Visit Angular NES Home Page
Angular 16
Release Notes
Angular
16.2.20 (NES) - January 22, 2026
Notes
- Full package names and versions:
@neverendingsupport/angular-animations@16.2.12-angular-16.2.20@neverendingsupport/angular-common@16.2.12-angular-16.2.20@neverendingsupport/angular-compiler@16.2.12-angular-16.2.20@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.20@neverendingsupport/angular-core@16.2.12-angular-16.2.20@neverendingsupport/angular-elements@16.2.12-angular-16.2.20@neverendingsupport/angular-forms@16.2.12-angular-16.2.20@neverendingsupport/angular-language-service@16.2.12-angular-16.2.20@neverendingsupport/angular-localize@16.2.12-angular-16.2.20@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.20@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.20@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.20@neverendingsupport/angular-router@16.2.12-angular-16.2.20@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.20@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.20
Security Fixes
- core: Sanitize sensitive attributes on SVG script elements.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-22610).
16.2.19 (NES) - December, 2025
Notes
- Full package names and versions:
@neverendingsupport/angular-animations@16.2.12-angular-16.2.19@neverendingsupport/angular-common@16.2.12-angular-16.2.19@neverendingsupport/angular-compiler@16.2.12-angular-16.2.19@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.19@neverendingsupport/angular-core@16.2.12-angular-16.2.19@neverendingsupport/angular-elements@16.2.12-angular-16.2.19@neverendingsupport/angular-forms@16.2.12-angular-16.2.19@neverendingsupport/angular-language-service@16.2.12-angular-16.2.19@neverendingsupport/angular-localize@16.2.12-angular-16.2.19@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.19@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.19@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.19@neverendingsupport/angular-router@16.2.12-angular-16.2.19@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.19@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.19
Security Fixes
- Fixed stored XSS vulnerability involving SVG Animation, SVG URL and MathML Attributes.
- This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-66412).
16.2.18 (NES) - December, 2025
Notes
- Full package names and versions:
@neverendingsupport/angular-animations@16.2.12-angular-16.2.18@neverendingsupport/angular-common@16.2.12-angular-16.2.18@neverendingsupport/angular-compiler@16.2.12-angular-16.2.18@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.18@neverendingsupport/angular-core@16.2.12-angular-16.2.18@neverendingsupport/angular-elements@16.2.12-angular-16.2.18@neverendingsupport/angular-forms@16.2.12-angular-16.2.18@neverendingsupport/angular-language-service@16.2.12-angular-16.2.18@neverendingsupport/angular-localize@16.2.12-angular-16.2.18@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.18@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.18@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.18@neverendingsupport/angular-router@16.2.12-angular-16.2.18@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.18@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.18
Security Fixes
- common/http: Prevent Cross-Site Request Forgery (XSRF) token leakage to protocol-relative URLs.
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-66035).
16.2.17 (NES) - October, 2025
Notes
- Full package names and versions:
@neverendingsupport/angular-animations@16.2.12-angular-16.2.17@neverendingsupport/angular-common@16.2.12-angular-16.2.17@neverendingsupport/angular-compiler@16.2.12-angular-16.2.17@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.17@neverendingsupport/angular-core@16.2.12-angular-16.2.17@neverendingsupport/angular-elements@16.2.12-angular-16.2.17@neverendingsupport/angular-forms@16.2.12-angular-16.2.17@neverendingsupport/angular-language-service@16.2.12-angular-16.2.17@neverendingsupport/angular-localize@16.2.12-angular-16.2.17@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.17@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.17@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.17@neverendingsupport/angular-router@16.2.12-angular-16.2.17@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.17@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.17
Security Fixes
- core: Introduce BootstrapContext for improved server bootstrapping
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-59052).
Breaking Changes
core
- The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
Before:const bootstrap = () => bootstrapApplication(AppComponent, config);
After:const bootstrap = (context: BootstrapContext) => bootstrapApplication(AppComponent, config, context);
In addition,getPlatform()anddestroyPlatform()will now returnnulland be a no-op respectively when running in a server environment.
16.2.16 (NES) - June 17, 2025
Notes
- This release contains no functional changes from NES v16.2.15.
- Full package names and versions:
@neverendingsupport/angular-animations@16.2.12-angular-16.2.16@neverendingsupport/angular-common@16.2.12-angular-16.2.16@neverendingsupport/angular-compiler@16.2.12-angular-16.2.16@neverendingsupport/angular-compiler-cli@16.2.12-angular-16.2.16@neverendingsupport/angular-core@16.2.12-angular-16.2.16@neverendingsupport/angular-elements@16.2.12-angular-16.2.16@neverendingsupport/angular-forms@16.2.12-angular-16.2.16@neverendingsupport/angular-language-service@16.2.12-angular-16.2.16@neverendingsupport/angular-localize@16.2.12-angular-16.2.16@neverendingsupport/angular-platform-browser@16.2.12-angular-16.2.16@neverendingsupport/angular-platform-browser-dynamic@16.2.12-angular-16.2.16@neverendingsupport/angular-platform-server@16.2.12-angular-16.2.16@neverendingsupport/angular-router@16.2.12-angular-16.2.16@neverendingsupport/angular-service-worker@16.2.12-angular-16.2.16@neverendingsupport/angular-upgrade@16.2.12-angular-16.2.16
16.2.15 (NES)
Notes
- Added HeroDevs NES License to each package.
- Full Version:
16.2.12-{PACKAGE_NAME}-16.2.15
16.2.14 (NES)
Notes
- This release contains only internal updates including adaption of the NES version formatting which will be OSSVersion-package-NESVersion.
- Full Version:
16.2.12-{PACKAGE_NAME}-16.2.14
16.2.12 (NES)
Notes
- This is the initial release of Angular 16. It contains no functional changes from OSS v16.2.2.
- Full Version:
16.2.12-{PACKAGE_NAME}
Angular CLI
16.2.19 (NES) - September, 2025
Notes
- Full package names and versions:
@neverendingsupport/angular-cli@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-create@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-pwa@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-architect@0.1602.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-architect-cli@0.1602.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-build-angular@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-build-webpack@0.1602.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-core@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-schematics@16.2.16-angular-cli-16.2.19@neverendingsupport/angular-devkit-schematics-cli@16.2.16-angular-cli-16.2.19@neverendingsupport/ngtools-webpack@16.2.16-angular-cli-16.2.19
Bug Fixes
- Fixed build issues: updated peer dependency version numbers
16.2.18 (NES) - June 5, 2025
Notes
- This release contains no functional changes from NES v16.2.17.
- Full package names and versions:
@neverendingsupport/angular-cli@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-create@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-pwa@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-architect@0.1602.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-architect-cli@0.1602.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-build-angular@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-build-webpack@0.1602.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-core@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-schematics@16.2.16-angular-cli-16.2.18@neverendingsupport/angular-devkit-schematics-cli@16.2.16-angular-cli-16.2.18@neverendingsupport/ngtools-webpack@16.2.16-angular-cli-16.2.18
16.2.17 (NES) - February 25, 2025
Notes
- This is the initial release of the NES Angular CLI 16.2.x series.
Angular Universal
16.2.1 (NES) - October, 2025
Notes
- This is the initial release of NES for Angular Universal based on the OSS universal v16.2.0.
- Full package names and versions:
@neverendingsupport/nguniversal-builders@16.2.0-universal-16.2.1@neverendingsupport/nguniversal-common@16.2.0-universal-16.2.1@neverendingsupport/nguniversal-express-engine@16.2.0-universal-16.2.1
Breaking Changes
- The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
- This fixes a high-severity Information Exposure vulnerability (CVE-2025-59052).
Before:const bootstrap = () => bootstrapApplication(AppComponent, config);
After:const bootstrap = (context: BootstrapContext) => bootstrapApplication(AppComponent, config, context);