Angular 17

Comprehensive release notes and changelog for Angular 17, including security patches, bug fixes, and feature updates across all supported versions.

34 Patched Vulnerabilities

VEX Statements

Angular

v17.3.25 - August 20, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.25
- @neverendingsupport/angular-common@17.3.12-angular-17.3.25
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.25
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.25
- @neverendingsupport/angular-core@17.3.12-angular-17.3.25
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.25
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.25
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.25
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.25
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.25
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.25
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.25
- @neverendingsupport/angular-router@17.3.12-angular-17.3.25
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.25
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.25

Security Fixes

common:
- Skip transfer cache for uncacheable HTTP traffic.
- Prevent caching of responses with Set-Cookie headers.
- Skip TransferCache for cookie-bearing requests by default.
  - This fixes a high-severity Information Exposure vulnerability (CVE-2026-50170).
- Exclude withCredentials requests from transfer cache.
  - This fixes a high-severity Information Exposure vulnerability (CVE-2026-50170).
- Use cryptographically secure SHA-256 for transfer cache key generation.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-54266).
- Distinguish repeated transfer cache parameters.
  - This fixes a high-severity Cache Poisoning vulnerability (CVE-2026-68945).
compiler:
- Apply schema-derived sanitizer resolution to two-way property bindings.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-54265).
- Disallow i18n event attributes.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
- Restrict possible event handler check to property names longer than 2 characters.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
platform-server:
- Escape matching closing tags correctly when raw-text content contains astral characters.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50555).
- Escape <noscript> text content when serializing server-rendered output.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50556).
- Escape text in fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>) when serializing server-rendered output.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69149).

v17.3.24 - August 7, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.24
- @neverendingsupport/angular-common@17.3.12-angular-17.3.24
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.24
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.24
- @neverendingsupport/angular-core@17.3.12-angular-17.3.24
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.24
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.24
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.24
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.24
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.24
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.24
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.24
- @neverendingsupport/angular-router@17.3.12-angular-17.3.24
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.24
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.24

Security Fixes

common:
- Add upper bounds for digitsInfo to prevent roundNumber from allocating a large array.
  - This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-50171).
- Limit date format string length to 256 characters.
  - This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-54268).
compiler:
- Strip namespaced SVG script elements during template compilation.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
- Sanitize dynamic href and xlink:href bindings on SVG elements.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
- Normalize tag names with custom namespaces in DomElementSchemaRegistry.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
core:
- Support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation.
- Normalize tag names in runtime i18n attribute security context lookup.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
- Synchronize core sanitization schema with compiler.
- Reject script element as a dynamic component host.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).
- Validate lowercase SVG animation attribute names.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).
- Harden TransferState restoration against DOM clobbering.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-54267).

v17.3.23 - July 8, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.23
- @neverendingsupport/angular-common@17.3.12-angular-17.3.23
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.23
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.23
- @neverendingsupport/angular-core@17.3.12-angular-17.3.23
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.23
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.23
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.23
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.23
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.23
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.23
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.23
- @neverendingsupport/angular-router@17.3.12-angular-17.3.23
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.23
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.23

Security Fixes

platform-server:
- Reject untrusted request URLs that bypass the allowedHosts allowlist.
  - This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-50168).
service-worker:
- Preserve redirect policy on reconstructed asset requests.
  - This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50169).
- Preserve explicit credentials: 'omit' and HTTP cache mode in asset group requests.
  - This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).
- Strip sensitive headers on cross-origin redirects.
  - This fixes a high-severity Information Exposure vulnerability (CVE-2026-54264).

v17.3.22 - June 18, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.22
- @neverendingsupport/angular-common@17.3.12-angular-17.3.22
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.22
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.22
- @neverendingsupport/angular-core@17.3.12-angular-17.3.22
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.22
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.22
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.22
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.22
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.22
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.22
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.22
- @neverendingsupport/angular-router@17.3.12-angular-17.3.22
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.22
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.22

Security Fixes

core:
- Validate security-sensitive attributes in i18n bindings.
- Disallow event attribute bindings in host bindings unconditionally.
platform-server:
- Add allowedHosts option to renderModule and renderApplication.
  - This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-46417).

Breaking Changes

platform-server

Add allowedHosts option to renderModule and renderApplication:
When url is an absolute URL, its hostname is now validated against the new allowedHosts option, mitigating Server-Side Request Forgery (SSRF) and Host Header Injection attacks. Because allowedHosts defaults to an empty allow-list, any absolute URL now throws at bootstrap unless allowedHosts is configured. Relative URLs (e.g. /path) are unaffected.
To pass validation, configure allowedHosts with the hostnames you serve (exact hostnames, *.example.com wildcards, or * to allow all).

v17.3.21 - April 30, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.21
- @neverendingsupport/angular-common@17.3.12-angular-17.3.21
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.21
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.21
- @neverendingsupport/angular-core@17.3.12-angular-17.3.21
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.21
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.21
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.21
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.21
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.21
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.21
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.21
- @neverendingsupport/angular-router@17.3.12-angular-17.3.21
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.21
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.21

Security Fixes

platform-server:
- Prevent SSRF bypasses via protocol-relative and backslash URLs.
  - This fixes a high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-41423).

v17.3.20 - March 30, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.20
- @neverendingsupport/angular-common@17.3.12-angular-17.3.20
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.20
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.20
- @neverendingsupport/angular-core@17.3.12-angular-17.3.20
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.20
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.20
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.20
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.20
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.20
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.20
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.20
- @neverendingsupport/angular-router@17.3.12-angular-17.3.20
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.20
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.20

Security Fixes

core:
- Sanitize translated attribute bindings with interpolations.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-32635).
compiler:
- Disallow translations of src attributes in iframes.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-32635).

v17.3.19 - March 9, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.19
- @neverendingsupport/angular-common@17.3.12-angular-17.3.19
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.19
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.19
- @neverendingsupport/angular-core@17.3.12-angular-17.3.19
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.19
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.19
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.19
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.19
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.19
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.19
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.19
- @neverendingsupport/angular-router@17.3.12-angular-17.3.19
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.19
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.19

Security Fixes

core:
- Block creation of sensitive URI attributes from ICU messages.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-27970).

Breaking Changes

core

Block creation of sensitive URI attributes from ICU messages:
Translators can no longer introduce URI attributes—attribute values are blocked to avoid malicious links, and sanitization now relies on an allowlist of known attributes (still sanitizing URI ones). Translated ICU content keeps only recognized attributes and drops everything else.

v17.3.18 - January 8, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.18
- @neverendingsupport/angular-common@17.3.12-angular-17.3.18
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.18
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.18
- @neverendingsupport/angular-core@17.3.12-angular-17.3.18
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.18
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.18
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.18
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.18
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.18
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.18
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.18
- @neverendingsupport/angular-router@17.3.12-angular-17.3.18
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.18
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.18

Security Fixes

core:
- Sanitize sensitive attributes on SVG script elements.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).

v17.3.17 - December 11, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.17
- @neverendingsupport/angular-common@17.3.12-angular-17.3.17
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.17
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.17
- @neverendingsupport/angular-core@17.3.12-angular-17.3.17
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.17
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.17
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.17
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.17
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.17
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.17
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.17
- @neverendingsupport/angular-router@17.3.12-angular-17.3.17
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.17
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.17

Security Fixes

compiler:
- Prevent stored XSS via SVG animation attributeName and MathML/SVG URLs.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).

v17.3.16 - December 2, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.16
- @neverendingsupport/angular-common@17.3.12-angular-17.3.16
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.16
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.16
- @neverendingsupport/angular-core@17.3.12-angular-17.3.16
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.16
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.16
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.16
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.16
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.16
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.16
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.16
- @neverendingsupport/angular-router@17.3.12-angular-17.3.16
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.16
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.16

Security Fixes

common:
- Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
  - This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).

v17.3.15 - September 30, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.15
- @neverendingsupport/angular-common@17.3.12-angular-17.3.15
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.15
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.15
- @neverendingsupport/angular-core@17.3.12-angular-17.3.15
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.15
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.15
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.15
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.15
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.15
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.15
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.15
- @neverendingsupport/angular-router@17.3.12-angular-17.3.15
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.15
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.15

Security Fixes

core:
- Introduce BootstrapContext for improved server bootstrapping.
  - This fixes a high-severity Information Exposure vulnerability (CVE-2025-59052).

Breaking Changes

core

Introduce BootstrapContext for improved server bootstrapping:
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector and avoid potential exposure of sensitive data from other sessions.
In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively, when running in a server environment.
Before:
const bootstrap = () => bootstrapApplication(AppComponent, config);
After:
const bootstrap = (context: BootstrapContext) => bootstrapApplication(AppComponent, config, context);

v17.3.14 - June 16, 2025

Notes

This release contains no functional changes from NES v17.3.13.
This release contains only build-related fixes and improvements.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.14
- @neverendingsupport/angular-common@17.3.12-angular-17.3.14
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.14
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.14
- @neverendingsupport/angular-core@17.3.12-angular-17.3.14
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.14
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.14
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.14
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.14
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.14
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.14
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.14
- @neverendingsupport/angular-router@17.3.12-angular-17.3.14
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.14
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.14

v17.3.13 - February 27, 2025

Notes

This release contains no functional change from the OSS Angular v17.3.12.
This release mainlines OSS v17.3.12 into NES v17.3.13.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@17.3.12-angular-17.3.13
- @neverendingsupport/angular-common@17.3.12-angular-17.3.13
- @neverendingsupport/angular-compiler@17.3.12-angular-17.3.13
- @neverendingsupport/angular-compiler-cli@17.3.12-angular-17.3.13
- @neverendingsupport/angular-core@17.3.12-angular-17.3.13
- @neverendingsupport/angular-elements@17.3.12-angular-17.3.13
- @neverendingsupport/angular-forms@17.3.12-angular-17.3.13
- @neverendingsupport/angular-language-service@17.3.12-angular-17.3.13
- @neverendingsupport/angular-localize@17.3.12-angular-17.3.13
- @neverendingsupport/angular-platform-browser@17.3.12-angular-17.3.13
- @neverendingsupport/angular-platform-browser-dynamic@17.3.12-angular-17.3.13
- @neverendingsupport/angular-platform-server@17.3.12-angular-17.3.13
- @neverendingsupport/angular-router@17.3.12-angular-17.3.13
- @neverendingsupport/angular-service-worker@17.3.12-angular-17.3.13
- @neverendingsupport/angular-upgrade@17.3.12-angular-17.3.13

Angular CLI

v17.3.24 - June 24, 2026

Notes

This release contains no functional change from the NES v17.3.23.
This release contains only metadata fixes and improvements: Fixed peer-dependency versions.
Full package name(s) and version(s):
- @neverendingsupport/angular-cli@17.3.17-angular-cli-17.3.24
- @neverendingsupport/angular-create@17.3.17-angular-cli-17.3.24
- @neverendingsupport/angular-pwa@17.3.17-angular-cli-17.3.24
- @neverendingsupport/angular-ssr@17.3.17-angular-cli-17.3.24
- @neverendingsupport/angular-devkit-architect@0.1703.17-angular-cli-17.3.24
- @neverendingsupport/angular-devkit-architect-cli@0.1703.17-angular-cli-17.3.24
- @neverendingsupport/angular-devkit-build-angular@17.3.17-angular-cli-17.3.24
- @neverendingsupport/angular-devkit-build-webpack@0.1703.17-angular-cli-17.3.24
- @neverendingsupport/angular-devkit-core@17.3.17-angular-cli-17.3.24
- @neverendingsupport/angular-devkit-schematics@17.3.17-angular-cli-17.3.24
- @neverendingsupport/angular-devkit-schematics-cli@17.3.17-angular-cli-17.3.24
- @neverendingsupport/ngtools-webpack@17.3.17-angular-cli-17.3.24

v17.3.23 - June 17, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-cli@17.3.17-angular-cli-17.3.23
- @neverendingsupport/angular-create@17.3.17-angular-cli-17.3.23
- @neverendingsupport/angular-pwa@17.3.17-angular-cli-17.3.23
- @neverendingsupport/angular-ssr@17.3.17-angular-cli-17.3.23
- @neverendingsupport/angular-devkit-architect@0.1703.17-angular-cli-17.3.23
- @neverendingsupport/angular-devkit-architect-cli@0.1703.17-angular-cli-17.3.23
- @neverendingsupport/angular-devkit-build-angular@17.3.17-angular-cli-17.3.23
- @neverendingsupport/angular-devkit-build-webpack@0.1703.17-angular-cli-17.3.23
- @neverendingsupport/angular-devkit-core@17.3.17-angular-cli-17.3.23
- @neverendingsupport/angular-devkit-schematics@17.3.17-angular-cli-17.3.23
- @neverendingsupport/angular-devkit-schematics-cli@17.3.17-angular-cli-17.3.23
- @neverendingsupport/ngtools-webpack@17.3.17-angular-cli-17.3.23

Compatibility Fixes

ssr:
- Allow all hosts in common engine rendering options to prevent validation errors caused by upstream Angular v17.3.22 host validation changes.

Dependency Updates

Upgrade picomatch to v4.0.4. Check the picomatch release notes for details.

v17.3.22 - April 20, 2026

Notes

This release contains no functional change from the NES v17.3.21.
Fixes an issue where installing NES packages would fail to resolve a dependency on @schematics/angular.
Full package name(s) and version(s):
- @neverendingsupport/angular-cli@17.3.17-angular-cli-17.3.22
- @neverendingsupport/angular-create@17.3.17-angular-cli-17.3.22
- @neverendingsupport/angular-pwa@17.3.17-angular-cli-17.3.22
- @neverendingsupport/angular-ssr@17.3.17-angular-cli-17.3.22
- @neverendingsupport/angular-devkit-architect@0.1703.17-angular-cli-17.3.22
- @neverendingsupport/angular-devkit-architect-cli@0.1703.17-angular-cli-17.3.22
- @neverendingsupport/angular-devkit-build-angular@17.3.17-angular-cli-17.3.22
- @neverendingsupport/angular-devkit-build-webpack@0.1703.17-angular-cli-17.3.22
- @neverendingsupport/angular-devkit-core@17.3.17-angular-cli-17.3.22
- @neverendingsupport/angular-devkit-schematics@17.3.17-angular-cli-17.3.22
- @neverendingsupport/angular-devkit-schematics-cli@17.3.17-angular-cli-17.3.22
- @neverendingsupport/ngtools-webpack@17.3.17-angular-cli-17.3.22

v17.3.21 - April 17, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-cli@17.3.17-angular-cli-17.3.21
- @neverendingsupport/angular-create@17.3.17-angular-cli-17.3.21
- @neverendingsupport/angular-pwa@17.3.17-angular-cli-17.3.21
- @neverendingsupport/angular-ssr@17.3.17-angular-cli-17.3.21
- @neverendingsupport/angular-devkit-architect@0.1703.17-angular-cli-17.3.21
- @neverendingsupport/angular-devkit-architect-cli@0.1703.17-angular-cli-17.3.21
- @neverendingsupport/angular-devkit-build-angular@17.3.17-angular-cli-17.3.21
- @neverendingsupport/angular-devkit-build-webpack@0.1703.17-angular-cli-17.3.21
- @neverendingsupport/angular-devkit-core@17.3.17-angular-cli-17.3.21
- @neverendingsupport/angular-devkit-schematics@17.3.17-angular-cli-17.3.21
- @neverendingsupport/angular-devkit-schematics-cli@17.3.17-angular-cli-17.3.21
- @neverendingsupport/ngtools-webpack@17.3.17-angular-cli-17.3.21

Security Fixes

ssr:
- Validate host headers to prevent header-based SSRF.
  - This fixes a critical-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-27739).

17.3.20 (NES) - October, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-cli@17.3.17-angular-cli-17.3.20
- @neverendingsupport/angular-create@17.3.17-angular-cli-17.3.20
- @neverendingsupport/angular-pwa@17.3.17-angular-cli-17.3.20
- @neverendingsupport/angular-ssr@17.3.17-angular-cli-17.3.20
- @neverendingsupport/angular-devkit-architect@0.1703.17-angular-cli-17.3.20
- @neverendingsupport/angular-devkit-architect-cli@0.1703.17-angular-cli-17.3.20
- @neverendingsupport/angular-devkit-build-angular@17.3.17-angular-cli-17.3.20
- @neverendingsupport/angular-devkit-build-webpack@0.1703.17-angular-cli-17.3.20
- @neverendingsupport/angular-devkit-core@17.3.17-angular-cli-17.3.20
- @neverendingsupport/angular-devkit-schematics@17.3.17-angular-cli-17.3.20
- @neverendingsupport/angular-devkit-schematics-cli@17.3.17-angular-cli-17.3.20
- @neverendingsupport/ngtools-webpack@17.3.17-angular-cli-17.3.20

Breaking Changes

@angular/ssr

The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-59052).
Before:
const bootstrap = () => bootstrapApplication(AppComponent, config);
After:
const bootstrap = (context: BootstrapContext) => bootstrapApplication(AppComponent, config, context);

17.3.19 (NES) - September, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-cli@17.3.17-angular-cli-17.3.19
- @neverendingsupport/angular-create@17.3.17-angular-cli-17.3.19
- @neverendingsupport/angular-pwa@17.3.17-angular-cli-17.3.19
- @neverendingsupport/angular-ssr@17.3.17-angular-cli-17.3.19
- @neverendingsupport/angular-devkit-architect@0.1703.17-angular-cli-17.3.19
- @neverendingsupport/angular-devkit-architect-cli@0.1703.17-angular-cli-17.3.19
- @neverendingsupport/angular-devkit-build-angular@17.3.17-angular-cli-17.3.19
- @neverendingsupport/angular-devkit-build-webpack@0.1703.17-angular-cli-17.3.19
- @neverendingsupport/angular-devkit-core@17.3.17-angular-cli-17.3.19
- @neverendingsupport/angular-devkit-schematics@17.3.17-angular-cli-17.3.19
- @neverendingsupport/angular-devkit-schematics-cli@17.3.17-angular-cli-17.3.19
- @neverendingsupport/ngtools-webpack@17.3.17-angular-cli-17.3.19

Bug Fixes

Fixed build issues: updated peer dependency version numbers

17.3.18 (NES) - June, 2025

Notes

This release brings in upstream changes from @angular/cli since the last NES release.
Full package name(s) and version(s):
- @neverendingsupport/angular-cli@17.3.17-angular-cli-17.3.18
- @neverendingsupport/angular-create@17.3.17-angular-cli-17.3.18
- @neverendingsupport/angular-pwa@17.3.17-angular-cli-17.3.18
- @neverendingsupport/angular-ssr@17.3.17-angular-cli-17.3.18
- @neverendingsupport/angular-devkit-architect@0.1703.17-angular-cli-17.3.18
- @neverendingsupport/angular-devkit-architect-cli@0.1703.17-angular-cli-17.3.18
- @neverendingsupport/angular-devkit-build-angular@17.3.17-angular-cli-17.3.18
- @neverendingsupport/angular-devkit-build-webpack@0.1703.17-angular-cli-17.3.18
- @neverendingsupport/angular-devkit-core@17.3.17-angular-cli-17.3.18
- @neverendingsupport/angular-devkit-schematics@17.3.17-angular-cli-17.3.18
- @neverendingsupport/angular-devkit-schematics-cli@17.3.17-angular-cli-17.3.18
- @neverendingsupport/ngtools-webpack@17.3.17-angular-cli-17.3.18

17.3.13 (NES) - February, 2025

Notes

This is the initial release of the NES Angular CLI 17.3.x series.