Navigating to specific ARIA guide pages directly or via hard refresh
causes a 404 error because the payload exceeds the default SSR fetch
limit. This commit increases the maxResponseBodySize to 2MB.
(cherry picked from commit 02d6b436f1)
Mark the iframe `credentialless` attribute as security-sensitive so dynamic
bindings are handled consistently with other iframe attributes that affect the
initial navigation, such as `sandbox`, `allow`, `referrerPolicy`, `csp`, and
`fetchPriority`.
Because `credentialless` must be present before the iframe starts loading to
affect the navigation’s credential mode, late dynamic updates can leave the final
DOM looking correct while the initial request was not loaded credentiallessly.
(cherry picked from commit 0152e3cbdf)
The "Creating an injectable service" tutorial introduced services with
`@Injectable({providedIn: 'root'})`, even though the essentials guide and
the in-depth dependency injection guides have already moved to the newer
`@Service` decorator. This left the tutorial out of step with the rest of
the documentation.
Update steps 19 and 20 to use `@Service()`. Because `@Service()` is an
ergonomic shorthand for `@Injectable({providedIn: 'root'})`, the examples
behave identically while teaching the recommended modern API. The step 19
README is reworked to match: it drops the now-unnecessary `providedIn`
configuration step and adds a note linking to the in-depth services guide
for the `autoProvided: false` opt-out.
(cherry picked from commit cbccd368af)
The homepage hero lays out the announcement banner and the search field on
the same flex row. The `.search-field` wrapper was a plain block, so its
`docs-text-field` kept its intrinsic height instead of filling the row,
leaving the two pills at different heights and vertically misaligned.
Make `.search-field` a flex container so the search control stretches to the
row height and matches the banner.
(cherry picked from commit 4ba8ba4ef2)
On tablet the social and theme mini-menus didn't line up with the buttons that
open them.
All three mini-menus now share one tablet positioning rule on `.adev-mini-menu`
that centers each panel under its trigger, with `--social`/`--theme`/`--version`
modifiers selecting the anchor; the version picker's on-screen behavior is
unchanged. The social trigger also gains `aria-controls` + a matching menu `id`
for a11y parity with the theme trigger.
(cherry picked from commit 50e7f3a1cd)
Follow-up to #69205. After switching adev's COEP to `credentialless`, the
cross-origin YouTube iframe in `<docs-video>` loads in Chromium and Safari but
not Firefox, whose `credentialless` policy does not extend to nested frames. The
result was a COEP error screen instead of the player.
Render `<docs-video>` as a lightweight thumbnail facade instead of embedding the
iframe directly. The thumbnail is a cross-origin subresource, so it loads under
`credentialless` in every browser. `DocViewer` then upgrades the facade to the
inline player on hydration in browsers that can load the embed (Chromium,
Safari), preserving the previous behavior there. On Firefox the facade stays a
plain link that opens the video on YouTube (with autoplay), which replaces the
error screen.
The thumbnail uses `maxresdefault` and falls back to `hqdefault` when a video
has no max-resolution image.
(cherry picked from commit 43acead06d)
In #67382 we changed how values are resolved which ended up being a breaking change for some unit tests.
fixes#69360
(cherry picked from commit 3b8bb7219b)
Add font family, size and weight to the `.docs-primary-btn`. This guarantees that applying the class to non-button elements, like anchors, will results in the same visual representation.
(cherry picked from commit 91ab7c6dea)
Do not store HTTP transfer cache entries when either the request or response
uses `Cache-Control: no-store`, `Cache-Control: private`, or
`Cache-Control: no-cache`.
Also skip transfer cache when requests use the Fetch API `cache` option with
`no-store` or `no-cache`.
Because transfer cache serializes SSR HTTP responses into the rendered HTML,
Angular now treats these directives conservatively to avoid exposing sensitive
or explicitly uncacheable data through `TransferState`.
PR Close#69316
Treat HttpClient requests using `credentials: 'include'` and `same-origin` as credentialed
when deciding whether a response can be stored in the HTTP transfer cache.
The transfer cache already skips requests with `withCredentials`, `Cookie`,
`Authorization`, or `Proxy-Authorization` because those responses may contain
user-specific data. Fetch-backed requests can express the same credentialed
behavior through the `credentials` option, so these responses must not be
serialized into the SSR HTML.
This keeps credentialed SSR responses out of TransferState and aligns the
cache eligibility check with the fetch request options supported by HttpClient.
PR Close#69316
Update the AI codegen resources for Angular v22:
- best-practices.md: OnPush is the default in v22+ (don't set it explicitly),
recommend Signal Forms, and recommend the @Service decorator.
- llms.txt: add a Signal Forms reference, the httpResource guide, and an
Accessibility section linking the Angular Aria overview.
(cherry picked from commit 248e9c146d)
adev is cross-origin isolated (COOP same-origin + COEP require-corp) so the
embedded WebContainer editor can use SharedArrayBuffer. Under require-corp the
cross-origin YouTube iframe in `<docs-video>` only loaded in Chromium, leaving
the player blank in Safari.
Switch COEP from `require-corp` to `credentialless`. The page stays cross-origin
isolated, so the editor keeps working, but cross-origin frames are now allowed
to load, which restores the inline player in Safari as well.
(cherry picked from commit 86cd166141)
Drops `position: absolute` from the version picker `<ul>` and tightens `max-height` to `70dvh` so the cdk-overlay-pane fits the viewport and the inner scroll reaches the last versions on mobile and desktop.
(cherry picked from commit 7d92cc8b46)
The "Override current locale for CurrencyPipe" example used `{{ amount | currency: 'en-US' }}`, but the first `CurrencyPipe` argument is the currency code, not the locale, so `'en-US'` was treated as an invalid currency code (rendered literally as the symbol) and the locale was never overridden. Since `locale` is the fourth positional argument, the example now passes a valid currency code, display, and digits before it (`'USD' : 'symbol' : '1.2-2' : 'en-US'`), matching the parameter order shown on the CurrencyPipe API page.
(cherry picked from commit a82f822057)
Reveal code copy controls on hover and focus so long code snippets stay readable while keyboard access and copy state feedback remain intact.
(cherry picked from commit b7cb5844cf)
The v22 event hero PNG shipped with a wide transparent margin baked into
its 960x540 canvas. Under the shared `img { width: 100% }` rule that empty
border stretched along with the artwork, leaving visible space around the
image. Trims the canvas to the artwork bounds (831x473) so it renders
flush; the retained pixels are unchanged and the file shrinks from about
795 KB to 568 KB.
(cherry picked from commit af7cb63151)
The my-lib schematics-for-libraries example still declared `^21.0.0`
peerDependencies, the only adev example left on the previous major. Bumps
`@angular/common`/`@angular/core` to `^22.0.0`, matching the current major
and this file's stable-`^N.0.0` bump pattern.
Also adds this example's package.json to .prettierignore: it contains
`// #docregion` markers consumed by the schematics-for-libraries guide, and
Prettier's json-stringify parser (used for any package.json) rejects those as
invalid JSON. Editing the file surfaced this pre-existing incompatibility in
the format check.
(cherry picked from commit 3960ad64e5)
Rename the tutorial and example template packages' package.json.template files to package.json on disk.
To comply with ng_package limitations (which forbids floating package.json files in package output), we added a copy_file rule in the BUILD files to generate the .template files during build/packaging, and excluded the source package.json files from the filegroups. This keeps package.json as standard files in the source tree while preserving docs packaging and runtime logic.
(cherry picked from commit ba59de563f)
The aria autocomplete examples list "Turkey" in their country data, but
the country's official name is "Türkiye". Update all nine app.ts variants
to use it.
While there, remove a junk "Imporant" entry from the highlight/retro
variant's list, which is not a country and was a misspelled stray paste.
(cherry picked from commit 192ac021e4)
- Validate storedSha and storedBranch from _build-info.json.
- Validate latestSha returned from GitHub API.
- Validate branch in GithubClient.getShaForBranch and baseSha/headSha in GithubClient.getAffectedFiles.
- Use execFileSync instead of execSync to avoid shell execution.
TAG=agy
CONV=4e3e69ba-3f3d-416b-9ce4-9ef75486d2f3
(cherry picked from commit 3093edcad0)
Angular Robot