AIKIDO-2026-10828

TL;DR

Template type checking against the DOM schema did not consistently reject dangerous event-property bindings such as onclick on plain elements. The schema checker now validates property names through the registry first and surfaces diagnostics instead of letting those bindings compile. That blocks template-level paths that reuse user-influenceable values on on-prefixed DOM properties outside of Angular’s event binding syntax.