From 5e3b6faa55911f334079a0ab41cb1512d0f198f6 Mon Sep 17 00:00:00 2001 From: Angular Robot Date: Wed, 10 Sep 2025 21:10:24 +0000 Subject: [PATCH 1/5] build: update github/codeql-action action to v3.30.3 See associated pull request for more information. --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b4921b0868e3..40fb506b29de 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,12 +23,12 @@ jobs: with: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@d3678e237b9c32a6c9bffb3315c335f976f3549f # v3.30.2 + uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3 with: languages: javascript-typescript build-mode: none config-file: .github/codeql/config.yml - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@d3678e237b9c32a6c9bffb3315c335f976f3549f # v3.30.2 + uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3 with: category: '/language:javascript-typescript' diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d74147208b95..24132b0bb481 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -46,6 +46,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: 'Upload to code-scanning' - uses: github/codeql-action/upload-sarif@d3678e237b9c32a6c9bffb3315c335f976f3549f # v3.30.2 + uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3 with: sarif_file: results.sarif From 4e51032e3e474d7e7a82a493098162a1dd15bb75 Mon Sep 17 00:00:00 2001 From: Andrew Scott Date: Wed, 10 Sep 2025 15:07:26 -0700 Subject: [PATCH 2/5] refactor(@angular/cli): Add instructions to component zoneless migration to retain NgZone.run I observed that it chose to do this in one test. These should not be removed for libraries that support Zone applications and also should not be removed for applications until the zoneless migration is entirely complete. (cherry picked from commit 47d0668b824827a22fde90c0f3bc23f30ec6eb5f) --- .../src/commands/mcp/tools/onpush-zoneless-migration/prompts.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/angular/cli/src/commands/mcp/tools/onpush-zoneless-migration/prompts.ts b/packages/angular/cli/src/commands/mcp/tools/onpush-zoneless-migration/prompts.ts index 01254ed5fc61..b01dd5bdee94 100644 --- a/packages/angular/cli/src/commands/mcp/tools/onpush-zoneless-migration/prompts.ts +++ b/packages/angular/cli/src/commands/mcp/tools/onpush-zoneless-migration/prompts.ts @@ -154,6 +154,7 @@ export function generateZonelessMigrationInstructionsForComponent( 3. **DO NOT** use \`ChangeDetectionStrategy.OnPush\`. This will be the next step in the migration, but it is not part of this task. 4. **DO NOT** modify properties that are already signals or are used with the \`async\` pipe in the template, as they are already zoneless-compatible. 5. **DO NOT** make any changes to files other than the component file at \`${filePath}\` and its direct template/style files if necessary. + 6. **DO NOT** remove or modify usages of \`NgZone.run\` or \`NgZone.runOutsideAngular\`. These are still required. ### Final Step After you have applied all the required changes and followed all the rules, consult this tool again for the next steps in the migration process.`; From d60f4e53d8f511d313e517161dc26eb3cc005f1c Mon Sep 17 00:00:00 2001 From: Alan Agius <17563226+alan-agius4@users.noreply.github.com> Date: Thu, 11 Sep 2025 07:12:56 +0000 Subject: [PATCH 3/5] fix(@angular/build): update vite to version `7.1.5` This fixes https://nvd.nist.gov/vuln/detail/CVE-2025-58751 Closes: #31158 --- packages/angular/build/package.json | 2 +- pnpm-lock.yaml | 78 ++++++++++++++++++++++++++--- 2 files changed, 73 insertions(+), 7 deletions(-) diff --git a/packages/angular/build/package.json b/packages/angular/build/package.json index fecb37dbbac7..6f988e9b27fc 100644 --- a/packages/angular/build/package.json +++ b/packages/angular/build/package.json @@ -42,7 +42,7 @@ "semver": "7.7.2", "source-map-support": "0.5.21", "tinyglobby": "0.2.14", - "vite": "7.1.2", + "vite": "7.1.5", "watchpack": "2.4.4" }, "optionalDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 79398028cd4b..b707bbf8334b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -366,7 +366,7 @@ importers: version: 5.1.14(@types/node@24.3.0) '@vitejs/plugin-basic-ssl': specifier: 2.1.0 - version: 2.1.0(vite@7.1.2(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1)) + version: 2.1.0(vite@7.1.5(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1)) beasties: specifier: 0.3.5 version: 0.3.5 @@ -419,8 +419,8 @@ importers: specifier: 0.2.14 version: 0.2.14 vite: - specifier: 7.1.2 - version: 7.1.2(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1) + specifier: 7.1.5 + version: 7.1.5(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1) watchpack: specifier: 2.4.4 version: 2.4.4 @@ -8249,6 +8249,10 @@ packages: resolution: {integrity: sha512-tX5e7OM1HnYr2+a2C/4V0htOcSQcoSTH9KgJnVvNm5zm/cyEWKJ7j7YutsH9CxMdtOkkLFy2AHrMci9IM8IPZQ==} engines: {node: '>=12.0.0'} + tinyglobby@0.2.15: + resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==} + engines: {node: '>=12.0.0'} + tinypool@1.1.1: resolution: {integrity: sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==} engines: {node: ^18.0.0 || >=20.0.0} @@ -8622,6 +8626,46 @@ packages: yaml: optional: true + vite@7.1.5: + resolution: {integrity: sha512-4cKBO9wR75r0BeIWWWId9XK9Lj6La5X846Zw9dFfzMRw38IlTk2iCcUt6hsyiDRcPidc55ZParFYDXi0nXOeLQ==} + engines: {node: ^20.19.0 || >=22.12.0} + hasBin: true + peerDependencies: + '@types/node': ^20.19.0 || >=22.12.0 + jiti: '>=1.21.0' + less: ^4.0.0 + lightningcss: ^1.21.0 + sass: ^1.70.0 + sass-embedded: ^1.70.0 + stylus: '>=0.54.8' + sugarss: ^5.0.0 + terser: ^5.16.0 + tsx: ^4.8.1 + yaml: ^2.4.2 + peerDependenciesMeta: + '@types/node': + optional: true + jiti: + optional: true + less: + optional: true + lightningcss: + optional: true + sass: + optional: true + sass-embedded: + optional: true + stylus: + optional: true + sugarss: + optional: true + terser: + optional: true + tsx: + optional: true + yaml: + optional: true + vitest@3.2.4: resolution: {integrity: sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==} engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0} @@ -12155,9 +12199,9 @@ snapshots: lodash: 4.17.21 minimatch: 7.4.6 - '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.2(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))': + '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.5(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))': dependencies: - vite: 7.1.2(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1) + vite: 7.1.5(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1) '@vitest/expect@3.2.4': dependencies: @@ -17617,6 +17661,11 @@ snapshots: fdir: 6.5.0(picomatch@4.0.3) picomatch: 4.0.3 + tinyglobby@0.2.15: + dependencies: + fdir: 6.5.0(picomatch@4.0.3) + picomatch: 4.0.3 + tinypool@1.1.1: {} tinyrainbow@2.0.0: {} @@ -17978,7 +18027,7 @@ snapshots: debug: 4.4.1(supports-color@10.2.0) es-module-lexer: 1.7.0 pathe: 2.0.3 - vite: 7.1.2(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1) + vite: 7.1.5(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1) transitivePeerDependencies: - '@types/node' - jiti @@ -18010,6 +18059,23 @@ snapshots: terser: 5.43.1 yaml: 2.8.1 + vite@7.1.5(@types/node@24.3.0)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1): + dependencies: + esbuild: 0.25.9 + fdir: 6.5.0(picomatch@4.0.3) + picomatch: 4.0.3 + postcss: 8.5.6 + rollup: 4.46.2 + tinyglobby: 0.2.15 + optionalDependencies: + '@types/node': 24.3.0 + fsevents: 2.3.3 + jiti: 1.21.7 + less: 4.4.0 + sass: 1.90.0 + terser: 5.43.1 + yaml: 2.8.1 + vitest@3.2.4(@types/node@24.3.0)(jiti@1.21.7)(jsdom@26.1.0(bufferutil@4.0.9)(utf-8-validate@6.0.5))(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1): dependencies: '@types/chai': 5.2.2 From be60be4997ea0f7be3a4fb993f87b1bd29fc1493 Mon Sep 17 00:00:00 2001 From: Alan Agius <17563226+alan-agius4@users.noreply.github.com> Date: Thu, 11 Sep 2025 08:50:40 +0000 Subject: [PATCH 4/5] fix(@angular/build): add timestamp to bundle generation log Adds an ISO timestamp to the "Application bundle generation complete" message. This provides more precise information about when the build process finished, which can be useful for debugging and analyzing build performance. Closes #30572 (cherry picked from commit 43fc5536fd42694a09a7b7c25fe8c5665e3e28d3) --- packages/angular/build/src/builders/application/index.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/angular/build/src/builders/application/index.ts b/packages/angular/build/src/builders/application/index.ts index 80261c41277f..8f11f2fd8001 100644 --- a/packages/angular/build/src/builders/application/index.ts +++ b/packages/angular/build/src/builders/application/index.ts @@ -109,7 +109,8 @@ export async function* buildApplicationInternal( const hasError = result.errors.length > 0; result.addLog( - `Application bundle generation ${hasError ? 'failed' : 'complete'}. [${buildTime.toFixed(3)} seconds]\n`, + `Application bundle generation ${hasError ? 'failed' : 'complete'}.` + + ` [${buildTime.toFixed(3)} seconds] - ${new Date().toISOString()}\n`, ); } From 9930e8aab37772ad46d5b6ad018458bbea12b9ba Mon Sep 17 00:00:00 2001 From: Alan Agius <17563226+alan-agius4@users.noreply.github.com> Date: Thu, 11 Sep 2025 13:01:11 +0000 Subject: [PATCH 5/5] release: cut the v20.3.1 release --- CHANGELOG.md | 13 +++++++++++++ package.json | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 24b4e0078ee1..a5baac8a54a9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,16 @@ + + +# 20.3.1 (2025-09-11) + +### @angular/build + +| Commit | Type | Description | +| --------------------------------------------------------------------------------------------------- | ---- | -------------------------------------- | +| [be60be499](https://github.com/angular/angular-cli/commit/be60be4997ea0f7be3a4fb993f87b1bd29fc1493) | fix | add timestamp to bundle generation log | +| [d60f4e53d](https://github.com/angular/angular-cli/commit/d60f4e53d8f511d313e517161dc26eb3cc005f1c) | fix | update vite to version `7.1.5` | + + + # 20.3.0 (2025-09-10) diff --git a/package.json b/package.json index 680605ea51eb..b56adb5f4b87 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@angular/devkit-repo", - "version": "20.3.0", + "version": "20.3.1", "private": true, "description": "Software Development Kit for Angular", "keywords": [