fix(security): align SVG, i18n, and host-binding sinks with Angular v22 - #334

Merged

Brooooooklyn merged 15 commits into

mainfrom

fix/issue-315-security-contexts

Sep 22, 2026

Commits on Sep 22, 2026

fix(security): align sanitizer sinks with Angular v22
Brooooooklyn
committed
d80213b
fix(security): keep pre-v22 sanitizer schema by Angular version
Brooooooklyn
committed
d999394
fix(security): keep namespace prefixes on sink and script checks
Brooooooklyn
committed
a55970e
fix(security): check selectorless i18n sinks on the host tag
Brooooooklyn
committed
b25c640
fix(security): inherit svg and math namespaces on selectorless hosts
Brooooooklyn
committed
933649f
fix(security): derive binding contexts from the selectorless host tag
Brooooooklyn
committed
d6bf367
fix(security): derive child namespaces from the selectorless host tag
Brooooooklyn
committed
8fab161
fix(security): gate schemas per backported release line
Brooooooklyn
committed
ee63c9e
fix(security): inherit arbitrary prefixes like upstream _getPrefix
Brooooooklyn
committed
0324bb1
fix(security): keep bare selectorless hosts on pre-v22 schemas
Brooooooklyn
committed
3a4b2a6
fix(security): route Angular 19.2.x through the backported schemas
Brooooooklyn
committed
82c7bea
fix(security): emit validateIframeAttribute on legacy targets
Brooooooklyn
committed
f5150f3
fix(security): normalize tag names only where upstream does
Brooooooklyn
committed
da571ca
fix(security): version-gate Trusted Types sinks in standalone i18n
Brooooooklyn
committed
6290207
fix(security): treat `*` selectors as element-less like upstream
Brooooooklyn
committed
f103a7f