diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5b897a2218c3..bf9e2eae4a49 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,16 @@
+
+
+# 20.3.17 (2026-02-23)
+
+### @angular/ssr
+
+| Commit | Type | Description |
+| --------------------------------------------------------------------------------------------------- | ---- | --------------------------------------------------- |
+| [8700e18d7](https://github.com/angular/angular-cli/commit/8700e18d7cf175d80fe6ce6205589767b7870c1c) | fix | prevent open redirect via X-Forwarded-Prefix header |
+| [67582a946](https://github.com/angular/angular-cli/commit/67582a946808d2c021cbcfacbf203ef58a6fbded) | fix | validate host headers to prevent header-based SSRF |
+
+
+
# 19.2.21 (2026-02-23)
@@ -2420,7 +2433,6 @@
- Protractor is no longer supported.
Protractor was marked end-of-life in August 2023 (see https://protractortest.org/). Projects still relying on Protractor should consider migrating to another E2E testing framework, several support solid migration paths from Protractor.
-
- https://angular.dev/tools/cli/end-to-end
- https://blog.angular.dev/the-state-of-end-to-end-testing-with-angular-d175f751cb9c
@@ -6055,7 +6067,6 @@ Alan Agius, Charles Lyding and Doug Parker
### @angular/cli
- Several changes to the `ng analytics` command syntax.
-
- `ng analytics project ` has been replaced with `ng analytics `
- `ng analytics ` has been replaced with `ng analytics --global`
@@ -6085,7 +6096,6 @@ Alan Agius, Charles Lyding and Doug Parker
- `browser` and `karma` builders `script` and `styles` options input files extensions are now validated.
Valid extensions for `scripts` are:
-
- `.js`
- `.cjs`
- `.mjs`
@@ -6094,7 +6104,6 @@ Alan Agius, Charles Lyding and Doug Parker
- `.mjsx`
Valid extensions for `styles` are:
-
- `.css`
- `.less`
- `.sass`