22.2.1

Official Angular changelog summary with source attribution, release tags, and community reactions.

Track this Angular release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

Angular·Sep 30, 2026, 06:34 PMFixSecurity-relevantAI-assisted summary

Summary

Added security hardening: URL sanitizer now blocks data: and vbscript: schemes, extends non‑executable MIME allowlist, and router rejects protocol‑relative URLs, limits absolute redirects, and prevents duplicate outlets.
Introduced feature and performance improvements: NgOptimizedImage now forwards srcset when disabled, support for extendedConfigCache, initial blocking resource input set synchronously, and httpResource reportProgress forwarded as reportD...
Compiler and core refinements: explicit return types for generated functions, fixes for parentheses stripping in templates, and added debugName to afterRenderEffect blocks.