• fix(vscode-extension): resolve relative workspace tsdk paths to absolute (f6695b0eb2)
• fix(language-service): prevent external template inlay hints from appearing in TS files (43a0e28729)
• fix(vscode-extension): inspect tsdk configurations correctly (102ffb65d1)

common

Commit	Description
	skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit	Description
	support foreign components defined outside top-level scope

compiler-cli

Commit	Description
	allow passing uninvoked signals as foreign component props
	support import aliases in foreignImports (#68674)

core

Commit	Description
	add custom set option to linkedSignal
	correct container anchor collection order to match DOM layout
	introduce disposal mechanism for Angular views in foreign @content
	introduce logical-only containers for foreign content
	set current tnode in foreign component instruction on reuse

http

Commit	Description
	skip transfer cache for fetch credentialed requests (#69017)
	deprecate jsonp support

language-service

Commit	Description
	compile non-exported classes if standalone (#68454)
	Typecheck templates which would require inline typecheck blocks (#68454)

platform-server

Commit	Description
	harden platform location origin validation during SSR (#69184)

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

Commit	Description
	disable WebMCP during SSR
	Handle synchronous errors in PendingTasks.run function
	harden TransferState restoration against DOM clobbering
	prevent dangling prevConsumer reference from leaking destroyed views (#68681)
	require WebMCP tool descriptions
	update comment for Default change detection
	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
	validate lowercase SVG animation attribute names

forms

Commit	Description
	delay mcp reading the form model by a tick
	harden FormGroup control lookups against prototype shadowing
	remove animationstart listener on component destroy to prevent memory leak
	set additionalProperties: false on generated WebMCP form

http

Commit	Description
	ensure query parameters are inserted before URL fragments
	pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit	Description
	prevent external template inlay hints from appearing in TS files

platform-server

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr

router

Commit	Description
	use native URL object for navigation boundary and comparison

service-worker

Commit	Description
	Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.
  (cherry picked from commit 8446e46)

common

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	sanitize two-way properties

core

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69269)

http

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

platform-server

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69255)

service-worker

Commit	Description
	Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	sanitize two-way properties

core

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69270)

http

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

platform-server

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69256)

service-worker

Commit	Description
	Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

compiler

Commit	Description
	allow safe navigation to correctly narrow down nullables
	Angular expressions with optional chaining returns undefined
	Support comments in html element.
	abstract emitter producing incorrect code for dynamic imports
	Don't bind inputs/outputs for data- attributes
	don't escape dollar sign in literal expression
	enforce parentheses containing arguments for :host-context
	invalid type checking code if field name needs to be quoted
	normalize tag names with custom namespaces in DomElementSchemaRegistry (#68868)
	preserve leading commas in animation definitions
	remove dedicated support for legacy shadow DOM selectors
	remove deprecated shadow CSS encapsulation polyfills
	sanitize dynamic href and xlink:href bindings on SVG a elements (#68868)
	simplify handling of colon host with a selector list
	stop generating unused field
	throw on duplicate input/outputs
	throw on invalid in expressions
	type check invalid for loops

compiler-cli

Commit	Description
	add support for Node.js 26.0.0
	Adds warning for prefetch without main defer trigger
	support external TCBs with copied content in specific mode
	animation events not type checked properly when bound through HostListener decorator
	resolve TCB mapping failure for safe property reads with as any
	transform dropping exclamationToken from properties
	introduce NG8023 compile-time diagnostic for duplicate selectors

core

Commit	Description
	add IdleRequestOptions support to IdleService
	add provideWebMcpTools
	Add a injectAsync helper function
	Add a schematics to migrate provideHttpClient to keep using the HttpXhrBackend implementation.
	add ability to cache resources for SSR
	Add migration to add ChangeDetectionStrategy.Eager where applicable
	add special return statuses for resource params
	add TestBed.getFixture
	allow debouncing signals
	Allow other expression for exhaustive typechecking
	allow synchronous values for stream Resources
	bootstrap via ApplicationRef with config
	de-duplicate host directives
	drop support for TypeScript 5.9
	enhance profiling with documentation URLs
	export experimental declareWebMcpTool support
	implement Angular DI graph in-page AI tool
	introduce @Service decorator
	re-introduce nested leave animations scoped to component boundaries
	register AI runtime debugging tools
	Set default Component changeDetection strategy ...

common

Commit	Description
	only strip a literal /index.html suffix from URLs

compiler

Commit	Description
	move projection attributes into constants

core

Commit	Description
	harden inherit definition feature against polluted prototypes
	use Object.create(null) for LOCALE_DATA as a hardening measure

platform-server

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

Breaking Changes

The extension now bundles TypeScript version 6.0, which itself includes breaking
changes, including new defaults such as strict being true. You will need to explicitly set
"strict": false in your tsconfig.json. Alternatively, the extension supports configuring the tsdk in the same way as the built in TS/JS extension.

Fixes and features

• fix(language-service): Add support for @Input with transforms (dc9c72da9b)
• feat(language-service): add Document Symbols support for Angular templates (cfd0f9950c)
• feat(language-service): add angular template inlay hints support (5a6d88626b)
• feat(language-service): Add support for idle timeout in defer blocks (c6f98c723c)

platform-server

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

platform-server

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version