Angular 15 Release Notes

Angular

v15.2.21 - July 8, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@15.2.10-angular-15.2.21
- @neverendingsupport/angular-bazel@15.2.10-angular-15.2.21
- @neverendingsupport/angular-common@15.2.10-angular-15.2.21
- @neverendingsupport/angular-compiler@15.2.10-angular-15.2.21
- @neverendingsupport/angular-compiler-cli@15.2.10-angular-15.2.21
- @neverendingsupport/angular-core@15.2.10-angular-15.2.21
- @neverendingsupport/angular-elements@15.2.10-angular-15.2.21
- @neverendingsupport/angular-forms@15.2.10-angular-15.2.21
- @neverendingsupport/angular-language-service@15.2.10-angular-15.2.21
- @neverendingsupport/angular-localize@15.2.10-angular-15.2.21
- @neverendingsupport/angular-platform-browser@15.2.10-angular-15.2.21
- @neverendingsupport/angular-platform-browser-dynamic@15.2.10-angular-15.2.21
- @neverendingsupport/angular-platform-server@15.2.10-angular-15.2.21
- @neverendingsupport/angular-router@15.2.10-angular-15.2.21
- @neverendingsupport/angular-service-worker@15.2.10-angular-15.2.21
- @neverendingsupport/angular-upgrade@15.2.10-angular-15.2.21

Security Fixes

platform-server: Reject untrusted request URLs that bypass the allowedHosts allowlist.
- This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-50168).
service-worker:
- Preserve redirect policy on reconstructed asset requests.
  - This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50169).
- Preserve explicit credentials: 'omit' and HTTP cache mode in asset group requests.
  - This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).
- Strip sensitive headers on cross-origin redirects.
  - This fixes a high-severity Information Exposure vulnerability (CVE-2026-54264).

v15.2.20 - June 18, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@15.2.10-angular-15.2.20
- @neverendingsupport/angular-bazel@15.2.10-angular-15.2.20
- @neverendingsupport/angular-common@15.2.10-angular-15.2.20
- @neverendingsupport/angular-compiler@15.2.10-angular-15.2.20
- @neverendingsupport/angular-compiler-cli@15.2.10-angular-15.2.20
- @neverendingsupport/angular-core@15.2.10-angular-15.2.20
- @neverendingsupport/angular-elements@15.2.10-angular-15.2.20
- @neverendingsupport/angular-forms@15.2.10-angular-15.2.20
- @neverendingsupport/angular-language-service@15.2.10-angular-15.2.20
- @neverendingsupport/angular-localize@15.2.10-angular-15.2.20
- @neverendingsupport/angular-platform-browser@15.2.10-angular-15.2.20
- @neverendingsupport/angular-platform-browser-dynamic@15.2.10-angular-15.2.20
- @neverendingsupport/angular-platform-server@15.2.10-angular-15.2.20
- @neverendingsupport/angular-router@15.2.10-angular-15.2.20
- @neverendingsupport/angular-service-worker@15.2.10-angular-15.2.20
- @neverendingsupport/angular-upgrade@15.2.10-angular-15.2.20

Security Fixes

core:
- Validate security-sensitive attributes in i18n bindings.
- Disallow event attribute bindings in host bindings unconditionally.
platform-server: Add allowedHosts option to renderModule and renderApplication.
- This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-46417).

Breaking Changes

platform-server

Add allowedHosts option to renderModule and renderApplication:
When url is an absolute URL, its hostname is now validated against the new allowedHosts option, mitigating Server-Side Request Forgery (SSRF) and Host Header Injection attacks. Because allowedHosts defaults to an empty allow-list, any absolute URL now throws at bootstrap unless allowedHosts is configured. Relative URLs (e.g. /path) are unaffected.
To pass validation, configure allowedHosts with the hostnames you serve (exact hostnames, *.example.com wildcards, or * to allow all).

v15.2.19 - March 10, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@15.2.10-angular-15.2.19
- @neverendingsupport/angular-bazel@15.2.10-angular-15.2.19
- @neverendingsupport/angular-common@15.2.10-angular-15.2.19
- @neverendingsupport/angular-compiler@15.2.10-angular-15.2.19
- @neverendingsupport/angular-compiler-cli@15.2.10-angular-15.2.19
- @neverendingsupport/angular-core@15.2.10-angular-15.2.19
- @neverendingsupport/angular-elements@15.2.10-angular-15.2.19
- @neverendingsupport/angular-forms@15.2.10-angular-15.2.19
- @neverendingsupport/angular-language-service@15.2.10-angular-15.2.19
- @neverendingsupport/angular-localize@15.2.10-angular-15.2.19
- @neverendingsupport/angular-platform-browser@15.2.10-angular-15.2.19
- @neverendingsupport/angular-platform-browser-dynamic@15.2.10-angular-15.2.19
- @neverendingsupport/angular-platform-server@15.2.10-angular-15.2.19
- @neverendingsupport/angular-router@15.2.10-angular-15.2.19
- @neverendingsupport/angular-service-worker@15.2.10-angular-15.2.19
- @neverendingsupport/angular-upgrade@15.2.10-angular-15.2.19

Security Fixes

core: Block creation of sensitive URI attributes from ICU messages.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-27970).

Breaking Changes

core

Block creation of sensitive URI attributes from ICU messages:
Translators can no longer introduce URI attributes—attribute values are blocked to avoid malicious links, and sanitization now relies on an allowlist of known attributes (still sanitizing URI ones). Translated ICU content keeps only recognized attributes and drops everything else.

v15.2.18 - January 22, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@15.2.10-angular-15.2.18
- @neverendingsupport/angular-bazel@15.2.10-angular-15.2.18
- @neverendingsupport/angular-common@15.2.10-angular-15.2.18
- @neverendingsupport/angular-compiler@15.2.10-angular-15.2.18
- @neverendingsupport/angular-compiler-cli@15.2.10-angular-15.2.18
- @neverendingsupport/angular-core@15.2.10-angular-15.2.18
- @neverendingsupport/angular-elements@15.2.10-angular-15.2.18
- @neverendingsupport/angular-forms@15.2.10-angular-15.2.18
- @neverendingsupport/angular-language-service@15.2.10-angular-15.2.18
- @neverendingsupport/angular-localize@15.2.10-angular-15.2.18
- @neverendingsupport/angular-platform-browser@15.2.10-angular-15.2.18
- @neverendingsupport/angular-platform-browser-dynamic@15.2.10-angular-15.2.18
- @neverendingsupport/angular-platform-server@15.2.10-angular-15.2.18
- @neverendingsupport/angular-router@15.2.10-angular-15.2.18
- @neverendingsupport/angular-service-worker@15.2.10-angular-15.2.18
- @neverendingsupport/angular-upgrade@15.2.10-angular-15.2.18

Security Fixes

core: Sanitize sensitive attributes on SVG script elements.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).

v15.2.17 - December 15, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@15.2.10-angular-15.2.17
- @neverendingsupport/angular-bazel@15.2.10-angular-15.2.17
- @neverendingsupport/angular-common@15.2.10-angular-15.2.17
- @neverendingsupport/angular-compiler@15.2.10-angular-15.2.17
- @neverendingsupport/angular-compiler-cli@15.2.10-angular-15.2.17
- @neverendingsupport/angular-core@15.2.10-angular-15.2.17
- @neverendingsupport/angular-elements@15.2.10-angular-15.2.17
- @neverendingsupport/angular-forms@15.2.10-angular-15.2.17
- @neverendingsupport/angular-language-service@15.2.10-angular-15.2.17
- @neverendingsupport/angular-localize@15.2.10-angular-15.2.17
- @neverendingsupport/angular-platform-browser@15.2.10-angular-15.2.17
- @neverendingsupport/angular-platform-browser-dynamic@15.2.10-angular-15.2.17
- @neverendingsupport/angular-platform-server@15.2.10-angular-15.2.17
- @neverendingsupport/angular-router@15.2.10-angular-15.2.17
- @neverendingsupport/angular-service-worker@15.2.10-angular-15.2.17
- @neverendingsupport/angular-upgrade@15.2.10-angular-15.2.17

Security Fixes

compiler: Prevent stored XSS via SVG animation attributeName and MathML/SVG URLs.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).

v15.2.16 - December 3, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@15.2.10-angular-15.2.16
- @neverendingsupport/angular-bazel@15.2.10-angular-15.2.16
- @neverendingsupport/angular-common@15.2.10-angular-15.2.16
- @neverendingsupport/angular-compiler@15.2.10-angular-15.2.16
- @neverendingsupport/angular-compiler-cli@15.2.10-angular-15.2.16
- @neverendingsupport/angular-core@15.2.10-angular-15.2.16
- @neverendingsupport/angular-elements@15.2.10-angular-15.2.16
- @neverendingsupport/angular-forms@15.2.10-angular-15.2.16
- @neverendingsupport/angular-language-service@15.2.10-angular-15.2.16
- @neverendingsupport/angular-localize@15.2.10-angular-15.2.16
- @neverendingsupport/angular-platform-browser@15.2.10-angular-15.2.16
- @neverendingsupport/angular-platform-browser-dynamic@15.2.10-angular-15.2.16
- @neverendingsupport/angular-platform-server@15.2.10-angular-15.2.16
- @neverendingsupport/angular-router@15.2.10-angular-15.2.16
- @neverendingsupport/angular-service-worker@15.2.10-angular-15.2.16
- @neverendingsupport/angular-upgrade@15.2.10-angular-15.2.16

Security Fixes

common: Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).
core: Introduce BootstrapContext for improved server bootstrapping.
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-59052).

Breaking Changes

core

Introduce BootstrapContext for improved server bootstrapping:
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector and avoid potential exposure of sensitive data from other sessions.
In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively, when running in a server environment.
Before:
const bootstrap = () => bootstrapApplication(AppComponent, config);
After:
const bootstrap = (context: BootstrapContext) => bootstrapApplication(AppComponent, config, context);

v15.2.15 - June 11, 2025

Notes

This release contains no functional changes from NES v15.2.14.
This release implements a new package naming scheme for the Angular packages. More information about the change can be found in the NES Decoupled Namespace Specification.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@15.2.10-angular-15.2.15
- @neverendingsupport/angular-bazel@15.2.10-angular-15.2.15
- @neverendingsupport/angular-common@15.2.10-angular-15.2.15
- @neverendingsupport/angular-compiler@15.2.10-angular-15.2.15
- @neverendingsupport/angular-compiler-cli@15.2.10-angular-15.2.15
- @neverendingsupport/angular-core@15.2.10-angular-15.2.15
- @neverendingsupport/angular-elements@15.2.10-angular-15.2.15
- @neverendingsupport/angular-forms@15.2.10-angular-15.2.15
- @neverendingsupport/angular-language-service@15.2.10-angular-15.2.15
- @neverendingsupport/angular-localize@15.2.10-angular-15.2.15
- @neverendingsupport/angular-platform-browser@15.2.10-angular-15.2.15
- @neverendingsupport/angular-platform-browser-dynamic@15.2.10-angular-15.2.15
- @neverendingsupport/angular-platform-server@15.2.10-angular-15.2.15
- @neverendingsupport/angular-router@15.2.10-angular-15.2.15
- @neverendingsupport/angular-service-worker@15.2.10-angular-15.2.15
- @neverendingsupport/angular-upgrade@15.2.10-angular-15.2.15

v15.2.14 - February 6, 2025

Notes

This release contains no functional changes from NES v15.2.13.
This release contains only metadata fixes and improvements: Updated licensing information.
Full Version: 15.2.10-{PACKAGE_NAME}-15.2.14

v15.2.13 - January 31, 2025

Notes

This release contains no functional changes from NES v15.2.12.
This release contains only metadata fixes and improvements: Updated package.json files.
Full Version: 15.2.10-{PACKAGE_NAME}-15.2.13

v15.2.12 - January 31, 2025

Notes

This release contains no functional changes from NES v15.2.11.
This release contains only metadata fixes and improvements: Updated peer dependency versions.
Full Version: 15.2.10-{PACKAGE_NAME}-15.2.12

v15.2.11 - January 31, 2025

Notes

This release contains no functional change from the OSS Angular v15.2.10.
This release mainlines OSS v15.2.10 into NES v15.2.11.
Full Version: 15.2.11-{PACKAGE_NAME}

Angular CLI

15.2.14 (NES) - September, 2025

Notes

Full package names and versions:
- @neverendingsupport/angular-cli@15.2.11-angular-cli-15.2.14
- @neverendingsupport/angular-create@15.2.11-angular-cli-15.2.14
- @neverendingsupport/angular-pwa@15.2.11-angular-cli-15.2.14
- @neverendingsupport/angular-devkit-architect@0.1502.11-angular-cli-15.2.14
- @neverendingsupport/angular-devkit-architect-cli@0.1502.11-angular-cli-15.2.14
- @neverendingsupport/angular-devkit-build-angular@15.2.11-angular-cli-15.2.14
- @neverendingsupport/angular-devkit-build-webpack@0.1502.11-angular-cli-15.2.14
- @neverendingsupport/angular-devkit-core@15.2.11-angular-cli-15.2.14
- @neverendingsupport/angular-devkit-schematics@15.2.11-angular-cli-15.2.14
- @neverendingsupport/angular-devkit-schematics-cli@15.2.11-angular-cli-15.2.14
- @neverendingsupport/ngtools-webpack@15.2.11-angular-cli-15.2.14

Bug Fixes

Fixed build issues: updated peer dependency version numbers

15.2.13 (NES) - June 5, 2025

Notes

This release contains no functional changes from NES v15.2.12.
Full package names and versions:
- @neverendingsupport/angular-cli@15.2.11-angular-cli-15.2.13
- @neverendingsupport/angular-create@15.2.11-angular-cli-15.2.13
- @neverendingsupport/angular-pwa@15.2.11-angular-cli-15.2.13
- @neverendingsupport/angular-devkit-architect@0.1502.11-angular-cli-15.2.13
- @neverendingsupport/angular-devkit-architect-cli@0.1502.11-angular-cli-15.2.13
- @neverendingsupport/angular-devkit-build-angular@15.2.11-angular-cli-15.2.13
- @neverendingsupport/angular-devkit-build-webpack@0.1502.11-angular-cli-15.2.13
- @neverendingsupport/angular-devkit-core@15.2.11-angular-cli-15.2.13
- @neverendingsupport/angular-devkit-schematics@15.2.11-angular-cli-15.2.13
- @neverendingsupport/angular-devkit-schematics-cli@15.2.11-angular-cli-15.2.13
- @neverendingsupport/ngtools-webpack@15.2.11-angular-cli-15.2.13

15.2.12 (NES) - February 25, 2025

Notes

This is the initial release of the NES Angular CLI 15.2.x series.