Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 21.2.15 to 21.2.17.

Release notes

Sourced from @angular/core's releases.

21.2.17

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69269)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69255)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

21.2.16

common

Commit Description

only strip a literal /index.html suffix from URLs

compiler

Commit Description

move projection attributes into constants

core

Commit Description

harden inherit definition feature against polluted prototypes

use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Description
	sanitize two-way properties

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69269)

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69255)

Commit	Description
	Strips sensitive headers on cross-origin redirects

Commit	Description
	only strip a literal /index.html suffix from URLs

Commit	Description
	move projection attributes into constants

Commit	Description
	harden inherit definition feature against polluted prototypes
	use Object.create(null) for LOCALE_DATA as a hardening measure

... (truncated)

Changelog

Sourced from @angular/core's changelog.

21.2.17 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

86a56dc279 fix Limits date format string length

d846326b07 fix skip transfer cache for uncacheable HTTP traffic

bc55749698 fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

dc9c99636d fix sanitize two-way properties

core

Commit Type Description

1523061137 fix harden TransferState restoration against DOM clobbering

88832c84f8 fix validate lowercase SVG animation attribute names (#69269)

http

Commit Type Description

bcb1b7ea25 fix preserve empty referrer option in HttpRequest

a810a319d1 fix Rejects non-HTTP(S) URLs in JSONP requests

e245d40c4d fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

35510746b7 fix harden platform location origin validation during SSR

13fb0afe93 refactor deprecate ServerXhr (#69255)

service-worker

Commit Type Description

b9d29381bb fix Strips sensitive headers on cross-origin redirects

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

| Commit | Type | Description |

Commit	Type	Description
86a56dc279	fix	Limits date format string length
d846326b07	fix	skip transfer cache for uncacheable HTTP traffic
bc55749698	fix	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
dc9c99636d	fix	sanitize two-way properties

Commit	Type	Description
1523061137	fix	harden TransferState restoration against DOM clobbering
88832c84f8	fix	validate lowercase SVG animation attribute names (#69269)

Commit	Type	Description
bcb1b7ea25	fix	preserve empty referrer option in HttpRequest
a810a319d1	fix	Rejects non-HTTP(S) URLs in JSONP requests
e245d40c4d	fix	skip transfer cache for fetch credentialed requests

Commit	Type	Description
35510746b7	fix	harden platform location origin validation during SSR
13fb0afe93	refactor	deprecate ServerXhr (#69255)

Commit	Type	Description
b9d29381bb	fix	Strips sensitive headers on cross-origin redirects

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

... (truncated)

Commits

88832c8 fix(core): validate lowercase SVG animation attribute names (#69269)
3551074 fix(platform-server): harden platform location origin validation during SSR
bc55749 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
d846326 fix(common): skip transfer cache for uncacheable HTTP traffic
e245d40 fix(http): skip transfer cache for fetch credentialed requests
1523061 fix(core): harden TransferState restoration against DOM clobbering
736c4ab refactor(core): fix broken unit test.
3fd6897 fix(core): harden inherit definition feature against polluted prototypes
7e38336 fix(core): use Object.create(null) for LOCALE_DATA as a hardening measure
See full diff in compare view