key framing is ambiguous when NUL shifts the URL/body boundary" (#70738)
on 15 September 2026 by Adyej999

docs: fix malformed code block metadata

Open

Open PR "docs: fix malformed code block metadata" (#70737)
on 15 September 2026 by erkamyaman

docs: close the heading tag in the ng-template output example

Open

Open PR "docs: close the heading tag in the ng-template output example" (#70736)
on 15 September 2026 by erkamyaman

fix(forms): support updateOn blur and submit for custom FormValueControl

Open

Open PR "fix(forms): support updateOn blur and submit for custom FormValueControl" (#70735)
on 15 September 2026 by sbarfurth

forms: custom FormValueControl ignores updateOn ('blur' / 'submit') in reactive and template-driven forms

Open

Open issue "forms: custom FormValueControl ignores updateOn ('blur' / 'submit') in reactive and template-driven forms" (#70734)
on 15 September 2026 by sbarfurth

forms: Provide a submission value that excludes disabled/hidden fields

Open

Open issue "forms: Provide a submission value that excludes disabled/hidden fields" (#70732)
on 15 September 2026 by xripcsu

docs(core): document the code modifier for keyboard event bindings

Open

Open PR "docs(core): document the code modifier for keyboard event bindings" (#70731)
on 15 September 2026 by arturovt

fix(core): ensure references are cleared from idle scheduler

Open

Open PR "fix(core): ensure references are cleared from idle scheduler" (#70730)
on 15 September 2026 by crisbeto

fix(core): don't re-apply protected attributes during hydration

Open

Open PR "fix(core): don't re-apply protected attributes during hydration" (#70729)
on 15 September 2026 by arturovt

core: IdleScheduler permanently strands a bucket after a callback or ApplicationRef._tick throws

Open

Open issue "core: IdleScheduler permanently strands a bucket after a callback or ApplicationRef._tick throws" (#70728)
on 15 September 2026 by COOLak

NG0203 intermittent in production build during initialNavigation with zoneless + lazy routes (not in ng serve)

Closed

Closed issue "NG0203 intermittent in production build during initialNavigation with zoneless + lazy routes (not in ng serve)" (#70719)
on 15 September 2026 by naduda

NG0953 should be suppressable

Open

Open issue "NG0953 should be suppressable" (#70727)
on 15 September 2026 by waterplea

Angular SSR can hang when Domino evaluates an empty `~=` selector

Open

Open issue "Angular SSR can hang when Domino evaluates an empty `~=` selector" (#70726)
on 15 September 2026 by SkyZeroZx

docs: clarify SSR response size limit with fetch integrity

Open

Open PR "docs: clarify SSR response size limit with fetch integrity" (#70724)
on 14 September 2026 by SkyZeroZx

fix(forms): apply validator directives to custom form controls

Open

Open PR "fix(forms): apply validator directives to custom form controls" (#70723)
on 14 September 2026 by thekhegay

docs: fix links that point at missing anchors

Open

Open PR "docs: fix links that point at missing anchors" (#70722)
on 14 September 2026 by erkamyaman

forms: validator directives (required, minlength, …) are not applied to a custom control bound with ngModel / formControl

Open

Open issue "forms: validator directives (required, minlength, …) are not applied to a custom control bound with ngModel / formControl" (#70721)
on 14 September 2026 by thekhegay

refactor(core): show the enclosing component in the NG0502 hydration error

Open

Open PR "refactor(core): show the enclosing component in the NG0502 hydration error" (#70720)
on 14 September 2026 by arturovt

uninvokedFunctionInEventBinding (NG8111) does not check host metadata listeners

Open

Open issue "uninvokedFunctionInEventBinding (NG8111) does not check host metadata listeners" (#70718)
on 14 September 2026 by xia-chao

fix(router): avoid dense elements allocation for numeric URL keys

Open

Open PR "fix(router): avoid dense elements allocation for numeric URL keys" (#70717)
on 14 September 2026 by SkyZeroZx

Angular Router numeric matrix parameters can exhaust memory during SSR

Open

Open issue "Angular Router numeric matrix parameters can exhaust memory during SSR" (#70716)
on 14 September 2026 by SkyZeroZx

fix(docs-infra): use member names as decorator member card ids

Open

Open PR "fix(docs-infra): use member names as decorator member card ids" (#70714)
on 13 September 2026 by erkamyaman

docs: add the missing heading to the effects guide

Open

Open PR "docs: add the missing heading to the effects guide" (#70713)
on 13 September 2026 by erkamyaman

refactor(platform-browser): type shadow DOM renderer fields

Open

Open PR "refactor(platform-browser): type shadow DOM renderer fields" (#70712)
on 13 September 2026 by splincode

angular/angular-cli

build: lock file maintenance (22.1.x)

Open

Open PR "build: lock file maintenance (22.1.x)" (#34094)
on 15 September 2026 by angular-robot

build: lock file maintenance (main)

Open

Open PR "build: lock file maintenance (main)" (#34093)
on 15 September 2026 by angular-robot

refactor(@angular/cli): import markdown files directly for command descriptions

Open

Open PR "refactor(@angular/cli): import markdown files directly for command descriptions" (#34092)
on 14 September 2026 by clydin

@angular/ssr: the route matcher and @angular/router disagree, so per-route headers, status and renderMode come from a different route than the one rendered

Closed

Closed issue "@angular/ssr: the route matcher and @angular/router disagree, so per-route headers, status and renderMode come from a different route than the one rendered" (#34090)
on 14 September 2026 by glivter

fix(@angular/ssr): resolve the request path through the router's URL grammar before matching

Open

Open PR "fix(@angular/ssr): resolve the request path through the router's URL grammar before matching" (#34091)
on 14 September 2026 by glivter

Running @angular/build:unit-test with `--include=` should only compile the included tests

Open

Open issue "Running @angular/build:unit-test with `--include=` should only compile the included tests" (#34089)
on 13 September 2026 by johncrim

build: update cross-repo angular dependencies (22.1.x)

Open

Open PR "build: update cross-repo angular dependencies (22.1.x)" (#34088)
on 11 September 2026 by angular-robot

perf(@angular/cli): skip eager yargs help message formatting during command execution

Open

Open PR "perf(@angular/cli): skip eager yargs help message formatting during command execution" (#34087)
on 11 September 2026 by clydin

refactor(@angular/build): budget and optimize JavaScript transformation concurrency

Open

Open PR "refactor(@angular/build): budget and optimize JavaScript transformation concurrency" (#34086)
on 11 September 2026 by clydin

fix(@angular/build): miscellaneous build correctness and cache fixes

Merged or Closed

Closed or merged PR "fix(@angular/build): miscellaneous build correctness and cache fixes" (#34085)
on 11 September 2026 by alan-agius4

ng new fails to install packages

Closed

Closed issue "ng new fails to install packages" (#34083)
on 11 September 2026 by vladt22

refactor(@angular/build): support supplying worker pool to i18n inliner

Open

Open PR "refactor(@angular/build): support supplying worker pool to i18n inliner" (#34084)
on 11 September 2026 by clydin

Bump version to "v22.2.0-next.7" with changelog.

Merged or Closed

Closed or merged PR "Bump version to "v22.2.0-next.7" with changelog." (#34082)
on 10 September 2026 by alan-agius4

docs: release notes for the v21.2.24 release

Merged or Closed

Closed or merged PR "docs: release notes for the v21.2.24 release" (#34081)
on 10 September 2026 by alan-agius4

Bump version to "v21.2.24" with changelog.

Merged or Closed

Closed or merged PR "Bump version to "v21.2.24" with changelog." (#34080)
on 10 September 2026 by alan-agius4

docs: release notes for the v20.3.37 release

Merged or Closed

Closed or merged PR "docs: release notes for the v20.3.37 release" (#34079)
on 10 September 2026 by alan-agius4

Bump version to "v20.3.37" with changelog.

Merged or Closed

Closed or merged PR "Bump version to "v20.3.37" with changelog." (#34078)
on 10 September 2026 by alan-agius4

docs: release notes for the v22.1.8 release

Merged or Closed

Closed or merged PR "docs: release notes for the v22.1.8 release" (#34077)
on 10 September 2026 by alan-agius4

Bump version to "v22.1.8" with changelog.

Merged or Closed

Closed or merged PR "Bump version to "v22.1.8" with changelog." (#34076)
on 10 September 2026 by alan-agius4

build: replace pnpm -s shorthand with --silent for improved readability

Merged or Closed

Closed or merged PR "build: replace pnpm -s shorthand with --silent for improved readability" (#34075)
on 10 September 2026 by alan-agius4

build: replace pnpm -s shorthand with --silent for improved readability

Merged or Closed

Closed or merged PR "build: replace pnpm -s shorthand with --silent for improved readability" (#34074)
on 10 September 2026 by alan-agius4

build: replace pnpm -s shorthand with --silent for improved readability

Merged or Closed

Closed or merged PR "build: replace pnpm -s shorthand with --silent for improved readability" (#34073)
on 10 September 2026 by alan-agius4

build: update @angular/ng-dev to build c3d7ed184d71d390d3eacff85f4b2b3f16b82660

Merged or Closed

Closed or merged PR "build: update @angular/ng-dev to build c3d7ed184d71d390d3eacff85f4b2b3f16b82660" (#34072)
on 10 September 2026 by alan-agius4

build: set verifyDepsBeforeRun to warn in pnpm workspace configuration

Merged or Closed

Closed or merged PR "build: set verifyDepsBeforeRun to warn in pnpm workspace configuration" (#34071)
on 10 September 2026 by alan-agius4

test(@angular/build): prevent flakiness in incremental-watch e2e test

Merged or Closed

Closed or merged PR "test(@angular/build): prevent flakiness in incremental-watch e2e test" (#34070)
on 10 September 2026 by alan-agius4

build: update dependency rolldown to v1.2.8 (main)

Merged or Closed

Closed or merged PR "build: update dependency rolldown to v1.2.8 (main)" (#34068)
on 10 September 2026 by angular-robot

perf(@angular/build): key Sass package resolutions without containing URL qualification

Open

Open PR "perf(@angular/build): key Sass package resolutions without containing URL qualification" (#34069)
on 10 September 2026 by alan-agius4

build: update dependency rolldown to v1.2.8 (main)-

Merged or Closed

Closed or merged PR "build: update dependency rolldown to v1.2.8 (main)-" (#34067)
on 10 September 2026 by angular-robot

Adding Comments in JSON file format

Closed

Closed issue "Adding Comments in JSON file format" (#34066)
on 10 September 2026 by RishiSharma62004

refactor: replace -s flag with --silent in husky prepare-commit-msg script

Merged or Closed

Closed or merged PR "refactor: replace -s flag with --silent in husky prepare-commit-msg script" (#34065)
on 10 September 2026 by alan-agius4

material2

fix(material/icon): keep FuncIRI references on current origin

Open

Open PR "fix(material/icon): keep FuncIRI references on current origin" (#33812)
on 15 September 2026 by moamenmahmod

bug(material/icon): keep FuncIRI references same-origin on multi-slash paths

Open

Open issue "bug(material/icon): keep FuncIRI references same-origin on multi-slash paths" (#33811)
on 15 September 2026 by moamenmahmod

feat(aria/accordion): custom trigger click

Open

Open issue "feat(aria/accordion): custom trigger click" (#33810)
on 15 September 2026 by mauriziocescon

fix(material/icon): false positive in font detection

Merged or Closed

Closed or merged PR "fix(material/icon): false positive in font detection" (#33805)
on 15 September 2026 by crisbeto

bug(stepper): `markAllAsTouched` does not exist

Open

Open issue "bug(stepper): `markAllAsTouched` does not exist" (#33809)
on 15 September 2026 by dzhavat

build: update all non-major dependencies (main)

Merged or Closed

Closed or merged PR "build: update all non-major dependencies (main)" (#33790)
on 15 September 2026 by angular-robot

build: lock file maintenance (main)

Merged or Closed

Closed or merged PR "build: lock file maintenance (main)" (#33806)
on 15 September 2026 by angular-robot

build: lock file maintenance (22.1.x)

Merged or Closed

Closed or merged PR "build: lock file maintenance (22.1.x)" (#33807)
on 15 September 2026 by angular-robot

docs-bug: v21 documentation is unreachable

Closed

Closed issue "docs-bug: v21 documentation is unreachable" (#33804)
on 15 September 2026 by mwaibel-go

docs: use correct version when redirecting externally

Merged or Closed

Closed or merged PR "docs: use correct version when redirecting externally" (#33808)
on 15 September 2026 by crisbeto

build: update cross-repo angular dependencies (22.1.x)

Merged or Closed

Closed or merged PR "build: update cross-repo angular dependencies (22.1.x)" (#33795)
on 15 September 2026 by angular-robot

build: update cross-repo angular dependencies (main)

Merged or Closed

Closed or merged PR "build: update cross-repo angular dependencies (main)" (#33794)
on 15 September 2026 by angular-robot

build: update pnpm to v11.27.0 (22.1.x)

Merged or Closed

Closed or merged PR "build: update pnpm to v11.27.0 (22.1.x)" (#33792)
on 15 September 2026 by angular-robot

build: update github/codeql-action action to v4.38.0 (22.1.x)

Merged or Closed

Closed or merged PR "build: update github/codeql-action action to v4.38.0 (22.1.x)" (#33791)
on 15 September 2026 by angular-robot

fix(material/core): generate Material Symbols in schematic

Merged or Closed

Closed or merged PR "fix(material/core): generate Material Symbols in schematic" (#33797)
on 14 September 2026 by crisbeto

build: switch infra to material symbols

Merged or Closed

Closed or merged PR "build: switch infra to material symbols" (#33798)
on 14 September 2026 by crisbeto

build: update to pnpm 12

Merged or Closed

Closed or merged PR "build: update to pnpm 12" (#33802)
on 14 September 2026 by crisbeto

feat(aria): directives encapsulation strategy

Closed

Closed issue "feat(aria): directives encapsulation strategy" (#33803)
on 14 September 2026 by mauriziocescon

docs(material): clarify Shadow DOM limitations

Merged or Closed

Closed or merged PR "docs(material): clarify Shadow DOM limitations" (#33801)
on 13 September 2026 by Gaalbu

docs(material): explain wrapping form controls

Merged or Closed

Closed or merged PR "docs(material): explain wrapping form controls" (#33800)
on 13 September 2026 by Gaalbu

docs(cdk): explain reacting to scroll events

Merged or Closed

Closed or merged PR "docs(cdk): explain reacting to scroll events" (#33799)
on 13 September 2026 by Gaalbu

docs: update documentation to use Material Symbols

Merged or Closed

Closed or merged PR "docs: update documentation to use Material Symbols" (#33796)
on 12 September 2026 by crisbeto

fix(cdk/testing): use directive fixture onDestroy

Merged or Closed

Closed or merged PR "fix(cdk/testing): use directive fixture onDestroy" (#33793)
on 10 September 2026 by crisbeto

build: update cross-repo angular dependencies (main) - autoclosed

Merged or Closed

Closed or merged PR "build: update cross-repo angular dependencies (main) - autoclosed" (#33786)
on 10 September 2026 by angular-robot

build: update cross-repo angular dependencies (22.1.x) - autoclosed

Merged or Closed

Closed or merged PR "build: update cross-repo angular dependencies (22.1.x) - autoclosed" (#33787)
on 10 September 2026 by angular-robot

Update to latest Angular

Merged or Closed

Closed or merged PR "Update to latest Angular" (#33788)
on 10 September 2026 by crisbeto

[Patch] Update to latest Angular

Merged or Closed

Closed or merged PR "[Patch] Update to latest Angular" (#33789)
on 10 September 2026 by crisbeto

fix(material/slider): expand value indicators for long labels

Open

Open PR "fix(material/slider): expand value indicators for long labels" (#33785)
on 09 September 2026 by mnkprs

Bump version to "v22.2.0-next.5" with changelog.

Merged or Closed

Closed or merged PR "Bump version to "v22.2.0-next.5" with changelog." (#33784)
on 09 September 2026 by crisbeto

docs: release notes for the v22.1.6 release

Merged or Closed

Closed or merged PR "docs: release notes for the v22.1.6 release" (#33783)
on 09 September 2026 by crisbeto