[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/build	22.2.4 → 22.2.5
@angular/build	21.2.28 → 21.2.29
@angular/build	20.3.41 → 20.3.42
@angular/cdk	22.2.4 → 22.2.5
@angular/cli	22.2.4 → 22.2.5
@angular/cli	21.2.28 → 21.2.29
@angular/cli	20.3.41 → 20.3.42
@angular/common (source)	22.2.3 → 22.2.4
@angular/compiler (source)	22.2.3 → 22.2.4
@angular/compiler-cli (source)	22.2.3 → 22.2.4
@angular/core (source)	22.2.3 → 22.2.4
@angular/forms (source)	22.2.3 → 22.2.4
@angular/material	22.2.4 → 22.2.5
@angular/platform-browser (source)	22.2.3 → 22.2.4
@angular/router (source)	22.2.3 → 22.2.4
oxfmt (source)	0.74.0 → 0.75.0
oxlint (source)	1.89.0 → 1.90.0
pnpm (source)	12.15.0 → 12.16.1

---

Release Notes

angular/angular-cli (@​angular/build)

v22.2.5

Compare Source

@​angular/cli

Commit	Type	Description
7efeeb9caa	fix	explain how to pick a project when a schematic cannot determine one
ee61e328ac	fix	handle bun registry error output and 404 detection
0d8898c289	fix	support resolving subproject dependencies in bun workspaces

@​schematics/angular

Commit	Type	Description
982c3dcbfc	fix	avoid adding web worker snippet to server configuration files
18e5dc6fe8	fix	ignore non-workspace stylesheet entries when adding Tailwind
dd18bda9db	fix	include the SSR entry file in the trust-proxy-headers migration
b7e24561e7	fix	include the type separator in the class spec import
7f3840c70c	fix	keep the default getter access type of spyOnProperty in refactor-jasmine-vitest
eaf2343be4	fix	migrate CallInfo returnValue and object in refactor-jasmine-vitest
6680d289cb	fix	migrate spy.calls.first().args in refactor-jasmine-vitest
9cba0da43f	fix	set explicit type for the module --route component
e9ae950364	fix	set explicit type for the app-shell component

@​angular-devkit/build-angular

Commit	Type	Description
0c4bd19ace	fix	resolve dev-server sslKey and sslCert relative to the workspace root (#​34399)

@​angular-devkit/core

Commit	Type	Description
ad04d689bb	fix	only invoke smart default provider when value is undefined

@​angular-devkit/schematics

Commit	Type	Description
e7fd1bd9cb	fix	support delegating trees in partition (#​34539)
1854c1714d	fix	support delegating trees in the filter rule (#​34539)

@​angular/build

Commit	Type	Description
6d45d1007f	fix	escape prerender redirect URLs
6298fb89e6	fix	include the oxc-parser WASI binding as an optional dependency
325f6a0f48	fix	only require karma-coverage when coverage is enabled
47075bee89	fix	resolve dev-server sslKey and sslCert relative to the workspace root (#​34399)
db45eed631	fix	serialize server manifest asset paths
5ae6a66edb	fix	suggest the istanbul provider in the unit-test V8 browser coverage error
e3134b4cbc	fix	warn about unsupported options in the unit-test karma runner
250fae725e	fix	write the stats file in a stable, deterministic order
cda246579e	perf	avoid duplicate Domino bundling in server bundles
bcdcc09fb7	perf	avoid web worker channel overhead in library parallel compilation

@​angular/ssr

Commit	Type	Description
7b9c8d0b5d	fix	preserve trailing slashes in query and fragment of redirect URLs

angular/components (@​angular/cdk)

v22.2.5

Compare Source

aria

Commit	Type	Description
1edc5bfd7	fix	menu: avoid re-rendering when unrelated elements are added (#​33996)

material

Commit	Type	Description
cdaa1c3bd	fix	checkbox: duplicate required error with signal forms
f70c3ccdd	fix	slide-toggle: duplicate required error with signal forms

multiple

Commit	Type	Description
549036362	fix	update fake event detection in aria (#​34004)

angular/angular (@​angular/common)

v22.2.4

Compare Source

compiler

Commit	Type	Description
bc600a2fc2	fix	avoid treating attributes with object prototype names as being translated
1a7ebad7a5	fix	default to Eager change detection for pre-v22 libraries in JIT
4e4df4a696	fix	report errors for malformed template literal interpolations
00229e112d	fix	skip escaped characters when looking for comments in expressions

compiler-cli

Commit	Type	Description
4b82200c4e	fix	require @​jridgewell/sourcemap-codec 1.6.0 or later

core

Commit	Type	Description
570679134b	fix	avoid mutating shared ICU case queue during i18n hydration
fe02c34c3c	fix	avoid reloading a resource when params is unchanged
d3c72743a9	fix	catch view effect errors in targeted change detection mode
b8102ebeb4	fix	check every i18n attribute translation for ICUs
57ae1d1bb6	fix	guard against integer overflow in i18n
84a398bec2	fix	improve the warning for bindings on elements inside ICU expressions
be85e4eb74	fix	keep prototype-named keys in getTransferState
c1b8b0a914	perf	avoid reading linked signal debug names in production
e79a9199a5	perf	guard i18n insertion assertion with ngDevMode

forms

Commit	Type	Description
1586cc72ab	fix	annotate field context helpers with this: void
41b189752e	fix	don't crash when formControlName has no matching control
122663145b	fix	reject unsupported updateOn in SignalFormControl
a02ad167dc	perf	match multi-select identities in a single pass

http

Commit	Type	Description
2251098d52	fix	account for multiple cache control headers

language-service

Commit	Type	Description
646e9723db	fix	resolve symbols for inputs with restricted access

migrations

Commit	Type	Description
6c631a5359	feat	migrate static string and array ngClass bindings to class

router

Commit	Type	Description
6ccbb0f6aa	fix	don't intercept downloads with the Navigation API
d1da1a7c4c	fix	drop null query params in createUrlTreeFromSnapshot
12b553bc28	fix	escape colons in parenthesized primary child segments
b8383a1987	fix	properly handle redirects during traversal navigations with Navigation API
702ba3a2eb	fix	remove previous classes when routerLinkActive changes
2f0e2ac5e7	fix	respect guard order when a guard throws a RedirectCommand
ea8cdc4c6b	fix	skip split when piercing empty path outlets
6c995a5a6d	fix	unsubscribe from route data when outlet deactivates

upgrade

Commit	Type	Description
ecaec13db4	fix	only compile the template contents of a downgraded component

oxc-project/oxc (oxfmt)

v0.75.0: oxfmt v0.75.0

Compare Source

🐛 Bug Fixes

• 5042019 formatter: Keep fill layout for array with comment after [ (#​28170) (leaysgur)
• 9d37ff6 formatter: Use position-based comment checks for concise arrays (#​28169) (leaysgur)
• 016c4a2 formatter: Keep a comment before } inside a JSX spread child (#​28103) (vidigoat)
• 190bb1e formatter: Keep parens around an instantiation expression ending an operand through any tight parent (#​28168) (leaysgur)
• a5314a1 formatter: Keep ; before in and instanceof class members (#​28166) (leaysgur)
• 3a56e7c formatter: Keep closing HTML comments at the start of a line (#​28064) (Cameron)
• 23d23d6 formatter_markdown: Honor range ignore inside directives (#​28164) (leaysgur)
• 5f1fd3d formatter: Measure width heuristics by display width (#​28098) (leaysgur)
• a5a52cf formatter: Keep parens around private in expressions (#​28096) (leaysgur)
• 999496e formatter: Measure a short key by its display width (#​28026) (vidigoat)
• 7e9aa44 formatter: Keep parens around a looser operand of an instantiation expression (#​28025) (vidigoat)
• 6912d1f formatter: Keep an arrow signature that exactly fills the line for any body (#​27989) (leaysgur)
• eb1d9f9 formatter_core: Count a flat line space in fits only when text follows (#​27987) (leaysgur)

⚡ Performance

• 1ed93af data_structures: Copy short strings without a memcpy call (#​27953) (leaysgur)
• 7948f0b formatter_core: Shrink FormatElement to 16B (#​28012) (leaysgur)
• 788af22 formatter: Keep AstNodes on the stack, and only chain links in the arena (#​27963) (leaysgur)

📚 Documentation

• 068a8ea formatter: Fix up wording (#​28167) (leaysgur)
• db55461 formatter_core: Document text width divergence (#​28095) (leaysgur)
• 880d229 formatter: Add vitest-test-call to known divergences (#​28006) (leaysgur)

oxc-project/oxc (oxlint)

v1.90.0

Compare Source

🚀 Features

• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#​28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#​28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#​28116) (camc314)

pnpm/pnpm (pnpm)

v12.16.1: pnpm 12.16.1

Compare Source

This release fixes pnpm install hanging on a cold store in workspaces that install Cargo crates, and pnpm pack shipping a file that files excludes by name.

Patch Changes

• pnpm install no longer hangs on a cold store in a workspace that also installs Cargo crates or a Rust toolchain.

• pnpm pack and pnpm publish now apply a files entry that names a file after the glob and directory entries, as npm does. A file excluded by name, such as !dist/index.js, stays out even when a later dist/** matches it. A file named by its path, such as lib/secret.js, ships even when a later !lib/*.js matches it.

• pnpm install no longer leaves a broken symlink in an injected workspace dependency when the package links to a file outside its published files and pnpm imports by hardlink. Installing a git dependency now skips internal directory symlinks when importing its files into the store.

• pnpm install now relinks a command that a workspace project renames into the projects that depend on it when sharedWorkspaceLockfile is false pnpm/tasks#224.

• pnpm install and pnpm rebuild now refresh privately hoisted .bin shims in node_modules/.pnpm/node_modules/.bin after a dependency build replaces a script target with a native executable #​17402.

• pnpm install now reads a package's manifest to decide its peer dependencies when it updates an existing lockfile, as it does when it resolves from scratch.

• Commands, pnpm --version, pnpm self-update, and invocations with unknown flags now apply the same packageManager and devEngines.packageManager settings when switching to the pinned pnpm version or recording it in pnpm-lock.yaml. --config.<key> flags and lockfileDir now reach the version switch and lockfile sync on every entry point. Unreadable settings in pnpm-workspace.yaml or the global config.yaml that do not affect the pin decision no longer block the version switch pnpm/tasks#222.

• pnpm now accepts the --cache-dir <dir> flag, as in pnpm install --cache-dir /tmp/pnpm-cache #​17422.

• When the version or range given to pnpm unpublish matches every published version, the error now says so and shows the same command with --force. Before, the error suggested running pnpm unpublish <pkg>@<version>, the command that had just failed.

Platinum Sponsors

Gold Sponsors

v12.16.0: pnpm 12.16

Compare Source

This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing.

Minor Changes

• Added a repeatable global --env-file <path> flag to load environment variables from dotenv-style files before running a command. Later files override earlier files, variables already in the environment are preserved, and loaded variables are visible to user-level .npmrc interpolation and lifecycle scripts #​7111.

• pnpm can now update a pnpm-lock.yaml that is a symlink. List the directories the lockfile may link into in the symlinkedLockfileTargetDirs setting, in the global config or with PNPM_CONFIG_SYMLINKED_LOCKFILE_TARGET_DIRS. pnpm writes the update to the file the symlink points to if that file is inside one of these directories. The symlink stays in place. pnpm ignores this setting in pnpm-workspace.yaml #​17222.

• Added a --no-modify-path option to pnpm setup. It installs pnpm without adding it to PATH, leaving the shell config file, the Windows registry, and the GitHub Actions environment files unchanged. pnpm setup then prints the lines to add yourself get.pnpm.io#37.

Patch Changes

Security

• Fixed memory exposure and allocation handling vulnerabilities when processing zstd-compressed data #​17388.

• Signing in pnpm and pnpr no longer uses arithmetic that may leak the private key through timing. This covers shared artifacts, OCI registry tokens, and OIDC login state advisory.

Installing packages

• A dependency symlink that pnpm cannot point at the wanted target now fails the install with an error that names the link. This happens when the filesystem still serves the old link after pnpm removed it, as a node_modules served by a virtual filesystem does. pnpm used to remove the link again without end and crashed with a segmentation fault once the thread ran out of stack.

• Concurrent workspace installs no longer lose store-index rows when initializing the shared SQLite index #​17388.

• Agent skill links now keep the same target across installs when a package version is installed with several sets of peer dependencies. An install no longer fails with ERR_PNPM_AGENT_SKILL_PATH_OCCUPIED on a skill link that pnpm created for another of those copies #​17319.

• pnpm now fails at once, without retrying, when a downloaded package archive contains a rejected entry path #​17205.

• pnpm now builds a git-hosted dependency in every new location it links the dependency into, such as a new global virtual store slot or a fresh node_modules. When the side-effects cache holds the build output, pnpm restores it from there. Before, only the install that fetched the dependency built it. This also fixes dependencies that are already in the store #​17224.

• Changes a preResolution hook makes to the lockfiles now take effect. The hook now also runs when pnpm installs from an up-to-date lockfile. An error thrown by the hook now fails the install.

• A custom fetcher in the pnpmfile can now call fetchers.directory to fetch a package from a local directory. The call rejects with ERR_PNPM_TARBALL_INTEGRITY if the lockfile pins an archive integrity for the package. Previously, calling fetchers.directory failed with a TypeError.

• packageImportMethod: copy now also applies to packages that have lifecycle scripts or patches. On a filesystem that supports block cloning, such as ReFS or a Dev Drive on Windows, these packages were cloned #​17195.

• With nodeLinker: hoisted and autoInstallPeers: false, a package that workspace projects use with different peer versions is now installed once per peer variant, so each project's copy resolves that project's peer #​17395.

• Under nodeLinker: hoisted, pnpm install now leaves a patched package that is already in place alone. The same holds for a package whose peers include a patched package, such as every package peering on a patched react-native #​17188.

• With nodeLinker: hoisted, an install that stops partway no longer leaves the next install trusting the packages it was replacing. Before, reverting the change that started the stopped install, such as a patch edit, kept the half-replaced package in node_modules.

Repeat installs and changed settings

• A repeat pnpm install now acts on a change to these settings. Before, it reported "Already up to date".

  • storeDir or virtualStoreDir: it recreates node_modules.
  • globalVirtualStoreDir: it links the packages from the new directory.
  • virtualStoreDirMaxLength: it renames the virtual store directories.
  • dangerouslyAllowAllBuilds turned on: it runs the builds it skipped.
  • trustLockfile turned off: it verifies the lockfile.

• pnpm add, pnpm remove, and pnpm update now fail if node_modules does not match the current settings. Run pnpm install to recreate it. Previously, these commands removed and reinstalled node_modules without asking. They report:

  • ERR_PNPM_UNEXPECTED_STORE if node_modules was linked from a different store.
  • ERR_PNPM_UNEXPECTED_VIRTUAL_STORE if it was linked from a different virtual store directory.
  • ERR_PNPM_MODULES_BREAKING_CHANGE if it was installed by an incompatible pnpm version, or if node_modules/.modules.yaml cannot be read.
  • ERR_PNPM_NODE_LINKER_DIFF if it was installed with a different nodeLinker.

  pnpm update now also fails with ERR_PNPM_HOIST_PATTERN_DIFF and the other errors pnpm add reports for a changed hoist pattern or virtualStoreDirMaxLength.

• An install filtered to some workspace projects now fails if node_modules was installed with a different nodeLinker, hoistPattern, publicHoistPattern, store, or virtual store. Before, it recreated node_modules and left the projects it skipped without their dependencies. A pnpm install of the whole workspace still recreates node_modules pnpm/tasks#217.

• pnpm install and the verifyDepsBeforeRun check now notice an edited patch file when sharedWorkspaceLockfile is false.

• pnpm install now takes its fast path in a workspace with patchedDependencies when the previous install ran with another major version of pnpm.

• pnpm install now relinks the bins of a workspace package when its bin field changes, including with --frozen-lockfile and an unchanged lockfile. A filtered install relinks them in the selected projects, and the next install that covers the remaining projects relinks them there #​17324.

• pnpm install now removes command shims from node_modules/.bin when a workspace dependency renames or removes an entry from its bin field pnpm/tasks#211.

Resolving dependencies and the lockfile

• A package that a plain range and a <prefix>: specifier both resolve from one registry is now recorded once in pnpm-lock.yaml and installed once. The lockfile key names the registry a package resolved from. When that registry declares a prefix, through prefix in registries or through namedRegistries, the package is keyed <name>@<prefix>:<version> however its dependency was written: with the prefix, as a plain range its scope routes to that registry, or through the default registry. Before, the plain range was keyed <name>@<version>, so one tarball was installed twice and instanceof checks and module singletons broke between the two copies. The same name and version served by two registries still get separate entries. When several prefixes declare one registry, its packages are keyed by the lexicographically smallest prefix.

  If a scope you route reaches a registry that also declares a prefix, your next pnpm install re-keys those entries, which shows up as a lockfile diff. Commit it. pnpm install --frozen-lockfile installs the lockfile as recorded.

• pnpm install now resolves a scope's packages again when the scope is routed to another registry in registries. Before, the lockfile kept the versions and integrity resolved from the old registry, so the install failed when the new registry did not serve a locked version or served different content. pnpm records in the workspace state which registry each scope routed to, so a fresh clone without that record installs the lockfile as recorded. Changing the default registry resolves nothing again, and pnpm install --frozen-lockfile is unchanged.

• When autoDedupe is off, a workspace project's dependencies now resolve from its own ranges, like they do with sharedWorkspaceLockfile: false. Previously, another project's narrower range could hold them back. For example, ajv: "*" now resolves to the latest Ajv even if another project depends on ajv@^6. Packages that a project lists in peerDependencies still follow the versions other projects use. pnpm dedupe and installs with autoDedupe: true still pick one version that satisfies every range. Set autoDedupe: true if CI runs pnpm dedupe --check #​17235.

• An optional dependency written with a named-registry prefix, such as work:^1.0.0, now fails the install when it cannot be resolved but the lockfile already has a matching entry from that registry. Such a dependency was skipped, which removed its entries from the lockfile.

• With injectWorkspacePackages: true, a workspace: dependency written as a relative path, such as workspace:../lib-a, in a workspace package now resolves from that package's directory #​17284.

• Fixed pnpm install failing with ERR_PNPM_UNSUPPORTED_PROTOCOL when a workspace package injected through a relative path, such as workspace:../lib, has catalog: dependencies. Their catalog entries now resolve the way they do for a package injected by name #​17280.

• pnpm dedupe now refreshes cached registry metadata while re-resolving locked versions #​17208.

• pnpm dedupe --check no longer fails when the only difference is a deprecated notice that the registry added or removed after the lockfile was written #​17198.

• Installs delegated to a pnpr server now resolve every prefix declared for a registry URL. A dependency or lockfile entry that used the second of two prefixes for the same registry, such as zeta: next to work: in namedRegistries, failed on the server pnpm/tasks#204.

• Registry revisions are now addressed at <registry>/<name>@<version>+r<revision> pnpm/tasks#208.

Adding packages and global packages

• pnpm add <pkg>@<tag> and pnpm add <pkg>@<range> now install the version the tag or range resolves to, even when the saved range allows a newer one #​17234.

• pnpm add <pkg> without a version now installs the version under the dist-tag set by the tag setting. An npm: alias or a jsr: dependency without a version resolves that tag too. The setting is read from pnpm-workspace.yaml, the global config, PNPM_CONFIG_TAG, and --config.tag, and defaults to latest.

• pnpm add now accepts the lowercase short options -p, -d, -o, and -e as aliases of --save-prod, --save-dev, --save-optional, and --save-exact.

• pnpm -D install <pkg> now saves the package to devDependencies. An add option such as -D or -E written before install <pkg> was rejected as an unexpected argument.

• pnpm add -T now reports that the short option is ambiguous and points to --save-types and --tilde.

• Global packages installed with pnpm add -g are now linked from the global virtual store, so global packages that share dependencies share one copy. Set virtualStoreType: project to give each global install its own virtual store.

• pnpm add -g and the other --global commands now fail with ERR_PNPM_CONFIG_CONFLICT_VIRTUAL_STORE_DIR_WITH_GLOBAL when --virtual-store-dir is passed. A custom --hoist-pattern fails with ERR_PNPM_CONFIG_CONFLICT_HOIST_PATTERN_WITH_GLOBAL. Passing --link-workspace-packages, --shared-workspace-lockfile, or --config.lockfile-dir with --global also fails, with the matching ERR_PNPM_CONFIG_CONFLICT_*_WITH_GLOBAL code.

Registries, proxies, and login

• pnpm now reads the strictSsl and localAddress settings from pnpm-workspace.yaml, the global config.yaml, PNPM_CONFIG_* environment variables, and --config.* options. Th

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 4am on sunday,before 4am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.