Angular 8 Release Notes | HeroDevs Docs

Angular

v8.2.22 - April 9, 2026

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@8.2.14-angular-8.2.22
- @neverendingsupport/angular-common@8.2.14-angular-8.2.22
- @neverendingsupport/angular-compiler@8.2.14-angular-8.2.22
- @neverendingsupport/angular-compiler-cli@8.2.14-angular-8.2.22
- @neverendingsupport/angular-core@8.2.14-angular-8.2.22
- @neverendingsupport/angular-elements@8.2.14-angular-8.2.22
- @neverendingsupport/angular-forms@8.2.14-angular-8.2.22
- @neverendingsupport/angular-language-service@8.2.14-angular-8.2.22
- @neverendingsupport/angular-platform-browser@8.2.14-angular-8.2.22
- @neverendingsupport/angular-platform-browser-dynamic@8.2.14-angular-8.2.22
- @neverendingsupport/angular-platform-server@8.2.14-angular-8.2.22
- @neverendingsupport/angular-platform-webworker@8.2.14-angular-8.2.22
- @neverendingsupport/angular-platform-webworker-dynamic@8.2.14-angular-8.2.22
- @neverendingsupport/angular-router@8.2.14-angular-8.2.22
- @neverendingsupport/angular-service-worker@8.2.14-angular-8.2.22
- @neverendingsupport/angular-upgrade@8.2.14-angular-8.2.22
- @neverendingsupport/zone.js@0.9.1-angular-8.2.22

Security Fixes

core:
- Sanitize sensitive attributes on SVG script elements.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).
- Block creation of sensitive URI attributes from ICU messages.
  - This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-27970).

Breaking Changes

core

Block creation of sensitive URI attributes from ICU messages:
Translators can no longer introduce URI attributes—attribute values are blocked to avoid malicious links, and sanitization now relies on an allowlist of known attributes (still sanitizing URI ones). Translated ICU content keeps only recognized attributes and drops everything else.

v8.2.21 - December 19, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@8.2.14-angular-8.2.21
- @neverendingsupport/angular-common@8.2.14-angular-8.2.21
- @neverendingsupport/angular-compiler@8.2.14-angular-8.2.21
- @neverendingsupport/angular-compiler-cli@8.2.14-angular-8.2.21
- @neverendingsupport/angular-core@8.2.14-angular-8.2.21
- @neverendingsupport/angular-elements@8.2.14-angular-8.2.21
- @neverendingsupport/angular-forms@8.2.14-angular-8.2.21
- @neverendingsupport/angular-language-service@8.2.14-angular-8.2.21
- @neverendingsupport/angular-platform-browser@8.2.14-angular-8.2.21
- @neverendingsupport/angular-platform-browser-dynamic@8.2.14-angular-8.2.21
- @neverendingsupport/angular-platform-server@8.2.14-angular-8.2.21
- @neverendingsupport/angular-platform-webworker@8.2.14-angular-8.2.21
- @neverendingsupport/angular-platform-webworker-dynamic@8.2.14-angular-8.2.21
- @neverendingsupport/angular-router@8.2.14-angular-8.2.21
- @neverendingsupport/angular-service-worker@8.2.14-angular-8.2.21
- @neverendingsupport/angular-upgrade@8.2.14-angular-8.2.21
- @neverendingsupport/zone.js@0.9.1-angular-8.2.21

Security Fixes

compiler: Prevent stored XSS via SVG animation attributeName and MathML/SVG URLs.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).

v8.2.20 - December 4, 2025

Notes

Full package name(s) and version(s):
- @neverendingsupport/angular-animations@8.2.14-angular-8.2.20
- @neverendingsupport/angular-common@8.2.14-angular-8.2.20
- @neverendingsupport/angular-compiler@8.2.14-angular-8.2.20
- @neverendingsupport/angular-compiler-cli@8.2.14-angular-8.2.20
- @neverendingsupport/angular-core@8.2.14-angular-8.2.20
- @neverendingsupport/angular-elements@8.2.14-angular-8.2.20
- @neverendingsupport/angular-forms@8.2.14-angular-8.2.20
- @neverendingsupport/angular-language-service@8.2.14-angular-8.2.20
- @neverendingsupport/angular-platform-browser@8.2.14-angular-8.2.20
- @neverendingsupport/angular-platform-browser-dynamic@8.2.14-angular-8.2.20
- @neverendingsupport/angular-platform-server@8.2.14-angular-8.2.20
- @neverendingsupport/angular-platform-webworker@8.2.14-angular-8.2.20
- @neverendingsupport/angular-platform-webworker-dynamic@8.2.14-angular-8.2.20
- @neverendingsupport/angular-router@8.2.14-angular-8.2.20
- @neverendingsupport/angular-service-worker@8.2.14-angular-8.2.20
- @neverendingsupport/angular-upgrade@8.2.14-angular-8.2.20
- @neverendingsupport/zone.js@0.9.1-angular-8.2.20

Security Fixes

common: Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).

v8.2.19 - June 16, 2025

Notes

This release contains no functional changes from NES v8.2.18.
This release implements a new package naming scheme for the Angular packages. More information about the change can be found in the NES Decoupled Namespace Specification.
Full package name(s) and version(s):
- @neverendingsupport/angular-animations@8.2.14-angular-8.2.19
- @neverendingsupport/angular-common@8.2.14-angular-8.2.19
- @neverendingsupport/angular-compiler@8.2.14-angular-8.2.19
- @neverendingsupport/angular-compiler-cli@8.2.14-angular-8.2.19
- @neverendingsupport/angular-core@8.2.14-angular-8.2.19
- @neverendingsupport/angular-elements@8.2.14-angular-8.2.19
- @neverendingsupport/angular-forms@8.2.14-angular-8.2.19
- @neverendingsupport/angular-language-service@8.2.14-angular-8.2.19
- @neverendingsupport/angular-platform-browser@8.2.14-angular-8.2.19
- @neverendingsupport/angular-platform-browser-dynamic@8.2.14-angular-8.2.19
- @neverendingsupport/angular-platform-server@8.2.14-angular-8.2.19
- @neverendingsupport/angular-platform-webworker@8.2.14-angular-8.2.19
- @neverendingsupport/angular-platform-webworker-dynamic@8.2.14-angular-8.2.19
- @neverendingsupport/angular-router@8.2.14-angular-8.2.19
- @neverendingsupport/angular-service-worker@8.2.14-angular-8.2.19
- @neverendingsupport/angular-upgrade@8.2.14-angular-8.2.19
- @neverendingsupport/zone.js@0.9.1-angular-8.2.19

v8.2.18 - February 3, 2025

Notes

This release adds the following packages: elements, language-service
This release contains metadata fixes and improvements: Updated licensing information.
Full Version: 8.2.14-{PACKAGE_NAME}-8.2.18

v8.2.17 - January 31, 2025

Notes

This release contains no functional changes from NES v8.2.16.
This release contains only metadata fixes and improvements: Updated peer dependency versions.
Full Version: 8.2.14-{PACKAGE_NAME}-8.2.17

v8.2.16 - January 13, 2025

Notes

This release contains no functional changes from NES v8.2.15.
This release contains only metadata fixes and improvements: Updated peer dependency versions.
Full Version: 8.2.16-{PACKAGE_NAME}

v8.2.15 - February 8, 2024

Notes

Full Version: 8.2.15-{PACKAGE_NAME}

Security Fixes

common: Use ContentType: application/json (instead of text/plain) for boolean values with HttpClient request body.
core:
- Ensure sanitizer works if DOMParser returns null body.
- Fix possible XSS vulnerability in development through SSR.
  - This fixes a low-severity Cross-Site Scripting (XSS) vulnerability (CVE-2021-4231).
platform-browser: Prevent memory leak of style nodes if shadow DOM encapsulation is used.

Angular CLI

8.3.34 (NES) - September 2025

Notes

Full package names and versions
- @neverendingsupport/angular-cli@8.3.29-angular-cli-8.3.34
- @neverendingsupport/angular-pwa@0.803.29-angular-cli-8.3.34
- @neverendingsupport/angular-devkit-architect@0.803.29-angular-cli-8.3.34
- @neverendingsupport/angular-devkit-architect-cli@0.803.29-angular-cli-8.3.34
- @neverendingsupport/angular-devkit-build-angular@0.803.29-angular-cli-8.3.34
- @neverendingsupport/angular-devkit-build-ng-packagr@0.803.29-angular-cli-8.3.34
- @neverendingsupport/angular-devkit-build-optimizer@0.803.29-angular-cli-8.3.34
- @neverendingsupport/angular-devkit-build-webpack@0.803.29-angular-cli-8.3.34
- @neverendingsupport/angular-devkit-core@8.3.29-angular-cli-8.3.34
- @neverendingsupport/angular-devkit-schematics@8.3.29-angular-cli-8.3.34
- @neverendingsupport/angular-devkit-schematics-cli@0.803.29-angular-cli-8.3.34
- @neverendingsupport/ngtools-webpack@8.3.29-angular-cli-8.3.34

Bug Fixes

Fixed build issues: updated peer dependency version numbers

8.3.33 (NES) - June 5, 2025

Notes

This release contains no functional changes from 8.3.32.
Full package names and versions
- @neverendingsupport/angular-cli@8.3.29-angular-cli-8.3.33
- @neverendingsupport/angular-pwa@0.803.29-angular-cli-8.3.33
- @neverendingsupport/angular-devkit-architect@0.803.29-angular-cli-8.3.33
- @neverendingsupport/angular-devkit-architect-cli@0.803.29-angular-cli-8.3.33
- @neverendingsupport/angular-devkit-build-angular@0.803.29-angular-cli-8.3.33
- @neverendingsupport/angular-devkit-build-ng-packagr@0.803.29-angular-cli-8.3.33
- @neverendingsupport/angular-devkit-build-optimizer@0.803.29-angular-cli-8.3.33
- @neverendingsupport/angular-devkit-build-webpack@0.803.29-angular-cli-8.3.33
- @neverendingsupport/angular-devkit-core@8.3.29-angular-cli-8.3.33
- @neverendingsupport/angular-devkit-schematics@8.3.29-angular-cli-8.3.33
- @neverendingsupport/angular-devkit-schematics-cli@0.803.29-angular-cli-8.3.33
- @neverendingsupport/ngtools-webpack@8.3.29-angular-cli-8.3.33