Bump @angular/common, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic and @angular/router

[dependabot]

Bumps @angular/common, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic and @angular/router. These dependencies needed to be updated together.
Updates @angular/common from 18.2.13 to 22.0.2

Release notes

Sourced from @​angular/common's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

http

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Description
	migration skip any target are not build or test

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

22.0.2 (2026-06-17)

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

22.1.0-next.0 (2026-06-10)

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit	Type	Description
25c744c4d0	fix	support foreign components defined outside top-level scope

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#68674)

... (truncated)

Commits

• 6867f77 fix(http): distinguish repeated transfer cache params
• 6c1f3e9 fix(common): skip transfer cache for uncacheable HTTP traffic (#69316)
• 7ef1399 fix(http): skip transfer cache for fetch credentialed requests (#69316)
• 94ea403 fix(common): escape anchor fragment in shadow DOM name selector
• 2dd65d2 fix(http): pass down the reportUploadProgress and reportDownloadProgress ...
• 1bd5a56 docs: deprecate XHR support for server-side rendering in HTTP docs and recomm...
• 3c2892c fix(common): prevent prototype pollution in formatDateTime
• c4b5fa3 fix(common): escape CSS string-terminating characters in escapeCssUrl
• 4254eb4 fix(http): preserve empty referrer option in HttpRequest
• 167bd4c fix(http): Rejects non-HTTP(S) URLs in JSONP requests
• Additional commits viewable in compare view

Updates @angular/forms from 18.2.13 to 22.0.2

Release notes

Sourced from @​angular/forms's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

http

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Description
	migration skip any target are not build or test

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

... (truncated)

Changelog

Sourced from @​angular/forms's changelog.

22.0.2 (2026-06-17)

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

22.1.0-next.0 (2026-06-10)

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit	Type	Description
25c744c4d0	fix	support foreign components defined outside top-level scope

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#68674)

... (truncated)

Commits

• 3f05543 refactor(forms): fix initWebMcpForm description to be required
• 11836a6 fix(forms): delay mcp reading the form model by a tick
• e51ad37 fix(forms): remove animationstart listener on component destroy to prevent me...
• 85d2d10 fix(forms): harden FormGroup control lookups against prototype shadowing
• cdcea80 fix(core): require WebMCP tool descriptions
• 55b7b5a fix(forms): set additionalProperties: false on generated WebMCP form
• e81c7e8 refactor(forms): type built-in getError results
• eb600aa refactor(forms): mark date and limit signal forms APIs public
• a97d5ec build: update minimum supported Node.js versions
• 3b4ef1e perf(forms): avoid redundant invalidations in parser errors signal
• Additional commits viewable in compare view

Updates @angular/platform-browser from 18.2.13 to 22.0.2

Release notes

Sourced from @​angular/platform-browser's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

http

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Description
	migration skip any target are not build or test

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

... (truncated)

Changelog

Sourced from @​angular/platform-browser's changelog.

22.0.2 (2026-06-17)

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

22.1.0-next.0 (2026-06-10)

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit	Type	Description
25c744c4d0	fix	support foreign components defined outside top-level scope

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#68674)

... (truncated)

Commits

• d9c38e5 docs: fix typos in source code comments
• a97d5ec build: update minimum supported Node.js versions
• 0d9a245 fix(core): sanitize meta selectors
• ad717df refactor(core): use the @Service decorator where possible.
• 5a7c1e6 feat(core): add ability to cache resources for SSR
• b8d3f36 feat(compiler-cli): add support for Node.js 26.0.0
• 4ad3a1f refactor(core): Don't throw when there are not async metadata
• 7f3f3d7 ci: remove remainings of saucelabs tests
• 9f479ae feat(core): Update Testability to use PendingTasks for stability indicator
• 0454d4c refactor(core): deprecate withIncrementalHydration
• Additional commits viewable in compare view

Updates @angular/platform-browser-dynamic from 18.2.13 to 22.0.2

Release notes

Sourced from @​angular/platform-browser-dynamic's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

http

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Description
	migration skip any target are not build or test

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl
	Limits date format string length
	prevent prototype pollution in formatDateTime
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	disallow i18n event attributes
	more robust logic to check if regex can be optimized
	sanitize href/xlink:href attributes of any element of the MathML namespace
	sanitize two-way properties

compiler-cli

Commit	Description
	bind switch exhaustive check expressions

core

... (truncated)

Changelog

Sourced from @​angular/platform-browser-dynamic's changelog.

22.0.2 (2026-06-17)

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

22.1.0-next.0 (2026-06-10)

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#69017)

compiler

Commit	Type	Description
25c744c4d0	fix	support foreign components defined outside top-level scope

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#68674)

... (truncated)

Commits

• a97d5ec build: update minimum supported Node.js versions
• b8d3f36 feat(compiler-cli): add support for Node.js 26.0.0
• 4ad3a1f refactor(core): Don't throw when there are not async metadata
• 7f3f3d7 ci: remove remainings of saucelabs tests
• d550bf7 build: update minimum supported Node.js versions
• d3f67f6 refactor(core): mark VERSION as @__PURE__ for better tree-shaking
• 26fed34 build: format md files
• c357650 refactor(core): Update tests for zoneless by default (#63668)
• 2fcafb6 build: rename defaults2.bzl to defaults.bzl (#63383)
• fa8d8b8 build: migrate all npm packages to use new rules_js based npm_package rule (#...
• Additional commits viewable in compare view

Updates @angular/router from 18.2.13 to 22.0.2

Release notes

Sourced from @​angular/router's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

http

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Description
	migration skip any target are not build or test

22.0.1

common

Commit	Description
	escape CSS string-terminating characters in escapeCssUrl