Angular 5 Release Notes | HeroDevs Docs

Angular

v5.2.22 - September 16, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@5.2.11-angular-5.2.22
- @neverendingsupport/angular-common@5.2.11-angular-5.2.22
- @neverendingsupport/angular-compiler@5.2.11-angular-5.2.22
- @neverendingsupport/angular-compiler-cli@5.2.11-angular-5.2.22
- @neverendingsupport/angular-core@5.2.11-angular-5.2.22
- @neverendingsupport/angular-forms@5.2.11-angular-5.2.22
- @neverendingsupport/angular-http@5.2.11-angular-5.2.22
- @neverendingsupport/angular-language-service@5.2.11-angular-5.2.22
- @neverendingsupport/angular-platform-browser@5.2.11-angular-5.2.22
- @neverendingsupport/angular-platform-browser-dynamic@5.2.11-angular-5.2.22
- @neverendingsupport/angular-platform-server@5.2.11-angular-5.2.22
- @neverendingsupport/angular-platform-webworker@5.2.11-angular-5.2.22
- @neverendingsupport/angular-platform-webworker-dynamic@5.2.11-angular-5.2.22
- @neverendingsupport/angular-router@5.2.11-angular-5.2.22
- @neverendingsupport/angular-service-worker@5.2.11-angular-5.2.22
- @neverendingsupport/angular-upgrade@5.2.11-angular-5.2.22

Security Fixes

platform-server:
- Escape fallback raw-content ancestor tags in comments and nested raw-text elements when serializing server-rendered output.
- Escape fallback raw-content ancestor tags across SVG and MathML foreign content when serializing server-rendered output.
- Escape processing instruction nodes in fallback raw-content elements when serializing server-rendered output.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-88058).
- Escape <template> content across DocumentFragment boundaries in fallback raw-content elements when serializing server-rendered output.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-88060).
- Escape comment content that abruptly closes the comment when serializing server-rendered output.
- Avoid an infinite loop when parsing a malformed DOCTYPE during server-side rendering.
  - This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-101895).

v5.2.21 - September 14, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@5.2.11-angular-5.2.21
- @neverendingsupport/angular-common@5.2.11-angular-5.2.21
- @neverendingsupport/angular-compiler@5.2.11-angular-5.2.21
- @neverendingsupport/angular-compiler-cli@5.2.11-angular-5.2.21
- @neverendingsupport/angular-core@5.2.11-angular-5.2.21
- @neverendingsupport/angular-forms@5.2.11-angular-5.2.21
- @neverendingsupport/angular-http@5.2.11-angular-5.2.21
- @neverendingsupport/angular-language-service@5.2.11-angular-5.2.21
- @neverendingsupport/angular-platform-browser@5.2.11-angular-5.2.21
- @neverendingsupport/angular-platform-browser-dynamic@5.2.11-angular-5.2.21
- @neverendingsupport/angular-platform-server@5.2.11-angular-5.2.21
- @neverendingsupport/angular-platform-webworker@5.2.11-angular-5.2.21
- @neverendingsupport/angular-platform-webworker-dynamic@5.2.11-angular-5.2.21
- @neverendingsupport/angular-router@5.2.11-angular-5.2.21
- @neverendingsupport/angular-service-worker@5.2.11-angular-5.2.21
- @neverendingsupport/angular-upgrade@5.2.11-angular-5.2.21

Security Fixes

compiler:
- Strip namespaced SVG script elements during template compilation.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
- Sanitize dynamic href and xlink:href bindings on SVG elements.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
- Normalize tag names with custom namespaces in DomElementSchemaRegistry.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50557).
core:
- Support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation.
- Synchronize core sanitization schema with compiler.
- Reject script element as a dynamic component host.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).
- Validate lowercase SVG animation attribute names.
  - This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-52725).

v5.2.20 - August 20, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@5.2.11-angular-5.2.20
- @neverendingsupport/angular-common@5.2.11-angular-5.2.20
- @neverendingsupport/angular-compiler@5.2.11-angular-5.2.20
- @neverendingsupport/angular-compiler-cli@5.2.11-angular-5.2.20
- @neverendingsupport/angular-core@5.2.11-angular-5.2.20
- @neverendingsupport/angular-forms@5.2.11-angular-5.2.20
- @neverendingsupport/angular-http@5.2.11-angular-5.2.20
- @neverendingsupport/angular-language-service@5.2.11-angular-5.2.20
- @neverendingsupport/angular-platform-browser@5.2.11-angular-5.2.20
- @neverendingsupport/angular-platform-browser-dynamic@5.2.11-angular-5.2.20
- @neverendingsupport/angular-platform-server@5.2.11-angular-5.2.20
- @neverendingsupport/angular-platform-webworker@5.2.11-angular-5.2.20
- @neverendingsupport/angular-platform-webworker-dynamic@5.2.11-angular-5.2.20
- @neverendingsupport/angular-router@5.2.11-angular-5.2.20
- @neverendingsupport/angular-service-worker@5.2.11-angular-5.2.20
- @neverendingsupport/angular-upgrade@5.2.11-angular-5.2.20

Security Fixes

common:
- Add upper bounds for digitsInfo to prevent roundNumber from allocating a large array.
  - This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-50171).
- Limit date format string length to 256 characters.
  - This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2026-54268).
compiler:
- Reject i18n translation of event-handler attributes on the View Engine path.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69151).
platform-browser:
- Harden TransferState restoration against DOM clobbering.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-54267).
platform-server:
- Escape matching closing tags correctly when raw-text content contains astral characters.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50555).
- Escape <noscript> text content when serializing server-rendered output.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-50556).
- Escape text in fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>) when serializing server-rendered output.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-69149).

v5.2.19 - August 3, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@5.2.11-angular-5.2.19
- @neverendingsupport/angular-common@5.2.11-angular-5.2.19
- @neverendingsupport/angular-compiler@5.2.11-angular-5.2.19
- @neverendingsupport/angular-compiler-cli@5.2.11-angular-5.2.19
- @neverendingsupport/angular-core@5.2.11-angular-5.2.19
- @neverendingsupport/angular-forms@5.2.11-angular-5.2.19
- @neverendingsupport/angular-http@5.2.11-angular-5.2.19
- @neverendingsupport/angular-language-service@5.2.11-angular-5.2.19
- @neverendingsupport/angular-platform-browser@5.2.11-angular-5.2.19
- @neverendingsupport/angular-platform-browser-dynamic@5.2.11-angular-5.2.19
- @neverendingsupport/angular-platform-server@5.2.11-angular-5.2.19
- @neverendingsupport/angular-platform-webworker@5.2.11-angular-5.2.19
- @neverendingsupport/angular-platform-webworker-dynamic@5.2.11-angular-5.2.19
- @neverendingsupport/angular-router@5.2.11-angular-5.2.19
- @neverendingsupport/angular-service-worker@5.2.11-angular-5.2.19
- @neverendingsupport/angular-upgrade@5.2.11-angular-5.2.19

Security Fixes

service-worker:
- Preserve redirect policy on reconstructed asset requests.
  - This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50169).
- Preserve explicit credentials: 'omit' in asset requests.
  - This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).
- Preserve HTTP cache mode in asset group requests.
  - This fixes a medium-severity Information Exposure vulnerability (CVE-2026-50184).

v5.2.18 - May 5, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@5.2.11-angular-5.2.18
- @neverendingsupport/angular-common@5.2.11-angular-5.2.18
- @neverendingsupport/angular-compiler@5.2.11-angular-5.2.18
- @neverendingsupport/angular-compiler-cli@5.2.11-angular-5.2.18
- @neverendingsupport/angular-core@5.2.11-angular-5.2.18
- @neverendingsupport/angular-forms@5.2.11-angular-5.2.18
- @neverendingsupport/angular-http@5.2.11-angular-5.2.18
- @neverendingsupport/angular-language-service@5.2.11-angular-5.2.18
- @neverendingsupport/angular-platform-browser@5.2.11-angular-5.2.18
- @neverendingsupport/angular-platform-browser-dynamic@5.2.11-angular-5.2.18
- @neverendingsupport/angular-platform-server@5.2.11-angular-5.2.18
- @neverendingsupport/angular-platform-webworker@5.2.11-angular-5.2.18
- @neverendingsupport/angular-platform-webworker-dynamic@5.2.11-angular-5.2.18
- @neverendingsupport/angular-router@5.2.11-angular-5.2.18
- @neverendingsupport/angular-service-worker@5.2.11-angular-5.2.18
- @neverendingsupport/angular-upgrade@5.2.11-angular-5.2.18

Security Fixes

core:
- Sanitize sensitive attributes on SVG script elements.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).

v5.2.17 - December 19, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@5.2.11-angular-5.2.17
- @neverendingsupport/angular-common@5.2.11-angular-5.2.17
- @neverendingsupport/angular-compiler@5.2.11-angular-5.2.17
- @neverendingsupport/angular-compiler-cli@5.2.11-angular-5.2.17
- @neverendingsupport/angular-core@5.2.11-angular-5.2.17
- @neverendingsupport/angular-forms@5.2.11-angular-5.2.17
- @neverendingsupport/angular-http@5.2.11-angular-5.2.17
- @neverendingsupport/angular-language-service@5.2.11-angular-5.2.17
- @neverendingsupport/angular-platform-browser@5.2.11-angular-5.2.17
- @neverendingsupport/angular-platform-browser-dynamic@5.2.11-angular-5.2.17
- @neverendingsupport/angular-platform-server@5.2.11-angular-5.2.17
- @neverendingsupport/angular-platform-webworker@5.2.11-angular-5.2.17
- @neverendingsupport/angular-platform-webworker-dynamic@5.2.11-angular-5.2.17
- @neverendingsupport/angular-router@5.2.11-angular-5.2.17
- @neverendingsupport/angular-service-worker@5.2.11-angular-5.2.17
- @neverendingsupport/angular-upgrade@5.2.11-angular-5.2.17

Security Fixes

compiler:
- Prevent stored XSS via SVG animation attributeName and MathML/SVG URLs.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).

v5.2.16 - December 10, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@5.2.11-angular-5.2.16
- @neverendingsupport/angular-common@5.2.11-angular-5.2.16
- @neverendingsupport/angular-compiler@5.2.11-angular-5.2.16
- @neverendingsupport/angular-compiler-cli@5.2.11-angular-5.2.16
- @neverendingsupport/angular-core@5.2.11-angular-5.2.16
- @neverendingsupport/angular-forms@5.2.11-angular-5.2.16
- @neverendingsupport/angular-http@5.2.11-angular-5.2.16
- @neverendingsupport/angular-language-service@5.2.11-angular-5.2.16
- @neverendingsupport/angular-platform-browser@5.2.11-angular-5.2.16
- @neverendingsupport/angular-platform-browser-dynamic@5.2.11-angular-5.2.16
- @neverendingsupport/angular-platform-server@5.2.11-angular-5.2.16
- @neverendingsupport/angular-platform-webworker@5.2.11-angular-5.2.16
- @neverendingsupport/angular-platform-webworker-dynamic@5.2.11-angular-5.2.16
- @neverendingsupport/angular-router@5.2.11-angular-5.2.16
- @neverendingsupport/angular-service-worker@5.2.11-angular-5.2.16
- @neverendingsupport/angular-upgrade@5.2.11-angular-5.2.16

Security Fixes

common:
- Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
  - This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).

v5.2.15 - June 16, 2025

Notes

This release contains no functional changes from NES v5.2.14.
This release implements a new package naming scheme for the Angular packages. More information about the change can be found in the NES Decoupled Namespace Specification.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@5.2.11-angular-5.2.15
- @neverendingsupport/angular-common@5.2.11-angular-5.2.15
- @neverendingsupport/angular-compiler@5.2.11-angular-5.2.15
- @neverendingsupport/angular-compiler-cli@5.2.11-angular-5.2.15
- @neverendingsupport/angular-core@5.2.11-angular-5.2.15
- @neverendingsupport/angular-forms@5.2.11-angular-5.2.15
- @neverendingsupport/angular-http@5.2.11-angular-5.2.15
- @neverendingsupport/angular-language-service@5.2.11-angular-5.2.15
- @neverendingsupport/angular-platform-browser@5.2.11-angular-5.2.15
- @neverendingsupport/angular-platform-browser-dynamic@5.2.11-angular-5.2.15
- @neverendingsupport/angular-platform-server@5.2.11-angular-5.2.15
- @neverendingsupport/angular-platform-webworker@5.2.11-angular-5.2.15
- @neverendingsupport/angular-platform-webworker-dynamic@5.2.11-angular-5.2.15
- @neverendingsupport/angular-router@5.2.11-angular-5.2.15
- @neverendingsupport/angular-service-worker@5.2.11-angular-5.2.15
- @neverendingsupport/angular-upgrade@5.2.11-angular-5.2.15

v5.2.14 - February 6, 2025

Notes

This release contains no functional changes from NES v5.2.13.
This release contains metadata fixes and improvements: Updated licensing information.
Full Version: 5.2.11-{PACKAGE_NAME}-5.2.14

v5.2.13 - January 10, 2025

Notes

This release contains no functional changes from NES v5.2.12.
This release contains metadata fixes and improvements: Updated package.json files.
Full Version: 5.2.11-{PACKAGE_NAME}-5.2.13

v5.2.12 - January 9, 2025

Notes

Full Version: 5.2.11-{PACKAGE_NAME}-5.2.12

Security Fixes

common:
- Use ContentType: application/json (instead of text/plain) for boolean values with HttpClient request body.
core:
- Ensure sanitizer works if DOMParser returns null body.
- Fix possible XSS vulnerability in development through SSR.
  - This fixes a low-severity Cross-Site Scripting (XSS) vulnerability (CVE-2021-4231).
platform-browser:
- Prevent memory leak of style nodes if shadow DOM encapsulation is used.