HeroDevs
Visit Angular NES Home Page

Angular 13

Comprehensive release notes and changelog for Angular 13, including security patches, bug fixes, and feature updates across all supported versions.

7 Patched Vulnerabilities
VEX Statements

Angular

v13.4.11 - March 10, 2026

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-bazel@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-common@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-compiler@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-compiler-cli@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-core@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-elements@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-forms@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-language-service@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-localize@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-platform-browser@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-platform-browser-dynamic@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-platform-server@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-router@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-service-worker@13.4.0-angular-13.4.11
    • @neverendingsupport/angular-upgrade@13.4.0-angular-13.4.11

Security Fixes

  • core: Block creation of sensitive URI attributes from ICU messages.
    • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-27970).

Breaking Changes

core
  • Block creation of sensitive URI attributes from ICU messages:
    Translators can no longer introduce URI attributes—attribute values are blocked to avoid malicious links, and sanitization now relies on an allowlist of known attributes (still sanitizing URI ones). Translated ICU content keeps only recognized attributes and drops everything else.

v13.4.10 - February 24, 2026

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-bazel@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-common@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-compiler@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-compiler-cli@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-core@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-elements@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-forms@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-language-service@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-localize@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-platform-browser@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-platform-browser-dynamic@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-platform-server@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-router@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-service-worker@13.4.0-angular-13.4.10
    • @neverendingsupport/angular-upgrade@13.4.0-angular-13.4.10

Security Fixes

  • localize: replace glob for fast-glob.
    • This fixes a high-severity Regular expression Denial of Service (ReDoS) vulnerability (CVE-2026-26996) in minimatch.
    • This fixes a high-severity Regular expression Denial of Service (ReDoS) vulnerability (CVE-2026-27903) in minimatch.
    • This fixes a medium-severity Memory Leak vulnerability (SNYK-JS-INFLIGHT-6095116) in inflight.

v13.4.9 - January 29, 2026

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-bazel@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-common@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-compiler@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-compiler-cli@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-core@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-elements@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-forms@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-language-service@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-localize@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-platform-browser@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-platform-browser-dynamic@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-platform-server@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-router@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-service-worker@13.4.0-angular-13.4.9
    • @neverendingsupport/angular-upgrade@13.4.0-angular-13.4.9

Security Fixes

  • core: Sanitize sensitive attributes on SVG script elements.
    • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).

v13.4.8 - December 15, 2025

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-bazel@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-common@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-compiler@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-compiler-cli@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-core@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-elements@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-forms@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-language-service@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-localize@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-platform-browser@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-platform-browser-dynamic@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-platform-server@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-router@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-service-worker@13.4.0-angular-13.4.8
    • @neverendingsupport/angular-upgrade@13.4.0-angular-13.4.8

Security Fixes

  • compiler: Prevent stored XSS via SVG animation attributeName and MathML/SVG URLs.
    • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).

v13.4.7 - December 3, 2025

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-bazel@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-common@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-compiler@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-compiler-cli@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-core@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-elements@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-forms@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-language-service@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-localize@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-platform-browser@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-platform-browser-dynamic@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-platform-server@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-router@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-service-worker@13.4.0-angular-13.4.7
    • @neverendingsupport/angular-upgrade@13.4.0-angular-13.4.7

Security Fixes

  • common: Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
    • This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).

v13.4.6 - June 16, 2025

Notes

  • This release contains no functional changes from NES v13.4.5.
  • This release implements a new package naming scheme for the Angular packages. More information about the change can be found in the NES Decoupled Namespace Specification.
  • Full package name(s) and version(s):
    • @neverendingsupport/angular-animations@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-bazel@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-common@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-compiler@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-compiler-cli@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-core@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-elements@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-forms@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-language-service@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-localize@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-platform-browser@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-platform-browser-dynamic@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-platform-server@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-router@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-service-worker@13.4.0-angular-13.4.6
    • @neverendingsupport/angular-upgrade@13.4.0-angular-13.4.6

v13.4.5 - February 6, 2025

Notes

  • This release contains no functional changes from NES v13.4.4.
  • This release contains only metadata fixes and improvements: Updated licensing information.
  • Full Version: 13.4.0-{PACKAGE_NAME}-13.4.5

v13.4.4 - January 31, 2025

Notes

  • This release contains no functional changes from NES v13.4.3.
  • This release contains only metadata fixes and improvements: Updated package.json files.
  • Full Version: 13.4.0-{PACKAGE_NAME}-13.4.4

v13.4.3 - January 31, 2025

Notes

  • This release contains no functional changes from NES v13.4.2.
  • This release contains only metadata fixes and improvements: Updated peer dependency versions.
  • Full Version: 13.4.0-{PACKAGE_NAME}-13.4.3

v13.4.2 - January 31, 2025

Notes

  • This release contains no functional changes from NES v13.4.1.
  • This release contains only metadata fixes and improvements: Updated peer dependency versions.
  • Full Version: 13.4.2-{PACKAGE_NAME}

v13.4.1 - February 12, 2024

Notes

  • Full Version: 13.4.1-{PACKAGE_NAME}

Security Fixes

  • compiler: Do not unquote CSS values.
  • core: Set style property value to empty string instead of an invalid value.

Angular CLI

13.3.14 - September, 2025

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angular-cli@13.3.11-angular-cli-13.3.14
    • @neverendingsupport/angular-pwa@13.3.11-angular-cli-13.3.14
    • @neverendingsupport/angular-devkit-architect@0.1303.11-angular-cli-13.3.14
    • @neverendingsupport/angular-devkit-architect-cli@0.1303.11-angular-cli-13.3.14
    • @neverendingsupport/angular-devkit-build-angular@13.3.11-angular-cli-13.3.14
    • @neverendingsupport/angular-devkit-build-optimizer@0.1303.11-angular-cli-13.3.14
    • @neverendingsupport/angular-devkit-build-webpack@0.1303.11-angular-cli-13.3.14
    • @neverendingsupport/angular-devkit-core@13.3.11-angular-cli-13.3.14
    • @neverendingsupport/angular-devkit-schematics@13.3.11-angular-cli-13.3.14
    • @neverendingsupport/angular-devkit-schematics-cli@13.3.11-angular-cli-13.3.14
    • @neverendingsupport/ngtools-webpack@13.3.11-angular-cli-13.3.14

Bug Fixes

  • Fixed build issues: updated peer dependency version numbers.

13.3.13 - June 5, 2025

Notes

  • This release contains no functional changes from NES v13.3.12.
  • Full package name(s) and version(s):
    • @neverendingsupport/angular-cli@13.3.11-angular-cli-13.3.13
    • @neverendingsupport/angular-pwa@13.3.11-angular-cli-13.3.13
    • @neverendingsupport/angular-devkit-architect@0.1303.11-angular-cli-13.3.13
    • @neverendingsupport/angular-devkit-architect-cli@0.1303.11-angular-cli-13.3.13
    • @neverendingsupport/angular-devkit-build-angular@13.3.11-angular-cli-13.3.13
    • @neverendingsupport/angular-devkit-build-optimizer@0.1303.11-angular-cli-13.3.13
    • @neverendingsupport/angular-devkit-build-webpack@0.1303.11-angular-cli-13.3.13
    • @neverendingsupport/angular-devkit-core@13.3.11-angular-cli-13.3.13
    • @neverendingsupport/angular-devkit-schematics@13.3.11-angular-cli-13.3.13
    • @neverendingsupport/angular-devkit-schematics-cli@13.3.11-angular-cli-13.3.13
    • @neverendingsupport/ngtools-webpack@13.3.11-angular-cli-13.3.13

13.3.12 - February 25, 2025

Notes

  • This is the initial release of the NES Angular CLI 13.3.x series.