build: update all non-major dependencies

See associated pull request for more information.

Closes angular#30721 as a pr takeover

Author: alan-agius4

.github/workflows/codeql.yml

@@ -23,12 +23,12 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/init@d6bbdef45e766d081b84a2def353b0055f728d3e # v3.29.3
         with:
           languages: javascript-typescript
           build-mode: none
           config-file: .github/codeql/config.yml
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/analyze@d6bbdef45e766d081b84a2def353b0055f728d3e # v3.29.3
         with:
           category: '/language:javascript-typescript'

.github/workflows/perf.yml

@@ -47,7 +47,7 @@ jobs:
       # identity federation. This allows us to request short lived credentials on demand, rather than storing
       # credentials in secrets long term. More information can be found at:
       # https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform
-      - uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
+      - uses: google-github-actions/auth@140bb5113ffb6b65a7e9b937a81fa96cf5064462 # v2.1.11
         with:
           project_id: 'internal-200822'
           workload_identity_provider: 'projects/823469418460/locations/global/workloadIdentityPools/measurables-tracking/providers/angular'

package.json

@@ -94,16 +94,16 @@
     "@types/yargs": "^17.0.20",
     "@types/yargs-parser": "^21.0.0",
     "@types/yarnpkg__lockfile": "^1.1.5",
-    "@typescript-eslint/eslint-plugin": "8.37.0",
-    "@typescript-eslint/parser": "8.37.0",
+    "@typescript-eslint/eslint-plugin": "8.38.0",
+    "@typescript-eslint/parser": "8.38.0",
     "ajv": "8.17.1",
     "ansi-colors": "4.1.3",
     "beasties": "0.3.5",
     "buffer": "6.0.3",
-    "esbuild": "0.25.6",
-    "esbuild-wasm": "0.25.6",
+    "esbuild": "0.25.8",
+    "esbuild-wasm": "0.25.8",
     "eslint": "9.31.0",
-    "eslint-config-prettier": "10.1.5",
+    "eslint-config-prettier": "10.1.8",
     "eslint-plugin-header": "3.1.1",
     "eslint-plugin-import": "2.32.0",
     "express": "5.1.0",
@@ -112,8 +112,8 @@
     "http-proxy": "^1.18.1",
     "http-proxy-middleware": "3.0.5",
     "husky": "9.1.7",
-    "jasmine": "~5.8.0",
-    "jasmine-core": "~5.8.0",
+    "jasmine": "~5.9.0",
+    "jasmine-core": "~5.9.0",
     "jasmine-reporters": "^2.5.2",
     "jasmine-spec-reporter": "~7.0.0",
     "karma": "~6.4.0",
@@ -141,7 +141,7 @@
     "ts-node": "^10.9.1",
     "tslib": "2.8.1",
     "typescript": "5.9.0-beta",
-    "undici": "7.11.0",
+    "undici": "7.12.0",
     "unenv": "^1.10.0",
     "verdaccio": "6.1.5",
     "verdaccio-auth-memory": "^10.0.0",

packages/angular/build/package.json

@@ -23,26 +23,26 @@
     "@babel/core": "7.28.0",
     "@babel/helper-annotate-as-pure": "7.27.3",
     "@babel/helper-split-export-declaration": "7.24.7",
-    "@inquirer/confirm": "5.1.13",
+    "@inquirer/confirm": "5.1.14",
     "@vitejs/plugin-basic-ssl": "2.1.0",
     "beasties": "0.3.5",
     "browserslist": "^4.23.0",
-    "esbuild": "0.25.6",
+    "esbuild": "0.25.8",
     "https-proxy-agent": "7.0.6",
     "istanbul-lib-instrument": "6.0.3",
     "jsonc-parser": "3.3.1",
     "listr2": "9.0.1",
     "magic-string": "0.30.17",
     "mrmime": "2.0.1",
     "parse5-html-rewriting-stream": "8.0.0",
-    "picomatch": "4.0.2",
+    "picomatch": "4.0.3",
     "piscina": "5.1.3",
     "rollup": "4.45.1",
     "sass": "1.89.2",
     "semver": "7.7.2",
     "source-map-support": "0.5.21",
     "tinyglobby": "0.2.14",
-    "vite": "7.0.4",
+    "vite": "7.0.5",
     "watchpack": "2.4.4"
   },
   "optionalDependencies": {
@@ -52,7 +52,7 @@
     "@angular/ssr": "workspace:*",
     "@angular-devkit/core": "workspace:*",
     "jsdom": "26.1.0",
-    "less": "4.3.0",
+    "less": "4.4.0",
     "ng-packagr": "20.2.0-next.0",
     "postcss": "8.5.6",
     "rxjs": "7.8.2",

packages/angular/build/src/tools/vite/middlewares/assets-middleware.ts

@@ -7,6 +7,9 @@
  */
 
 import { lookup as lookupMimeType } from 'mrmime';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import type { ServerResponse } from 'node:http';
 import { extname } from 'node:path';
 import type { Connect, ViteDevServer } from 'vite';
 import { AngularMemoryOutputFiles, AngularOutputAssets, pathnameWithoutBasePath } from '../utils';
@@ -17,6 +20,8 @@ export interface ComponentStyleRecord {
   reload?: boolean;
 }
 
+const JS_TS_REGEXP = /\.[cm]?[tj]sx?$/;
+
 export function createAngularAssetsMiddleware(
   server: ViteDevServer,
   assets: AngularOutputAssets,
@@ -38,15 +43,28 @@ export function createAngularAssetsMiddleware(
     // Rewrite all build assets to a vite raw fs URL
     const asset = assets.get(pathname);
     if (asset) {
-      // Workaround to disable Vite transformer middleware.
-      // See: https://github.com/vitejs/vite/blob/746a1daab0395f98f0afbdee8f364cb6cf2f3b3f/packages/vite/src/node/server/middlewares/transform.ts#L201 and
-      // https://github.com/vitejs/vite/blob/746a1daab0395f98f0afbdee8f364cb6cf2f3b3f/packages/vite/src/node/server/transformRequest.ts#L204-L206
-      req.headers.accept = 'text/html';
-
-      // The encoding needs to match what happens in the vite static middleware.
-      // ref: https://github.com/vitejs/vite/blob/d4f13bd81468961c8c926438e815ab6b1c82735e/packages/vite/src/node/server/middlewares/static.ts#L163
-      req.url = `${server.config.base}@fs/${encodeURI(asset.source)}`;
-      next();
+      // This is a workaround to serve JS and TS files without Vite transformations.
+      if (JS_TS_REGEXP.test(extension)) {
+        const contents = readFileSync(asset.source);
+        const etag = `W/${createHash('sha256').update(contents).digest('hex')}`;
+        if (checkAndHandleEtag(req, res, etag)) {
+          return;
+        }
+
+        const mimeType = lookupMimeType(extension);
+        if (mimeType) {
+          res.setHeader('Content-Type', mimeType);
+        }
+
+        res.setHeader('ETag', etag);
+        res.setHeader('Cache-Control', 'no-cache');
+        res.end(contents);
+      } else {
+        // The encoding needs to match what happens in the vite static middleware.
+        // ref: https://github.com/vitejs/vite/blob/d4f13bd81468961c8c926438e815ab6b1c82735e/packages/vite/src/node/server/middlewares/static.ts#L163
+        req.url = `${server.config.base}@fs/${encodeURI(asset.source)}`;
+        next();
+      }
 
       return;
     }
@@ -100,12 +118,8 @@ export function createAngularAssetsMiddleware(
               componentStyle.used.add(componentId);
             }
 
-            // Report if there are no changes to avoid reprocessing
             const etag = `W/"${outputFile.contents.byteLength}-${outputFile.hash}-${componentId}"`;
-            if (req.headers['if-none-match'] === etag) {
-              res.statusCode = 304;
-              res.end();
-
+            if (checkAndHandleEtag(req, res, etag)) {
               return;
             }
 
@@ -134,12 +148,8 @@ export function createAngularAssetsMiddleware(
           }
         }
 
-        // Avoid resending the content if it has not changed since last request
         const etag = `W/"${outputFile.contents.byteLength}-${outputFile.hash}"`;
-        if (req.headers['if-none-match'] === etag) {
-          res.statusCode = 304;
-          res.end();
-
+        if (checkAndHandleEtag(req, res, etag)) {
           return;
         }
 
@@ -188,3 +198,18 @@ export function createAngularAssetsMiddleware(
     next();
   };
 }
+
+function checkAndHandleEtag(
+  req: Connect.IncomingMessage,
+  res: ServerResponse,
+  etag: string,
+): boolean {
+  if (req.headers['if-none-match'] === etag) {
+    res.statusCode = 304;
+    res.end();
+
+    return true;
+  }
+
+  return false;
+}

packages/angular/cli/package.json

@@ -25,12 +25,12 @@
     "@angular-devkit/architect": "workspace:0.0.0-EXPERIMENTAL-PLACEHOLDER",
     "@angular-devkit/core": "workspace:0.0.0-PLACEHOLDER",
     "@angular-devkit/schematics": "workspace:0.0.0-PLACEHOLDER",
-    "@inquirer/prompts": "7.6.0",
+    "@inquirer/prompts": "7.7.1",
     "@listr2/prompt-adapter-inquirer": "3.0.1",
-    "@modelcontextprotocol/sdk": "1.15.1",
+    "@modelcontextprotocol/sdk": "1.16.0",
     "@schematics/angular": "workspace:0.0.0-PLACEHOLDER",
     "@yarnpkg/lockfile": "1.1.0",
-    "algoliasearch": "5.32.0",
+    "algoliasearch": "5.34.0",
     "ini": "5.0.0",
     "jsonc-parser": "3.3.1",
     "listr2": "9.0.1",

packages/angular_devkit/build_angular/package.json

@@ -28,20 +28,20 @@
     "browserslist": "^4.21.5",
     "copy-webpack-plugin": "13.0.0",
     "css-loader": "7.1.2",
-    "esbuild-wasm": "0.25.6",
+    "esbuild-wasm": "0.25.8",
     "fast-glob": "3.3.3",
     "http-proxy-middleware": "3.0.5",
     "istanbul-lib-instrument": "6.0.3",
     "jsonc-parser": "3.3.1",
     "karma-source-map-support": "1.4.0",
-    "less": "4.3.0",
+    "less": "4.4.0",
     "less-loader": "12.3.0",
     "license-webpack-plugin": "4.0.2",
     "loader-utils": "3.3.1",
     "mini-css-extract-plugin": "2.9.2",
     "open": "10.2.0",
     "ora": "8.2.0",
-    "picomatch": "4.0.2",
+    "picomatch": "4.0.3",
     "piscina": "5.1.3",
     "postcss": "8.5.6",
     "postcss-loader": "8.1.1",
@@ -62,14 +62,14 @@
     "webpack-subresource-integrity": "5.1.0"
   },
   "optionalDependencies": {
-    "esbuild": "0.25.6"
+    "esbuild": "0.25.8"
   },
   "devDependencies": {
     "@angular/ssr": "workspace:*",
     "@web/test-runner": "0.20.2",
     "browser-sync": "3.0.4",
     "ng-packagr": "20.2.0-next.0",
-    "undici": "7.11.0"
+    "undici": "7.12.0"
   },
   "peerDependencies": {
     "@angular/core": "0.0.0-ANGULAR-FW-PEER-DEP",

packages/angular_devkit/build_angular/src/builders/browser/specs/web-worker_spec.ts

@@ -124,7 +124,7 @@ describe('Browser Builder Web Worker support', () => {
     );
     expect(workerContent).toContain('hello from worker');
     expect(workerContent).toContain('bar');
-    expect(workerContent).toContain('"hello"===e&&postMessage');
+    expect(workerContent).toContain('"hello"===o&&postMessage');
 
     // Main bundle should reference hashed worker bundle.
     const mainBundle = host.fileMatchExists(outputPath, /main\.[0-9a-f]{16}\.js/) as string;

packages/angular_devkit/core/package.json

@@ -28,7 +28,7 @@
     "ajv": "8.17.1",
     "ajv-formats": "3.0.1",
     "jsonc-parser": "3.3.1",
-    "picomatch": "4.0.2",
+    "picomatch": "4.0.3",
     "rxjs": "7.8.2",
     "source-map": "0.7.4"
   },

packages/angular_devkit/schematics_cli/package.json

@@ -18,7 +18,7 @@
   "dependencies": {
     "@angular-devkit/core": "workspace:0.0.0-PLACEHOLDER",
     "@angular-devkit/schematics": "workspace:0.0.0-PLACEHOLDER",
-    "@inquirer/prompts": "7.6.0",
+    "@inquirer/prompts": "7.7.1",
     "ansi-colors": "4.1.3",
     "yargs-parser": "22.0.0"
   }