Angular 20 reaches the end of its long-term support on 28 November 2026. From that day the Angular team stops releasing security patches for version 20. Applications built on it keep running, but any vulnerability found in the framework after that date stays open unless the application moves to a supported version. The recommended target today is Angular 22, which is in active support until June 2027 and in long-term support until June 2028.

This article explains what end of support means in practice, how to check whether it affects you, how the upgrade from Angular 20 works, and why it is worth planning together with two dates that fall in the same weeks: the end of bug fixes for Symfony 6.4 and the end of security support for PHP 8.2.

The dates that matter (as of 29 October 2026)

• Angular 20: long-term support, security fixes until 28 November 2026
• Angular 21: long-term support, security fixes until June 2027
• Angular 22: active support, security fixes until June 2028
• Angular 19 and older: no longer supported
• Symfony 6.4 LTS: bug fixes end in November 2026, security fixes until November 2027
• Symfony 7.4 LTS: active support, security fixes until November 2029
• PHP 8.2: security fixes only, until 31 December 2026
• PHP 8.4: active support until 31 December 2026, security fixes until 31 December 2028
• PHP 8.5: active support, security fixes until 31 December 2029

Sources: Angular releases, Symfony 6.4, Symfony 7.4, PHP supported versions.

Angular supports each major version for about 24 months: 12 months of active support with regular updates, then 12 months of long-term support with critical and security fixes only. A new major version arrives roughly every six months, so an application that is not upgraded falls out of support about two years after its version was released.

What end of support means in practice

Nothing breaks on 29 November. The application loads, users log in, data flows. The change is in what happens next.

• Security issues stay open. When a vulnerability in Angular 20 is published after 28 November, there is no official patch. The only fix is to upgrade, usually under time pressure.
• Libraries move on. Component libraries, state management and testing tools drop support for old Angular versions. Each new library release you cannot install widens the gap.
• Questions from customers and auditors get harder. Security questionnaires, penetration test reports and enterprise procurement reviews routinely ask whether the software runs on supported versions. "No" is an answer that needs explaining.
• The upgrade gets more expensive with time. Moving one major version is routine work. Moving three or four at once, under pressure, is a project.

How to check whether it affects you

Open the application's package.json and look at the version of @angular/core, or run ng version in the project. If it starts with 20 or lower, the application is on a version that loses support on 28 November or has already lost it.

Do the same for the backend. In a Symfony project, composer.json shows the Symfony version and php -v on the server shows the PHP version. Symfony 6.4 or PHP 8.2 means the backend has its own deadline in the same window.

How the upgrade from Angular 20 works

Angular upgrades are done one major version at a time: 20 to 21, then 21 to 22. The official Angular update guide lists the steps for each pair of versions, and the Angular CLI applies most code changes automatically with ng update.

A typical sequence:

1. Inventory. List the Angular version, Node.js version, TypeScript version and every third-party Angular library with its version. Check that each library has a release supporting the target Angular version.
2. Upgrade to 21. Run ng update @angular/core@21 @angular/cli@21, then update libraries. Fix what the build and the tests report.
3. Test. Automated tests first, then a manual pass over the main user journeys. This is where test coverage pays for itself.
4. Upgrade to 22. Repeat the same steps for the next version.
5. Release in stages. Ship to a staging environment, then to production, with the previous version ready to restore.

Angular 21 changed several defaults for new projects: new applications no longer include zone.js, and the CLI uses Vitest as the default test runner. Existing applications are not forced to switch, but deprecated APIs were removed, so code that ignored deprecation warnings in version 20 will need changes.

What makes an upgrade take longer

• Third-party libraries that are late to support new Angular versions, or no longer maintained at all
• Skipped versions: an application on Angular 17 has to move through every major version to 22
• Low test coverage, which turns every upgrade step into a manual regression test
• Custom build configuration that departs from the Angular CLI defaults
• Code that relies on deprecated APIs the team never had time to replace

An application on Angular 20 with maintained libraries and reasonable tests is usually a short, predictable piece of work. An application several versions behind, with abandoned dependencies, needs an assessment first.

Plan Angular, Symfony and PHP together

Many business web applications pair an Angular frontend with a Symfony backend. In that setup the next few weeks bring three deadlines:

• Angular 20: security fixes end on 28 November 2026.
• Symfony 6.4: bug fixes end in November 2026; security fixes continue until November 2027. The next long-term version is Symfony 7.4, supported until November 2029.
• PHP 8.2: security fixes end on 31 December 2026. PHP 8.4 is supported until the end of 2028 and PHP 8.5 until the end of 2029.

Doing all three in one planned effort costs less than three separate projects: one inventory, one test cycle, one release window. Symfony 6.4 has more time on the security side, so the usual order is Angular first, then PHP before the end of December, then Symfony 7.4 in the first months of 2027.

If you cannot upgrade before 28 November

Missing the date is not a disaster, as long as it is a decision rather than an accident.

• Put a date on it. Agree when the upgrade will happen and who owns it.
• Reduce exposure. Keep dependencies and the server patched, review what the application exposes publicly, and monitor Angular security advisories.
• Consider extended support. Some third-party vendors sell commercial security patches for Angular versions after official support ends. It buys time; it does not replace the upgrade.

How we approach version upgrades at codelabs.rocks

We have built web applications in Angular and Symfony since 2018, and version upgrades are a regular part of maintaining them. We start with a short technical assessment: versions, dependencies, test coverage and the risky areas of the code. You get a written plan with the order of steps and the risks before any upgrade work begins. The upgrade itself runs in two-week sprints, with tests after each major version and a staged release.

We also take over applications built by other teams. If you are not sure what your application runs on or how far behind it is, the assessment answers that first.

Frequently asked questions

When does Angular 20 support end?

Angular 20 long-term support ends on 28 November 2026. After that date the Angular team releases no further security patches for version 20.

Will my Angular 20 application stop working after 28 November 2026?

No. It keeps running. It stops receiving security fixes, so new vulnerabilities in the framework will not be patched.

Which Angular version should I upgrade to?

Angular 22. It is in active support until June 2027 and long-term support until June 2028. Angular 21 is supported until June 2027.

Can I jump straight from Angular 20 to 22?

Angular upgrades go one major version at a time: 20 to 21, then 21 to 22. Both steps can be done in the same project.

Does Symfony 6.4 also lose support in November 2026?

Only bug fixes end in November 2026. Security fixes for Symfony 6.4 continue until November 2027. The next long-term version is Symfony 7.4.

When does PHP 8.2 support end?

PHP 8.2 receives security fixes until 31 December 2026.

If your application runs on Angular 20 or older, Symfony 6.4 or PHP 8.2, contact us and we will start with an assessment of what the upgrade involves.