Angular Q&A Highlights Signal Forms

The December installment of the Angular Q&A brought together Mark Thompson, Jeremy Elbourn, and Kirill Cherkashin from the Angular team. Signal Forms dominated the conversation.

Signal Forms made their debut in v21 under the experimental flag. Cherkashin anticipates minimal changes moving forward, noting that feedback has largely centered on edge-case scenarios.

Cherkashin revealed that Signal Forms are already in production within Google's internal applications. He emphasized that because of their experimental status, not every edge case has been addressed yet, and the team retains the flexibility to introduce breaking changes.

The Q&A also touched on advanced DateTimePicker features for Angular Material. Elbourn explained that locale-related complications mean such features are on hold until the Temporal API makes it into browsers.

Selectorless components came up as well. This feature would let templates reference components by class name rather than selector.
Right now, the initiative has been deprioritized in favor of the team's ongoing AI efforts.

Angular Air Dives Into Signal Forms

The Angular Air podcast also dedicated a lengthy session to Signal Forms. Sander Elias walked through a particularly intricate form example—a true "kitchen-sink" scenario—and shared the source code for it.

Exploring @angular/aria on Angular Air

Angular Air welcomed Wagner Maciel, the Angular team member responsible for @angular/aria. This library also shipped with Angular 21.

Maciel described the purpose of @angular/aria in these terms:

@angular/aria is a set of headless - meaning like completely unstyled - accessibility primitives. There's a role combobox, there's a role menu, a role grid... We want to take the responsibility of implementing the accessibility behind those rules.

A notable aspect is that @angular/aria works even outside the Angular ecosystem, as long as the consuming framework has Signal support. Currently, it's only used within Google's internal Wiz framework.

The integration strategy is clear: existing Angular Material components won't be rebuilt on @angular/aria. Instead, it’s likely that new Angular Material components will leverage it as their foundation.

PrimeNg 21 Arrives

PrimeNG has also issued its Angular 21-compatible release. This isn't merely a dependency bump; the changelog lists substantial additions:

  • zoneless support is included,
  • there's now a straightforward mechanism to pass attributes like aria-* or data-* down to the underlying DOM element, and
  • a suite of unstyled components has been introduced, drawing a parallel to what Angular CDK provides.

Earlier in the year, a separate PrimeNgx edition was on the roadmap. That plan has been abandoned, and development efforts are now consolidated entirely within PrimeNg.

primeng.org
FOREM_LTAG_END:{"tag":"open_graph","url":"https://primeng.org/migration/v21","options":"https://primeng.org/migration/v21"}

https://www.reddit.com/r/Angular2/comments/1pdxkom/primeng_v21_has_landed_with_aiready_docs_pt

Security Advisories

Two security vulnerabilities were also announced, both of which have already received fixes.

XSRF Token Leak Scenario

The HttpClient has a built-in safeguard: when you make a fetch, it verifies whether the target is the same origin serving the application. For relative URLs, this process injects an XSRF token into the header, ensuring the request originated from the user.

The reported flaw involved protocol-relative URLs (those starting with //). These were mistakenly classified as internal relative URLs, leading to a token leak. Patches have been rolled out for Angular versions 19, 20, and 21.

https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37

XSS Vulnerability via Templates

A separate issue was identified in the Angular template engine. Certain SVG attributes slipped through the sanitization checks, creating a vector for attackers to inject malicious JavaScript code.
This problem has also been rectified across all actively supported versions—19, 20, and 21.

https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49