fix(deps): update dependency @angular/common to v22 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/common (source)	21.2.19 → 22.0.2

---

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

CVE-2026-68945 / GHSA-jhpw-976m-542j

More information

Details

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.

During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:

new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')

Both requests previously serialized as role=user,admin, allowing distinct HttpClient requests to produce the same transfer-cache key material.

Impact

In an SSR application, this cache-key ambiguity can make a later security-sensitive HttpClient request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to:

• State Poisoning: Using incorrect or attacker-influenced cached responses for subsequent application logic.
• Cross-Request Response Reuse: Reusing cached responses across requests with semantically different parameters.

Patched Versions

• 22.0.2
• 21.2.19
• 20.3.27

Workarounds

If you cannot upgrade immediately, configure your HttpClient requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used:

this.http.get('/api/resource', {
  transferCache: false
});

Alternatively, disable the HTTP transfer cache globally in your application bootstrap config:

import { provideClientHydration, withNoHttpTransferCache } from '@angular/platform-browser';

export const appConfig = {
  providers: [
    provideClientHydration(
      withNoHttpTransferCache()
    )
  ]
};

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j
• https://github.com/angular/angular/pull/68571
• https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c
• https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35
• https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b
• https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c
• https://github.com/advisories/GHSA-jhpw-976m-542j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/common)

v22.0.2

Compare Source

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#​69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#​69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

v22.0.1

Compare Source

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.
  (cherry picked from commit 8446e46)

common

Commit	Type	Description
c4b5fa3c92	fix	escape CSS string-terminating characters in escapeCssUrl
dfff57ede9	fix	Limits date format string length
3c2892c8df	fix	prevent prototype pollution in formatDateTime
1d87c49f6e	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
1ee224ca30	fix	disallow i18n event attributes
a56f1cdf8f	fix	more robust logic to check if regex can be optimized
5946c18275	fix	sanitize href/xlink:href attributes of any element of the MathML namespace
393b84caf8	fix	sanitize two-way properties

compiler-cli

Commit	Type	Description
3d9ca2f173	fix	bind switch exhaustive check expressions

core

Commit	Type	Description
669146b0e7	fix	disable WebMCP during SSR
562a566ead	fix	Handle synchronous errors in PendingTasks.run function
fa546f382d	fix	harden TransferState restoration against DOM clobbering
29fdb98684	fix	prevent dangling prevConsumer reference from leaking destroyed views (#​68681)
cdcea80327	fix	require WebMCP tool descriptions
4289c4c840	fix	update comment for Default change detection
3dd433b39a	fix	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
045bb736b3	fix	validate lowercase SVG animation attribute names

forms

Commit	Type	Description
11836a670a	fix	delay mcp reading the form model by a tick
85d2d100e3	fix	harden FormGroup control lookups against prototype shadowing
e51ad374ea	fix	remove animationstart listener on component destroy to prevent memory leak
55b7b5a6b6	fix	set additionalProperties: false on generated WebMCP form

http

Commit	Type	Description
ffb06c0514	fix	ensure query parameters are inserted before URL fragments
2dd65d21e6	fix	pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
4254eb416c	fix	preserve empty referrer option in HttpRequest
167bd4c162	fix	Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit	Type	Description
43a0e28729	fix	prevent external template inlay hints from appearing in TS files

platform-server

Commit	Type	Description
ed48ca7f51	fix	harden platform location origin validation during SSR
1881ede3a7	refactor	deprecate ServerXhr

router

Commit	Type	Description
43edc8410f	fix	use native URL object for navigation boundary and comparison

service-worker

Commit	Type	Description
cf97b1f828	fix	Strips sensitive headers on cross-origin redirects

v22.0.0

Compare Source

Blog post "Announcing Angular v22".

Breaking Changes

compiler

• This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
  You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
• data prefixed attribute no-longer bind inputs nor outputs.
• The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
• in variables will throw in template expressions.

compiler-cli

• Elements with multiple matching selectors will now throw at compile time.

core

• The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
• • TypeScript versions older than 6.0 are no longer supported.
• Leave animations are no longer limited to the element being removed.
• Component with undefined changeDetection property are now OnPush by default. Specify changeDetection: ChangeDetectionStrategy.Eager to keep the previous behavior.
• change AnimationCallbackEvent.animationComplete signature
• ChangeDetectorRef.checkNoChanges was removed. In tests use fixture.detectChanges() instead.
• createNgModuleRef was removed, use createNgModule instead
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

forms

• min and max validation rules no longer support
  string values. Bound values must be numbers or null.

http

• Use the HttpXhrBackend with provideHttpClient(withXhr) if you want to keep supporting upload progress reports.

platform-browser

• This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.
• Hammer.js integration has been removed. Use your own implementation.

router

• The return type for TitleStrategy.getResolvedTitleForRoute
  was previously 'any' while the actual return type could only be either string
  or undefined. The return type now reflects the possible values correctly.
  Code that reads the value may need to be adjusted.

  (cherry picked from commit ad37f52)

• The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

• paramsInheritanceStrategy now defaults to 'always'

  The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.

• provideRoutes() has been removed. Use provideRouter() or ROUTES as multi token if necessary.

upgrade

• Deprecated getAngularLib/setAngularLib have been removed use getAngularJSGlobal/setAngularJSGlobal instead.

Deprecations

http

• withFetch is now deprecated, it can be safely removed.
• The reportProgress option is deprecated please use reportUploadProgress & reportDownloadProgress instead.

compiler

Commit	Type	Description
47fcbc4704	feat	allow safe navigation to correctly narrow down nullables
2896c93cc1	feat	Angular expressions with optional chaining returns undefined
e850643b1b	feat	Support comments in html element.
96be4f429b	fix	abstract emitter producing incorrect code for dynamic imports
488d962bc7	fix	Don't bind inputs/outputs for data- attributes
2c5aabb9da	fix	don't escape dollar sign in literal expression
c7aef8ec5d	fix	enforce parentheses containing arguments for :host-context
b225a5d902	fix	invalid type checking code if field name needs to be quoted
ab9154ab75	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#​68868)
8a1533c9ad	fix	preserve leading commas in animation definitions
194f723f66	fix	remove dedicated support for legacy shadow DOM selectors
4c25a42e98	fix	remove deprecated shadow CSS encapsulation polyfills
6ff620a033	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#​68868)
7dc1017e51	fix	simplify handling of colon host with a selector list
d99ab0e040	fix	stop generating unused field
03db2aefaa	fix	throw on duplicate input/outputs
786ef8261f	fix	throw on invalid in expressions
ccb7d427e4	fix	type check invalid for loops

compiler-cli

Commit	Type	Description
b8d3f36ed9	feat	add support for Node.js 26.0.0
7f9450219f	feat	Adds warning for prefetch without main defer trigger
2eae497a04	feat	support external TCBs with copied content in specific mode
e5f96c2d88	fix	animation events not type checked properly when bound through HostListener decorator
9218140348	fix	resolve TCB mapping failure for safe property reads with as any
7a0d6b8df2	fix	transform dropping exclamationToken from properties
ca67828ee2	refactor	introduce NG8023 compile-time diagnostic for duplicate selectors

core

Commit	Type	Description
17d3ea44e2	feat	add IdleRequestOptions support to IdleService
3b0ae5fef0	feat	add provideWebMcpTools
444b024d49	feat	Add a injectAsync helper function
3bc095d508	feat	Add a schematics to migrate provideHttpClient to keep using the HttpXhrBackend implementation.
5a7c1e62dc	feat	add ability to cache resources for SSR
cb4cb77053	feat	Add migration to add ChangeDetectionStrategy.Eager where applicable
2206efa55f	feat	add special return statuses for resource params
246a984a5d	feat	add TestBed.getFixture
b918beda32	feat	allow debouncing signals
8bc31a515f	feat	Allow other expression for exhaustive typechecking
4e331062e8	feat	allow synchronous values for stream Resources
a0aa8304cd	feat	bootstrap via ApplicationRef with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
2f5ab541ea	feat	enhance profiling with documentation URLs
ef1810197b	feat	export experimental declareWebMcpTool support
75f2cb8f56	feat	implement Angular DI graph in-page AI tool
8f3d0b9d97	feat	introduce @Service decorator
df659b8d0c	feat	re-introduce nested leave animations scoped to component boundaries
8ce9cc4f6b	feat	register AI runtime debugging tools
eae8f7e30b	feat	Set default Component changeDetection strategy to OnPush
cdda51a3b2	feat	support bootstrapping Angular applications underneath shadow roots
a5981b83a6	feat	support customization of @​defer's on idle behavior
98eb24cea0	feat	Support optional timeout for idle deferred triggers
dc3131c639	feat	TestBed.getFixture -> TestBed.getLastFixture and update implementation
9f479ae964	feat	Update Testability to use PendingTasks for stability indicator
8ebae1de33	fix	allow service with factory on abstract classes
f9d8da6924	fix	bind global context to idle callback shims in @​defer's idle service
61a48e99aa	fix	do not register dom triggers when defer blocks are in manual mode
49748b5c79	fix	enforce return type for service factory
16adbbf423	fix	ensure custom controls resolve transitive host directives
50e599e73e	fix	lazy-initialize debounced state to prevent computation cycle
7aad302c3e	fix	mark service decorator as stable
a08e4fb93c	fix	normalize tag names in runtime i18n attribute security context lookup (#​68868)
b20f0fe078	fix	prevent rxResource from leaking a subscription
22f8b0a500	fix	resolver function not matching expected type
88d138ccc8	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation
bfe6f6c2a5	fix	synchronize core sanitization schema with compiler
5e99ae9f00	fix	widen type for directive inputs/outputs
b9b5c279b4	refactor	enhance AnimationCallbackEvent.animationComplete signature
69fb1614ef	refactor	remove checkNoChanges from the public API.
36936872c9	refactor	remove createNgModuleRef
9d76ac8229	refactor	remove ComponentFactoryResolver & ComponentFactory from the api surface
b1f5181ffd	refactor	remove ComponentFactoryResolver & ComponentFactory from the api surface""

forms

Commit	Type	Description
74f76d8075	feat	add reloadValidation to Signal Forms to manually trigger async validation
24e52d450d	feat	add debounce option to validateAsync and validateHttp
709f5a390c	feat	add FieldState.getError()
7745365910	feat	graduate signal forms APIs to public API
f9f24fc669	feat	shim legacy NG_VALIDATORS into parseErrors for CVA mode (#​67943)
41b1410cb8	feat	support binding `number	nullto`
3983080236	feat	support ngNoCva as an opt-out for ControlValueAccessors
c4ce3f345f	feat	template & reactive support for FVC
3524de29f3	fix	Add support for range type with outside of native bounds
de56d74da3	fix	align FormField CVA selection priority with standard forms
0eeb1b5f03	fix	allow FormRoot to be used without submission options (#​67727)
394ad0c2a2	fix	allow late-bound input types for signals forms
ee8d2098cb	fix	change FieldState optional properties to non-optional	undefined
df8b020299	fix	clear native date inputs correctly in signal forms when changed via native UI
2e9aeea0fe	fix	deduplicate writeValue calls in CVA interop
0ea50ffe5a	fix	ensure debounced async validators produce pending status during debounce
3c44d7c90b	fix	fix orphan field error on blur during array removal
849dba6c65	fix	implement custom control reset propagation
5835a5e3a7	fix	prevent orphan field crashes in debounceSync and async validation
3e7ce0dafc	fix	restrict SignalFormsConfig to a readonly API
fb166772d2	fix	split the touched model into an input and touch output
83032e3605	fix	support generic unions in signal form schemas
68c3abbe09	fix	synchronize controls with the model on reset
2061fd8253	fix	Untrack setValue in reactive forms
72d3ace03c	fix	use controlValue in NgControl for CVA interop (#​67943)
3b4ef1e2ff	perf	avoid redundant invalidations in parser errors signal
07a9358157	perf	avoid spurious recomputation in FormField.parseErrors
98c5afdb02	perf	lazily instantiate signal form fields
e0536091f5	perf	optimize reactivity by using shallow array equality
9b9769479b	perf	shortcut deepSignal writes if value is unchanged
592a12d6c9	refactor	remove string support from min and max validation rules (#​68001)

http

Commit	Type	Description
5c432fb8bb	feat	Use FetchBackend as default for the HttpBackend implementation
f7b3ed8db2	fix	Introduce a max buffer size for fetch requests on SSR
e6cfaf5672	fix	prevent httpResource from leaking a subscription
7c8c3347ef	refactor	Add reportUploadProgress & reportDownloadProgress options

language-service

Commit	Type	Description
5a6d88626b	feat	add angular template inlay hints support
cfd0f9950c	feat	add Document Symbols support for Angular templates
c6f98c723c	feat	Add support for idle timeout in defer blocks
dc9c72da9b	fix	Add support for @Input with transforms

migrations

Commit	Type	Description
8216d34976	feat	Add migration for CanMatchFn snapshot parameter (#​67452)
682aaf943f	feat	add strictTemplates to tsconfig during ng update
6a435658e2	feat	Disabling nullishCoalescingNotNullable & optionalChainNotNullable on ng update
8f8972b0fd	feat	model + output migrations
f01901d766	fix	avoid generating invalid code in ChangeDetectionStrategy.Eager migration
1415d86980	fix	Fix typo for strict-template migration
9d9855a415	fix	Make the safe optional chaining idempotent
0f2160c410	fix	remove compiler import from safe optional chaining migration

platform-browser

Commit	Type	Description
68628dd45b	feat	make incremental hydration default behavior
d45b7a91f9	fix	remove unused styles when associated host is dropped
f99e7ed20f	refactor	remove Hammer integration

router

| Commit | Type | Description |
| ---------

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.