Last checked and updated on 10 Jun 2026
What Is New in AngularJS 1.7
AngularJS 1.7 is a significant release focused on stability, security, and paving the way for a smoother long-term support period. It introduces critical security patches, deprecates older practices, and adds a few targeted features for component development.
| Category | Key Updates |
|---|---|
| Security | New $sce debug mode, stricter contextual escaping defaults. |
| New Features | $onInit hook for component controllers, ngProp* directives. |
| Improvements & Bug Fixes | jqLite cleanup, $animate.css refactor, various directive fixes. |
| Deprecations | ngBindHtml, $compile.preAssignBindingsEnabled, $$RAF, $$AsyncCallback. |
| Breaking Changes | Removal of pre-assigned bindings for component controllers. |
What security enhancements were added?
The release tightens security around Strict Contextual Escaping (SCE). A new debug mode for $sce was added, which throws detailed errors when bindings violate security contexts in development. This makes it easier to catch unsafe practices early.
Additionally, the default behavior for ngBindHtml was changed to be more strict, leading to its deprecation. In practice, this pushes developers towards safer patterns like ngBind or custom sanitization, reducing XSS risks.
How does 1.7 improve component development?
AngularJS 1.7 formalizes the $onInit lifecycle hook for component controllers. This guarantees the hook is always available, resolving previous inconsistencies where it might be missing if the controllerAs syntax wasn't used.
The new ngProp* directives (e.g., ng-prop-my_var="expression") allow setting properties on DOM elements instead of attributes. This matters because properties often reflect the current state, while attributes are initial values--a common point of confusion in AngularJS.
What internal cleanups and fixes were made?
Significant refactoring was done on the $animate.css driver and jqLite's internal method handling. These are internal improvements that reduce code complexity and potential bugs in animation and DOM manipulation.
Several bug fixes address edge cases in directives like ngModel, ngSrc, and ngSrcset. For example, fixes ensure ngSrc correctly ignores empty strings and that select directives handle dynamic options more reliably.
What deprecated features should I migrate away from?
ngBindHtml is deprecated due to its insecure default behavior. Use the $sce service and explicit trust contexts or a library like angular-sanitize instead.
The $compile.preAssignBindingsEnabled flag and the pre-assigned bindings behavior for component controllers are removed. Bindings are now always available in $onInit, not the constructor. This aligns with best practices and avoids initialization race conditions.
Internal helpers $$RAF and $$AsyncCallback are also deprecated. Use standard APIs like requestAnimationFrame and $timeout/$interval.
FAQ
Is the $onInit hook now safe to use in all component controllers?
Yes. AngularJS 1.7 guarantees the $onInit hook is always defined on component controller instances, regardless of how the controller is invoked. You can rely on it for initialization logic.
Why was ngBindHtml deprecated and what should I use?
It was deprecated because it automatically trusts the value in certain contexts, which is a security risk. For binding HTML, explicitly use $sce.trustAsHtml() with ngBind or include the angular-sanitize module and use ng-bind-html with sanitization.
What's the practical impact of removing pre-assigned bindings?
Component controller constructors can no longer access bindings. You must move that logic into the $onInit hook. This change fixes a long-standing issue where bindings might be undefined if accessed too early.
When should I use the new ngProp* directives?
Use ngProp* when you need to set a DOM element's *property* (like .value or .checked), not its attribute. This is crucial for interacting with custom elements or native properties that don't map 1:1 with attributes.
Does the $sce debug mode affect production performance?
No. The debug mode is intended for development only. It provides better error messages to catch insecure bindings but should not be enabled in production as it adds overhead.