common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68868)
	prevent namespaced SVG <style> elements from being stripped
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68868)

core

Commit	Description
	do not register dom triggers when defer blocks are in manual mode
	normalize tag names in runtime i18n attribute security context lookup (#68868)
	prevent rxResource from leaking a subscription
	sanitize meta selectors

forms

Commit	Description
	avoid redundant invalidations in parser errors signal

http

Commit	Description
	exclude withCredentials requests from transfer cache
	Introduce a max buffer size for fetch requests on SSR
	prevent httpResource from leaking a subscription
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	prevent SSRF bypasses via backslash URLs in HttpClient
	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Description
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68925)
	prevent namespaced SVG <style> elements from being stripped
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68925)
	strip namespaced SVG script elements during template compilation (#68925)

core

Commit	Description
	normalize tag names in runtime i18n attribute security context lookup (#68925)
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68925)
	synchronize core sanitization schema with compiler (#68925)

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	prevent SSRF bypasses via backslash URLs in HttpClient
	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Description
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

compiler

Commit	Description
	prevent namespaced SVG <style> elements from being stripped

compiler

Commit	Description
	prevent namespaced SVG <style> elements from being stripped

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68926)
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68926)
	strip namespaced SVG script elements during template compilation (#68926)

core

Commit	Description
	normalize tag names in runtime i18n attribute security context lookup (#68926)
	reject script element as a dynamic component host (#68926)
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation (#68926)
	synchronize core sanitization schema with compiler (#68926)

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Description
	preserve redirect policy on reconstructed asset requests
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

common

Commit	Description
	add upper bounds for digitsInfo
	sanitize placeholder

compiler

Commit	Description
	normalize tag names with custom namespaces in DomElementSchemaRegistry
	sanitize dynamic href and xlink:href bindings on SVG a elements
	strip namespaced SVG script elements during template compilation

core

Commit	Description
	reject script element as a dynamic component host
	sanitize meta selectors
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation
	synchronize core sanitization schema with compiler
	wrap i18n dynamic element property updates in active index states

http

Commit	Description
	exclude withCredentials requests from transfer cache
	skip TransferCache for cookie-bearing requests by default

platform-server

Commit	Description
	normalize path parsing in ServerPlatformLocation
	secure location and document initialization against SSRF and path hijack

service-worker

Commit	Description
	preserve redirect policy on reconstructed asset requests
	Preserves explicit 'credentials: omit' in asset requests
	Preserves HTTP cache mode in asset group requests

• fix(vscode-extension): disable language server in untrusted workspaces (4a41831326)
• fix(vscode-extension): restrict jsdoc markdown trust and harden document opening (6d8b156b45)
• fix(vscode-extension): prompt for confirmation before loading workspace tsdk (82cf38ad95)
• fix(vscode-extension): Look for tsdk override in the new js/ts.tsdk.path setting (b40b67cdc1)
• fix(language-service): get quick info at local var location to align with TS semantics and support type narrowing (7797671257)

compiler

Commit	Description
	strip namespaced SVG script elements during template compilation

core

Commit	Description
	do not insert todo when migrating void @output
	makes resource URL sanitizer lookup case-insensitive
	reject script element as a dynamic component host
	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation
	synchronize core sanitization schema with compiler
	visit ICU expressions in signal migration schematics

forms

Commit	Description
	avoid spurious recomputation in FormField.parseErrors

router

Commit	Description
	Add strict typing on 'getResolvedTitleForRoute'
	skip scroll-to-top on initial navigation when hydrating

Breaking Changes

router

• The return type for TitleStrategy.getResolvedTitleForRoute
  was previously 'any' while the actual return type could only be either string
  or undefined. The return type now reflects the possible values correctly.
  Code that reads the value may need to be adjusted.

  (cherry picked from commit ad37f52)

compiler

Commit	Description
	strip namespaced SVG script elements during template compilation

core

Commit	Description
	do not insert todo when migrating void @output
	makes resource URL sanitizer lookup case-insensitive
	reject script element as a dynamic component host
	visit ICU expressions in signal migration schematics

router

Commit	Description
	skip scroll-to-top on initial navigation when hydrating

compiler

Commit	Description
	enforce parentheses containing arguments for :host-context
	preserve leading commas in animation definitions
	remove dedicated support for legacy shadow DOM selectors
	remove deprecated shadow CSS encapsulation polyfills
	simplify handling of colon host with a selector list
	type check invalid for loops

platform-server

Commit	Description
	forward BEFORE_APP_SERIALIZED errors to ErrorHandler