@angular/ssr 22.0.0-next.5 → 22.0.0-next.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@angular/ssr",
-  "version": "22.0.0-next.5",
+  "version": "22.0.0-next.6",
   "description": "Angular server side rendering utilities",
   "type": "module",
   "license": "MIT",
@@ -29,14 +29,14 @@
   },
   "devDependencies": {
     "@angular-devkit/schematics": "workspace:*",
-    "@angular/common": "22.0.0-next.6",
-    "@angular/compiler": "22.0.0-next.6",
-    "@angular/core": "22.0.0-next.6",
-    "@angular/platform-browser": "22.0.0-next.6",
-    "@angular/platform-server": "22.0.0-next.6",
-    "@angular/router": "22.0.0-next.6",
+    "@angular/common": "22.0.0-next.8",
+    "@angular/compiler": "22.0.0-next.8",
+    "@angular/core": "22.0.0-next.8",
+    "@angular/platform-browser": "22.0.0-next.8",
+    "@angular/platform-server": "22.0.0-next.8",
+    "@angular/router": "22.0.0-next.8",
     "@schematics/angular": "workspace:*",
-    "beasties": "0.4.1"
+    "beasties": "0.4.2"
   },
   "sideEffects": false,
   "schematics": "./schematics/collection.json",

package/third_party/beasties/THIRD_PARTY_LICENSES.txt

@@ -449,7 +449,7 @@ License: MIT
 
 The MIT License (MIT)
 
-Copyright 2013 Andrey Sitnik <andrey@sitnik.ru>
+Copyright 2013 Andrey Sitnik <andrey@sitnik.es>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

package/third_party/beasties/index.js

@@ -599,6 +599,18 @@ function requireStringifier () {
 	if (hasRequiredStringifier) return stringifier;
 	hasRequiredStringifier = 1;
 
+	// Escapes sequences that could break out of an HTML <style> context.
+	// Uses CSS unicode escaping (\3c = '<') which is valid CSS and parsed
+	// correctly by all compliant CSS consumers.
+	const STYLE_TAG = /(<)(\/?style\b)/gi;
+	const COMMENT_OPEN = /(<)(!--)/g;
+
+	function escapeHTMLInCSS(str) {
+	  if (typeof str !== 'string') return str
+	  if (!str.includes('<')) return str
+	  return str.replace(STYLE_TAG, '\\3c $2').replace(COMMENT_OPEN, '\\3c $2')
+	}
+
 	const DEFAULT_RAW = {
 	  after: '\n',
 	  beforeClose: '\n',
@@ -637,7 +649,7 @@ function requireStringifier () {
 	      this.block(node, name + params);
 	    } else {
 	      let end = (node.raws.between || '') + (semicolon ? ';' : '');
-	      this.builder(name + params + end, node);
+	      this.builder(escapeHTMLInCSS(name + params + end), node);
 	    }
 	  }
 
@@ -672,7 +684,7 @@ function requireStringifier () {
 
 	  block(node, start) {
 	    let between = this.raw(node, 'between', 'beforeOpen');
-	    this.builder(start + between + '{', node, 'start');
+	    this.builder(escapeHTMLInCSS(start + between) + '{', node, 'start');
 
 	    let after;
 	    if (node.nodes && node.nodes.length) {
@@ -682,7 +694,7 @@ function requireStringifier () {
 	      after = this.raw(node, 'after', 'emptyBody');
 	    }
 
-	    if (after) this.builder(after);
+	    if (after) this.builder(escapeHTMLInCSS(after));
 	    this.builder('}', node, 'end');
 	  }
 
@@ -694,10 +706,11 @@ function requireStringifier () {
 	    }
 
 	    let semicolon = this.raw(node, 'semicolon');
+	    let isDocument = node.type === 'document';
 	    for (let i = 0; i < node.nodes.length; i++) {
 	      let child = node.nodes[i];
 	      let before = this.raw(child, 'before');
-	      if (before) this.builder(before);
+	      if (before) this.builder(isDocument ? before : escapeHTMLInCSS(before));
 	      this.stringify(child, last !== i || semicolon);
 	    }
 	  }
@@ -705,7 +718,7 @@ function requireStringifier () {
 	  comment(node) {
 	    let left = this.raw(node, 'left', 'commentLeft');
 	    let right = this.raw(node, 'right', 'commentRight');
-	    this.builder('/*' + left + node.text + right + '*/', node);
+	    this.builder(escapeHTMLInCSS('/*' + left + node.text + right + '*/'), node);
 	  }
 
 	  decl(node, semicolon) {
@@ -717,7 +730,7 @@ function requireStringifier () {
 	    }
 
 	    if (semicolon) string += ';';
-	    this.builder(string, node);
+	    this.builder(escapeHTMLInCSS(string), node);
 	  }
 
 	  document(node) {
@@ -923,13 +936,17 @@ function requireStringifier () {
 
 	  root(node) {
 	    this.body(node);
-	    if (node.raws.after) this.builder(node.raws.after);
+	    if (node.raws.after) {
+	      let after = node.raws.after;
+	      let isDocument = node.parent && node.parent.type === 'document';
+	      this.builder(isDocument ? after : escapeHTMLInCSS(after));
+	    }
 	  }
 
 	  rule(node) {
 	    this.block(node, this.rawValue(node, 'selector'));
 	    if (node.raws.ownSemicolon) {
-	      this.builder(node.raws.ownSemicolon, node, 'end');
+	      this.builder(escapeHTMLInCSS(node.raws.ownSemicolon), node, 'end');
 	    }
 	  }
 
@@ -2126,7 +2143,8 @@ function requirePreviousMap () {
 	      return fromBase64(text.substr(baseUriMatch[0].length))
 	    }
 
-	    let encoding = text.match(/data:application\/json;([^,]+),/)[1];
+	    let encoding = text.slice('data:application/json;'.length);
+	    encoding = encoding.slice(0, encoding.indexOf(','));
 	    throw new Error('Unsupported source map encoding ' + encoding)
 	  }
 
@@ -2369,7 +2387,15 @@ function requireInput () {
 	      );
 	    }
 
-	    result.input = { column, endColumn, endLine, endOffset, line, offset, source: this.css };
+	    result.input = {
+	      column,
+	      endColumn,
+	      endLine,
+	      endOffset,
+	      line,
+	      offset,
+	      source: this.css
+	    };
 	    if (this.file) {
 	      if (pathToFileURL) {
 	        result.input.url = pathToFileURL(this.file).toString();
@@ -4736,7 +4762,7 @@ function requireNoWorkResult () {
 
 	let MapGenerator = requireMapGenerator();
 	let parse = requireParse();
-	const Result = requireResult();
+	let Result = requireResult();
 	let stringify = requireStringify();
 	let warnOnce = requireWarnOnce();
 
@@ -4886,7 +4912,7 @@ function requireProcessor () {
 
 	class Processor {
 	  constructor(plugins = []) {
-	    this.version = '8.5.8';
+	    this.version = '8.5.10';
 	    this.plugins = this.normalize(plugins);
 	  }
 
@@ -11647,23 +11673,21 @@ function validateMediaQuery(query) {
   return true;
 }
 
-let classCache = null;
-let idCache = null;
 function buildCache(container) {
-  classCache = /* @__PURE__ */ new Set();
-  idCache = /* @__PURE__ */ new Set();
+  container._classCache = /* @__PURE__ */ new Set();
+  container._idCache = /* @__PURE__ */ new Set();
   const queue = [container];
   while (queue.length) {
     const node = queue.shift();
     if (node.hasAttribute?.("class")) {
       const classList = node.getAttribute("class").trim().split(" ");
       classList.forEach((cls) => {
-        classCache.add(cls);
+        container._classCache.add(cls);
       });
     }
     if (node.hasAttribute?.("id")) {
       const id = node.getAttribute("id").trim();
-      idCache.add(id);
+      container._idCache.add(id);
     }
     if ("children" in node) {
       queue.push(...node.children.filter((child) => child.type === "tag"));
@@ -11749,10 +11773,8 @@ function extendElement(element) {
     },
     setAttribute: {
       value(name, value) {
-        if (this.attribs == null)
-          this.attribs = {};
-        if (value == null)
-          value = "";
+        this.attribs ??= {};
+        value ??= "";
         this.attribs[name] = value;
       }
     },
@@ -11870,15 +11892,16 @@ function cachedQuerySelector(sel, node) {
     selectorTokens = parseRelevantSelectors(sel);
     selectorTokensCache.set(sel, selectorTokens);
   }
-  if (selectorTokens) {
+  if (selectorTokens && node._classCache && node._idCache) {
     for (const token of selectorTokens) {
-      if (token.name === "class") {
-        return classCache.has(token.value);
+      if (token.name === "class" && !node._classCache.has(token.value)) {
+        return false;
       }
-      if (token.name === "id") {
-        return idCache.has(token.value);
+      if (token.name === "id" && !node._idCache.has(token.value)) {
+        return false;
       }
     }
+    return true;
   }
   return !!selectOne(sel, node);
 }
@@ -11888,7 +11911,7 @@ function parseRelevantSelectors(sel) {
   for (let i = 0; i < tokens.length; i++) {
     const tokenGroup = tokens[i];
     if (tokenGroup?.length !== 1) {
-      continue;
+      return null;
     }
     const token = tokenGroup[0];
     if (token?.type === "attribute" && (token.name === "class" || token.name === "id")) {
@@ -11937,6 +11960,15 @@ const removePseudoClassesAndElementsPattern = /(?<!\\)::?[a-z-]+(?:\(.+\))?/gi;
 const implicitUniversalPattern = /([>+~])\s*(?!\1)([>+~])/g;
 const emptyCombinatorPattern = /([>+~])\s*(?=\1|$)/g;
 const removeTrailingCommasPattern = /\(\s*,|,\s*\)/g;
+const LEADING_SLASH_OR_QUERY_RE = /^\/(?!\/)|[?#].*$/g;
+const PUBLIC_PATH_RE = /(^\/(?!\/)|\/$)/g;
+const REMOTE_URL_RE = /^https?:\/\//;
+const BEFORE_AFTER_PSEUDO_RE = /^::?(?:before|after)$/;
+const FONT_FAMILY_RE = /\bfont(?:-family)?\b/i;
+const BEASTIES_COMMENT_RE = /^(?<!! )beasties:(.*)/;
+const LEADING_SLASH_RE = /^\//;
+const WHITESPACE_RE = /\s+/;
+const URL_RE = /url\s*\(\s*(['"]?)(.+?)\1\s*\)/;
 class Beasties {
   #selectorCache = /* @__PURE__ */ new Map();
   options;
@@ -12062,12 +12094,12 @@ class Beasties {
   async getCssAsset(href, _style) {
     const outputPath = this.options.path;
     const publicPath = this.options.publicPath;
-    let normalizedPath = href.replace(/^\/(?!\/)|[?#].*$/g, "");
-    const pathPrefix = `${(publicPath || "").replace(/(^\/(?!\/)|\/$)/g, "")}/`;
+    let normalizedPath = href.replace(LEADING_SLASH_OR_QUERY_RE, "");
+    const pathPrefix = `${(publicPath || "").replace(PUBLIC_PATH_RE, "")}/`;
     if (normalizedPath.startsWith(pathPrefix) && !(pathPrefix === "/" && normalizedPath.startsWith("//"))) {
-      normalizedPath = normalizedPath.substring(pathPrefix.length).replace(/^\//, "");
+      normalizedPath = normalizedPath.substring(pathPrefix.length).replace(LEADING_SLASH_RE, "");
     }
-    const isRemote = /^https?:\/\//.test(normalizedPath) || normalizedPath.startsWith("//");
+    const isRemote = REMOTE_URL_RE.test(normalizedPath) || normalizedPath.startsWith("//");
     if (isRemote) {
       if (this.options.remote === true) {
         try {
@@ -12271,7 +12303,7 @@ class Beasties {
   processStyle(style, document) {
     if (style.$$reduce === false)
       return;
-    const name = style.$$name ? style.$$name.replace(/^\//, "") : "inline CSS";
+    const name = style.$$name ? style.$$name.replace(LEADING_SLASH_RE, "") : "inline CSS";
     const options = this.options;
     const beastiesContainer = document.beastiesContainer;
     let keyframesMode = options.keyframes ?? "critical";
@@ -12298,7 +12330,7 @@ class Beasties {
       ast,
       markOnly((rule) => {
         if (rule.type === "comment") {
-          const beastiesComment = rule.text.match(/^(?<!! )beasties:(.*)/);
+          const beastiesComment = rule.text.match(BEASTIES_COMMENT_RE);
           const command = beastiesComment && beastiesComment[1];
           if (command) {
             switch (command) {
@@ -12347,7 +12379,7 @@ class Beasties {
             });
             if (isAllowedRule)
               return true;
-            if (sel === ":root" || sel === "html" || sel === "body" || sel[0] === ":" && /^::?(?:before|after)$/.test(sel)) {
+            if (sel === ":root" || sel === "html" || sel === "body" || sel[0] === ":" && BEFORE_AFTER_PSEUDO_RE.test(sel)) {
               return true;
             }
             sel = this.normalizeCssSelector(sel);
@@ -12368,11 +12400,11 @@ class Beasties {
               if (!("prop" in decl)) {
                 continue;
               }
-              if (shouldInlineFonts && /\bfont(?:-family)?\b/i.test(decl.prop)) {
+              if (shouldInlineFonts && FONT_FAMILY_RE.test(decl.prop)) {
                 criticalFonts += ` ${decl.value}`;
               }
               if (decl.prop === "animation" || decl.prop === "animation-name") {
-                for (const name2 of decl.value.split(/\s+/)) {
+                for (const name2 of decl.value.split(WHITESPACE_RE)) {
                   const nameTrimmed = name2.trim();
                   if (nameTrimmed)
                     criticalKeyframeNames.add(nameTrimmed);
@@ -12415,7 +12447,7 @@ class Beasties {
               continue;
             }
             if (decl.prop === "src") {
-              src = (decl.value.match(/url\s*\(\s*(['"]?)(.+?)\1\s*\)/) || [])[2];
+              src = (decl.value.match(URL_RE) || [])[2];
             } else if (decl.prop === "font-family") {
               family = decl.value;
             }