compiler

Commit	Description
	strip namespaced SVG script elements during template compilation

core

Commit	Description
	do not insert todo when migrating void @output
	makes resource URL sanitizer lookup case-insensitive
	reject script element as a dynamic component host
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation
	synchronize core sanitization schema with compiler
	visit ICU expressions in signal migration schematics

forms

Commit	Description
	avoid spurious recomputation in FormField.parseErrors

router

Commit	Description
	Add strict typing on 'getResolvedTitleForRoute'
	skip scroll-to-top on initial navigation when hydrating

Breaking Changes

router

• The return type for TitleStrategy.getResolvedTitleForRoute
  was previously 'any' while the actual return type could only be either string
  or undefined. The return type now reflects the possible values correctly.
  Code that reads the value may need to be adjusted.

  (cherry picked from commit ad37f52)

compiler

Commit	Description
	strip namespaced SVG script elements during template compilation

core

Commit	Description
	do not insert todo when migrating void @output
	makes resource URL sanitizer lookup case-insensitive
	reject script element as a dynamic component host
	visit ICU expressions in signal migration schematics

router

Commit	Description
	skip scroll-to-top on initial navigation when hydrating

compiler

Commit	Description
	enforce parentheses containing arguments for :host-context
	preserve leading commas in animation definitions
	remove dedicated support for legacy shadow DOM selectors
	remove deprecated shadow CSS encapsulation polyfills
	simplify handling of colon host with a selector list
	type check invalid for loops

platform-server

Commit	Description
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally (#68469)
	validate security-sensitive attributes in i18n bindings (#68469)

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication
	ensure origin has a trailing slash when parsing url (#68469)

core

Commit	Description
	allow service with factory on abstract classes
	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Description
	remove compiler import from safe optional chaining migration

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication

compiler

Commit	Description
	invalid type checking code if field name needs to be quoted

compiler-cli

Commit	Description
	add support for Node.js 26.0.0
	support external TCBs with copied content in specific mode

core

Commit	Description
	add provideWebMcpTools
	add ability to cache resources for SSR
	export experimental declareWebMcpTool support
	allow explicit read generic with signal input transforms
	enforce return type for service factory
	i18n flags leaking on errors
	mark service decorator as stable
	respect ngSkipHydration on components with projectable nodes in LContainers
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	graduate signal forms APIs to public API
	Add support for range type with outside of native bounds
	ensure debounced async validators produce pending status during debounce
	fix orphan field error on blur during array removal
	implement custom control reset propagation
	prevent orphan field crashes in debounceSync and async validation
	prohibit concurrent submits in signal forms
	synchronize controls with the model on reset
	optimize reactivity by using shallow array equality
	shortcut deepSignal writes if value is unchanged
	remove string support from min and max validation rules (#68001)

http

Commit	Description
	Add reportUploadProgress & reportDownloadProgress options

language-service

Commit	Description
	Add support for @Input with transforms

router

Commit	Description
	add unmatchedInputBehavior option to componentInputBinding

Breaking Changes

forms

• min and max validation rules no longer support
  string values. Bound values must be numbers or null.

Deprecations

http

• The reportProgress option is deprecated please use reportUploadProgress & reportDownloadProgress instead.

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally (#68468)
	validate security-sensitive attributes in i18n bindings (#68468)

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url (#68468)