@angular/build 19.1.7 → 19.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@angular/build",
-  "version": "19.1.7",
+  "version": "19.1.9",
   "description": "Official build system for Angular",
   "keywords": [
     "Angular CLI",
@@ -23,8 +23,8 @@
   "builders": "builders.json",
   "dependencies": {
     "@ampproject/remapping": "2.3.0",
-    "@angular-devkit/core": "19.1.7",
-    "@angular-devkit/architect": "0.1901.7",
+    "@angular-devkit/core": "19.1.9",
+    "@angular-devkit/architect": "0.1901.9",
     "@babel/core": "7.26.0",
     "@babel/helper-annotate-as-pure": "7.25.9",
     "@babel/helper-split-export-declaration": "7.24.7",
@@ -58,7 +58,7 @@
     "@angular/localize": "^19.0.0",
     "@angular/platform-server": "^19.0.0",
     "@angular/service-worker": "^19.0.0",
-    "@angular/ssr": "^19.1.7",
+    "@angular/ssr": "^19.1.9",
     "less": "^4.2.0",
     "ng-packagr": "^19.0.0",
     "postcss": "^8.4.0",

package/src/builders/application/execute-build.js

@@ -190,10 +190,6 @@ async function executeBuild(options, context, rebuildState) {
     if (serverEntryPoint) {
         executionResult.addOutputFile(manifest_1.SERVER_APP_ENGINE_MANIFEST_FILENAME, (0, manifest_1.generateAngularServerAppEngineManifest)(i18nOptions, baseHref), bundler_context_1.BuildOutputFileType.ServerRoot);
     }
-    // Override auto-CSP settings if we are serving through Vite middleware.
-    if (context.builder.builderName === 'dev-server' && options.security) {
-        options.security.autoCsp = false;
-    }
     // Perform i18n translation inlining if enabled
     if (i18nOptions.shouldInline) {
         const result = await (0, i18n_1.inlineI18n)(metafile, options, executionResult, initialFiles);

package/src/builders/application/options.d.ts

@@ -196,7 +196,11 @@ export declare function normalizeOptions(context: BuilderContext, projectName: s
     partialSSRBuild: boolean;
     externalRuntimeStyles: boolean | undefined;
     instrumentForCoverage: ((filename: string) => boolean) | undefined;
-    security: import("./schema").Security | undefined;
+    security: {
+        autoCsp: {
+            unsafeEval: boolean;
+        } | undefined;
+    };
     templateUpdates: boolean;
     incrementalResults: boolean;
 }>;

package/src/builders/application/options.js

@@ -236,8 +236,16 @@ async function normalizeOptions(context, projectName, options, extensions) {
             throw new Error('The "index" option cannot be set to false when enabling "ssr", "prerender" or "app-shell".');
         }
     }
+    const autoCsp = options.security?.autoCsp;
+    const security = {
+        autoCsp: autoCsp
+            ? {
+                unsafeEval: autoCsp === true ? false : !!autoCsp.unsafeEval,
+            }
+            : undefined,
+    };
     // Initial options to keep
-    const { allowedCommonJsDependencies, aot = true, baseHref, crossOrigin, externalDependencies, extractLicenses, inlineStyleLanguage = 'css', outExtension, serviceWorker, poll, polyfills, statsJson, outputMode, stylePreprocessorOptions, subresourceIntegrity, verbose, watch, progress = true, externalPackages, namedChunks, budgets, deployUrl, clearScreen, define, partialSSRBuild = false, externalRuntimeStyles, instrumentForCoverage, security, } = options;
+    const { allowedCommonJsDependencies, aot = true, baseHref, crossOrigin, externalDependencies, extractLicenses, inlineStyleLanguage = 'css', outExtension, serviceWorker, poll, polyfills, statsJson, outputMode, stylePreprocessorOptions, subresourceIntegrity, verbose, watch, progress = true, externalPackages, namedChunks, budgets, deployUrl, clearScreen, define, partialSSRBuild = false, externalRuntimeStyles, instrumentForCoverage, } = options;
     // Return all the normalized options
     return {
         advancedOptimizations: !!aot && optimizationOptions.scripts,

package/src/builders/dev-server/vite-server.js

@@ -82,6 +82,17 @@ async function* serveWithVite(serverOptions, builderName, builderAction, context
         browserOptions.prerender = undefined;
         browserOptions.ssr ||= true;
     }
+    // Disable auto CSP.
+    browserOptions.security = {
+        autoCsp: false,
+    };
+    // Disable JSON build stats.
+    // These are not accessible with the dev server and can cause HMR fallbacks.
+    if (browserOptions.statsJson === true) {
+        context.logger.warn('Build JSON statistics output (`statsJson` option) has been disabled.' +
+            ' The development server does not support this option.');
+    }
+    browserOptions.statsJson = false;
     // Set all packages as external to support Vite's prebundle caching
     browserOptions.externalPackages = serverOptions.prebundle;
     // Disable generating a full manifest with routes.

package/src/tools/esbuild/angular/compiler-plugin.js

@@ -402,7 +402,7 @@ function createCompilerPlugin(pluginOptions, compilationOrFactory, stylesheetBun
                     const replacement = pluginOptions.fileReplacements?.[path.normalize(args.path)];
                     if (replacement) {
                         return {
-                            contents: await Promise.resolve().then(() => __importStar(require('fs/promises'))).then(({ readFile }) => readFile(path.normalize(replacement))),
+                            contents: await Promise.resolve().then(() => __importStar(require('node:fs/promises'))).then(({ readFile }) => readFile(path.normalize(replacement))),
                             loader: 'json',
                             watchFiles: [replacement],
                         };

package/src/tools/esbuild/index-html-generator.js

@@ -59,13 +59,6 @@ async function generateIndexHtml(initialFiles, outputFiles, buildOptions, lang)
         }
         throw new Error(`Output file does not exist: ${relativefilePath}`);
     };
-    // Read the Auto CSP options.
-    const autoCsp = buildOptions.security?.autoCsp;
-    const autoCspOptions = autoCsp === true
-        ? { unsafeEval: false }
-        : autoCsp
-            ? { unsafeEval: !!autoCsp.unsafeEval }
-            : undefined;
     // Create an index HTML generator that reads from the in-memory output files
     const indexHtmlGenerator = new index_html_generator_1.IndexHtmlGenerator({
         indexPath: indexHtmlOptions.input,
@@ -78,7 +71,7 @@ async function generateIndexHtml(initialFiles, outputFiles, buildOptions, lang)
         generateDedicatedSSRContent: !!(buildOptions.ssrOptions ||
             buildOptions.prerenderOptions ||
             buildOptions.appShellOptions),
-        autoCsp: autoCspOptions,
+        autoCsp: buildOptions.security.autoCsp,
     });
     indexHtmlGenerator.readAsset = readAsset;
     return indexHtmlGenerator.process({

package/src/tools/vite/middlewares/html-fallback-middleware.js

@@ -20,7 +20,8 @@ function angularHtmlFallbackMiddleware(req, _res, next) {
     }
     if (req.url) {
         const mimeType = (0, utils_1.lookupMimeTypeFromRequest)(req.url);
-        if (mimeType === 'text/html' || mimeType === 'application/xhtml+xml') {
+        if ((mimeType === 'text/html' || mimeType === 'application/xhtml+xml') &&
+            !/^\/index\.(?:csr\.)?html/.test(req.url)) {
             // eslint-disable-next-line no-console
             console.warn(`Request for HTML file "${req.url}" was received but no asset found. Asset may be missing from build.`);
         }

package/src/utils/error.js

@@ -11,10 +11,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assertIsError = assertIsError;
-const assert_1 = __importDefault(require("assert"));
+const node_assert_1 = __importDefault(require("node:assert"));
 function assertIsError(value) {
     const isError = value instanceof Error ||
         // The following is needing to identify errors coming from RxJs.
         (typeof value === 'object' && value && 'name' in value && 'message' in value);
-    (0, assert_1.default)(isError, 'catch clause variable is not an Error instance');
+    (0, node_assert_1.default)(isError, 'catch clause variable is not an Error instance');
 }

package/src/utils/index-file/auto-csp.js

@@ -112,7 +112,7 @@ async function autoCsp(html, unsafeEval = false) {
         rewriter.emitRaw(`<script>${loaderScript}</script>`);
         scriptContent = [];
     }
-    rewriter.on('startTag', (tag, html) => {
+    rewriter.on('startTag', (tag) => {
         if (tag.tagName === 'script') {
             openedScriptTag = tag;
             const src = getScriptAttributeValue(tag, 'src');

package/src/utils/index-file/index-html-generator.js

@@ -32,7 +32,7 @@ class IndexHtmlGenerator {
         this.plugins = [augmentIndexHtmlPlugin(this), ...extraCommonPlugins, postTransformPlugin(this)];
         // CSR plugins
         if (options?.optimization?.styles?.inlineCritical) {
-            this.csrPlugins.push(inlineCriticalCssPlugin(this));
+            this.csrPlugins.push(inlineCriticalCssPlugin(this, !!options.autoCsp));
         }
         this.csrPlugins.push(addNoncePlugin());
         // SSR plugins
@@ -127,11 +127,12 @@ function inlineFontsPlugin({ options }) {
     });
     return async (html) => inlineFontsProcessor.process(html);
 }
-function inlineCriticalCssPlugin(generator) {
+function inlineCriticalCssPlugin(generator, autoCsp) {
     const inlineCriticalCssProcessor = new inline_critical_css_1.InlineCriticalCssProcessor({
         minify: generator.options.optimization?.styles.minify,
         deployUrl: generator.options.deployUrl,
         readAsset: (filePath) => generator.readAsset(filePath),
+        autoCsp,
     });
     return async (html, options) => inlineCriticalCssProcessor.process(html, { outputPath: options.outputPath });
 }

package/src/utils/index-file/inline-critical-css.d.ts

@@ -12,6 +12,7 @@ export interface InlineCriticalCssProcessorOptions {
     minify?: boolean;
     deployUrl?: string;
     readAsset?: (path: string) => Promise<string>;
+    autoCsp?: boolean;
 }
 export declare class InlineCriticalCssProcessor {
     protected readonly options: InlineCriticalCssProcessorOptions;

package/src/utils/index-file/inline-critical-css.js

@@ -113,7 +113,7 @@ class BeastiesExtended extends BeastiesBase {
         }
         const returnValue = await super.embedLinkedStylesheet(link, document);
         const cspNonce = this.findCspNonce(document);
-        if (cspNonce) {
+        if (cspNonce || this.optionsExtended.autoCsp) {
             const beastiesMedia = link.getAttribute('onload')?.match(MEDIA_SET_HANDLER_PATTERN);
             if (beastiesMedia) {
                 // If there's a Beasties-generated `onload` handler and the file has an Angular CSP nonce,
@@ -128,11 +128,13 @@ class BeastiesExtended extends BeastiesBase {
             // a way of doing that at the moment so we fall back to doing it any time a `link` tag is
             // inserted. We mitigate it by only iterating the direct children of the `<head>` which
             // should be pretty shallow.
-            document.head.children.forEach((child) => {
-                if (child.tagName === 'style' && !child.hasAttribute('nonce')) {
-                    child.setAttribute('nonce', cspNonce);
-                }
-            });
+            if (cspNonce) {
+                document.head.children.forEach((child) => {
+                    if (child.tagName === 'style' && !child.hasAttribute('nonce')) {
+                        child.setAttribute('nonce', cspNonce);
+                    }
+                });
+            }
         }
         return returnValue;
     }
@@ -159,8 +161,10 @@ class BeastiesExtended extends BeastiesBase {
             return;
         }
         const script = document.createElement('script');
-        script.setAttribute('nonce', nonce);
         script.textContent = LINK_LOAD_SCRIPT_CONTENT;
+        if (nonce) {
+            script.setAttribute('nonce', nonce);
+        }
         // Prepend the script to the head since it needs to
         // run as early as possible, before the `link` tags.
         document.head.insertBefore(script, link);

package/src/utils/load-translations.js

@@ -41,8 +41,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createTranslationLoader = createTranslationLoader;
-const crypto_1 = require("crypto");
-const fs = __importStar(require("fs"));
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
 const load_esm_1 = require("./load-esm");
 async function createTranslationLoader() {
     const { parsers, diagnostics } = await importParsers();
@@ -55,7 +55,7 @@ async function createTranslationLoader() {
                 // Types don't overlap here so we need to use any.
                 // eslint-disable-next-line @typescript-eslint/no-explicit-any
                 const { locale, translations } = parser.parse(path, content, analysis.hint);
-                const integrity = 'sha256-' + (0, crypto_1.createHash)('sha256').update(content).digest('base64');
+                const integrity = 'sha256-' + (0, node_crypto_1.createHash)('sha256').update(content).digest('base64');
                 return { format, locale, translations, diagnostics, integrity };
             }
             else {

package/src/utils/normalize-asset-patterns.js

@@ -45,9 +45,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MissingAssetSourceRootException = void 0;
 exports.normalizeAssetPatterns = normalizeAssetPatterns;
-const fs_1 = require("fs");
 const node_assert_1 = __importDefault(require("node:assert"));
-const path = __importStar(require("path"));
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
 class MissingAssetSourceRootException extends Error {
     constructor(path) {
         super(`The ${path} asset path must start with the project source root.`);
@@ -73,7 +73,7 @@ function normalizeAssetPatterns(assetPatterns, workspaceRoot, projectRoot, proje
             let glob, input;
             let isDirectory = false;
             try {
-                isDirectory = (0, fs_1.statSync)(resolvedAssetPath).isDirectory();
+                isDirectory = (0, node_fs_1.statSync)(resolvedAssetPath).isDirectory();
             }
             catch {
                 isDirectory = true;

package/src/utils/normalize-cache.js

@@ -10,7 +10,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeCacheOptions = normalizeCacheOptions;
 const node_path_1 = require("node:path");
 /** Version placeholder is replaced during the build process with actual package version */
-const VERSION = '19.1.7';
+const VERSION = '19.1.9';
 function hasCacheMetadata(value) {
     return (!!value &&
         typeof value === 'object' &&

package/src/utils/server-rendering/esm-in-memory-loader/loader-hooks.js

@@ -17,7 +17,6 @@ const node_assert_1 = __importDefault(require("node:assert"));
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
 const node_url_1 = require("node:url");
-const url_1 = require("url");
 const javascript_transformer_1 = require("../../../tools/esbuild/javascript-transformer");
 /**
  * @note For some unknown reason, setting `globalThis.ngServerMode = true` does not work when using ESM loader hooks.
@@ -110,7 +109,7 @@ async function load(url, context, nextLoad) {
     // Only module files potentially require transformation. Angular libraries that would
     // need linking are ESM only.
     if (format === 'module' && isFileProtocol(url)) {
-        const filePath = (0, url_1.fileURLToPath)(url);
+        const filePath = (0, node_url_1.fileURLToPath)(url);
         let source = await javascriptTransformer.transformFile(filePath);
         if (filePath.includes('@angular/')) {
             // Prepend 'var ngServerMode=true;' to the source.

package/src/utils/server-rendering/render-worker.js

@@ -7,14 +7,14 @@
  * found in the LICENSE file at https://angular.dev/license
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-const worker_threads_1 = require("worker_threads");
+const node_worker_threads_1 = require("node:worker_threads");
 const fetch_patch_1 = require("./fetch-patch");
 const launch_server_1 = require("./launch-server");
 const load_esm_from_memory_1 = require("./load-esm-from-memory");
 /**
  * This is passed as workerData when setting up the worker via the `piscina` package.
  */
-const { outputMode, hasSsrEntry } = worker_threads_1.workerData;
+const { outputMode, hasSsrEntry } = node_worker_threads_1.workerData;
 let serverURL = launch_server_1.DEFAULT_URL;
 /**
  * Renders each route in routes and writes them to <outputPath>/<route>/index.html.

package/src/utils/server-rendering/routes-extractor-worker.js

@@ -7,7 +7,7 @@
  * found in the LICENSE file at https://angular.dev/license
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-const worker_threads_1 = require("worker_threads");
+const node_worker_threads_1 = require("node:worker_threads");
 const schema_1 = require("../../builders/application/schema");
 const fetch_patch_1 = require("./fetch-patch");
 const launch_server_1 = require("./launch-server");
@@ -15,7 +15,7 @@ const load_esm_from_memory_1 = require("./load-esm-from-memory");
 /**
  * This is passed as workerData when setting up the worker via the `piscina` package.
  */
-const { outputMode, hasSsrEntry } = worker_threads_1.workerData;
+const { outputMode, hasSsrEntry } = node_worker_threads_1.workerData;
 /** Renders an application based on a provided options. */
 async function extractRoutes() {
     const serverURL = outputMode !== undefined && hasSsrEntry ? await (0, launch_server_1.launchServer)() : launch_server_1.DEFAULT_URL;

package/src/utils/service-worker.js

@@ -43,9 +43,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.augmentAppWithServiceWorker = augmentAppWithServiceWorker;
 exports.augmentAppWithServiceWorkerEsbuild = augmentAppWithServiceWorkerEsbuild;
 exports.augmentAppWithServiceWorkerCore = augmentAppWithServiceWorkerCore;
-const crypto = __importStar(require("crypto"));
+const crypto = __importStar(require("node:crypto"));
 const node_fs_1 = require("node:fs");
-const path = __importStar(require("path"));
+const path = __importStar(require("node:path"));
 const bundler_context_1 = require("../tools/esbuild/bundler-context");
 const error_1 = require("./error");
 const load_esm_1 = require("./load-esm");