core

Commit	Description
	allow service with factory on abstract classes
	disallow event attribute bindings in host bindings unconditionally

migrations

Commit	Description
	remove compiler import from safe optional chaining migration

platform-server

Commit	Description
	add allowedHosts option to renderModule and renderApplication

compiler

Commit	Description
	invalid type checking code if field name needs to be quoted

compiler-cli

Commit	Description
	add support for Node.js 26.0.0
	support external TCBs with copied content in specific mode

core

Commit	Description
	add provideWebMcpTools
	add ability to cache resources for SSR
	export experimental declareWebMcpTool support
	allow explicit read generic with signal input transforms
	enforce return type for service factory
	i18n flags leaking on errors
	mark service decorator as stable
	respect ngSkipHydration on components with projectable nodes in LContainers
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	graduate signal forms APIs to public API
	Add support for range type with outside of native bounds
	ensure debounced async validators produce pending status during debounce
	fix orphan field error on blur during array removal
	implement custom control reset propagation
	prevent orphan field crashes in debounceSync and async validation
	prohibit concurrent submits in signal forms
	synchronize controls with the model on reset
	optimize reactivity by using shallow array equality
	shortcut deepSignal writes if value is unchanged
	remove string support from min and max validation rules (#68001)

http

Commit	Description
	Add reportUploadProgress & reportDownloadProgress options

language-service

Commit	Description
	Add support for @Input with transforms

router

Commit	Description
	add unmatchedInputBehavior option to componentInputBinding

Breaking Changes

forms

• min and max validation rules no longer support
  string values. Bound values must be numbers or null.

Deprecations

http

• The reportProgress option is deprecated please use reportUploadProgress & reportDownloadProgress instead.

core

Commit	Description
	allow explicit read generic with signal input transforms
	i18n flags leaking on errors
	respect ngSkipHydration on components with projectable nodes in LContainers
	sanitizer typings
	validate security-sensitive attributes in i18n bindings
	visit ng-let expression value in signal migration schematics

forms

Commit	Description
	prohibit concurrent submits in signal forms

core

Commit	Description
	disallow event attribute bindings in host bindings unconditionally (#68468)
	validate security-sensitive attributes in i18n bindings (#68468)

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url (#68468)

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	Angular expressions with optional chaining returns undefined
	let declaration span not including end character

core

Commit	Description
	Add a injectAsync helper function
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

migrations

Commit	Description
	model + output migrations

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

common

Commit	Description
	prevent focus from scrollToAnchor

compiler

Commit	Description
	let declaration span not including end character

core

Commit	Description
	fix ordering of view queries metadata in JIT mode
	guard against non-object events and avoid listener wrapper identity mismatch
	prevent event replay double-invocation when element hydrates before app stability

platform-server

Commit	Description
	ensure origin has a trailing slash when parsing url

core

Commit	Description
	introduce @Service decorator
	Update Testability to use PendingTasks for stability indicator

docs

Commit	Description
	link formatting in "Animating your Application with CSS"

migrations

Commit	Description
	fix NgClass leaving trailing comma after removal

router

Commit	Description
	restore internal URL on popstate when browserUrl is used
	set default paramsInheritanceStrategy to 'always'

Breaking Changes

router

• paramsInheritanceStrategy now defaults to 'always'

  The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.

docs

Commit	Description
	link formatting in "Animating your Application with CSS"

migrations

Commit	Description
	fix NgClass leaving trailing comma after removal

router

Commit	Description
	restore internal URL on popstate when browserUrl is used

compiler

Commit	Description
	allow safe navigation to correctly narrow down nullables
	don't escape dollar sign in literal expression

compiler-cli

Commit	Description
	animation events not type checked properly when bound through HostListener decorator

core

Commit	Description
	allow synchronous values for stream Resources
	enhance profiling with documentation URLs
	implement Angular DI graph in-page AI tool
	register AI runtime debugging tools
	support bootstrapping Angular applications underneath shadow roots
	escape forward slashes in transfer state to prevent crawler indexing

forms

Commit	Description
	shim legacy NG_VALIDATORS into parseErrors for CVA mode (#67943)
	use controlValue in NgControl for CVA interop (#67943)

http

Commit	Description
	add CSP nonce support to JsonpClientBackend
	Don't on Passthru outside of reactive context

migrations

Commit	Description
	Disabling nullishCoalescingNotNullable & optionalChainNotNullable on ng update
	Fix typo for strict-template migration

platform-browser

Commit	Description
	make incremental hydration default behavior

platform-server

Commit	Description
	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Description
	normalize multiple leading slashes in URL parser

service-worker

Commit	Description
	resolve TS 6.0 compatibility for messageerror listener

Breaking Changes

compiler

• This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
  You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

core

Commit	Description
	escape forward slashes in transfer state to prevent crawler indexing

http

Commit	Description
	add CSP nonce support to JsonpClientBackend
	Don't on Passthru outside of reactive context

platform-server

Commit	Description
	prevent SSRF bypasses via protocol-relative and backslash URLs

router

Commit	Description
	normalize multiple leading slashes in URL parser