Interpolating GitHub context values directly into `run:` steps creates
an expression-injection vector. Move the affected values into an `env:`
block and reference them as environment variables in the shell script
instead. This prevents shell metacharacters in context values from
altering step behaviour.
Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>
(cherry picked from commit d43acaf80c)
Bind spyOn explicitly to Window so Jasmine uses the DOM setTimeout signature that returns a number instead of the Node.js Timeout type. Remove the unsafe any cast and the obsolete TODO.
(cherry picked from commit 24a3c63976)
The DevTools state screens (Angular not detected, unsupported version,
production build) showed a plain Material icon above the message. Show
the Angie mascot instead, matching the treatment already used across
angular.dev (the 404 page, empty search, the preview error state).
Each screen uses a pose that fits its message: the dizzy `error` pose for
"application not detected", `coding-01` for the version-upgrade prompt,
and `sad` for the production build notice.
(cherry picked from commit d4f2313e4d)
If a directive has an input declared as `dismissible = input<boolean>(true, {transform: booleanAttribute});` then the following templates were not compiling:
```
<div directiveName dismissible="true"></div>
<div directiveName dismissible></div>
```
This commit fixes the issue, without breaking contravariant consumers.
(cherry picked from commit 0ae6d81ed2)
The NAMED_FORMATS and DATE_FORMATS caches were plain objects read with a
truthy check keyed by a token from the format string, so a token matching
an inherited Object member (e.g. `__proto__`) resolved to a prototype
value. Create both caches with a null prototype so only real entries are
returned.
(cherry picked from commit 359fb503b8)
Native text `<input type="text">` controls do not support `null` values.
When a Signal Forms model bound to a text input is set to `null`, the value
is silently coerced to an empty string.
(cherry picked from commit 37f3279fe7)
Updates the template parser to detect and ignore processing instruction syntax (e.g. `<? foo ?>` or `<? foo >`). Currently it is being printed out as text.
Fixes#34371.
(cherry picked from commit 68ac204074)
The cookie consent popup showed only text and two buttons. Add the
Angie greeting pose to it so the first thing a new visitor sees carries
the same mascot treatment already used across the docs (the 404 page,
empty search results, the preview error state).
The message and mascot sit in a flex header row; the two action buttons
now share the row equally so they fill the card instead of leaving a
trailing gap. Layout only, the consent behaviour is unchanged.
(cherry picked from commit 6a3487f7b7)
Move the DebugSignalGraph, DebugSignalGraphEdge, and DebugSignalGraphNode interfaces from packages/core/src/render3/util/signal_debug.ts into the packages/core/primitives/devtools/src package. This decouples the signal graph debug types from runtime render3 utilities and allows devtools and internal core tooling to import them directly from primitives as type-only exports.
(cherry picked from commit d997a96b47)
Replace the lazy quantifier (.+?) with a negated character class
([^\s*]+) that excludes whitespace and asterisks. Source map URLs
never contain these characters, so the fix is semantically
equivalent while eliminating the O(n²) backtracking path triggered
by unclosed /*# sourceMappingURL= fragments.
Fixes: polynomial ReDoS in addBaseHrefToCssSourceMap
(cherry picked from commit fb6b354fbd)
When `HttpClient` is called from within an `effect()` or other reactive
context, any signal reads performed inside HTTP interceptors were
inadvertently tracked by that context. This caused the effect to
re-execute whenever those signals changed, regardless of whether the
signal was semantically related to the HTTP call.
The fix wraps the interceptor chain invocation in `untracked()` so that
signal reads inside interceptors — both functional (`withInterceptors`)
and class-based (`withInterceptorsFromDi`) — are invisible to the
calling reactive context. This matches the precedent set by the resource
API, which also wraps its loader in `untracked()` for the same reason.
Fixes#58682
(cherry picked from commit 6d043f8657)
TypeScript reuses SourceFile objects between old and new programs, so untagging the old program also untags shared files in the new program. Re-apply shim tags on the new program to prevent getSemanticDiagnostics() crashes with TS 5.5+.
(cherry picked from commit ae0ec7315c)
The error snack bar (the chunk-load reload prompt and the embedded
editor's memory / mobile alerts) showed only text and an action button.
Add an Angie press-kit pose to the left of the message so the failure
state matches the mascot treatment already used for the preview error
card and the empty search states.
The pose is data-driven: ErrorSnackBarData gains a required `pose` field
so each caller picks the mascot that fits the message tone (`greeting`
for the docs-updated reload prompt and the mobile notice, `error` for
the out-of-memory warning). The message moves into a `<p>` that flexes
to fill the row, keeping the action button aligned to the right.
Presentation only; when and why the snack bar appears is unchanged.
(cherry picked from commit d5e0b131ed)
PR #68946 removed the "Open in Firebase Studio" (Project IDX) launcher
from the embedded editor, but left its supporting configuration behind:
a per-tutorial `idx/dev.nix` workspace file in seven tutorials, plus an
`'idx'` entry in `excludeFromRoot` whose only job was to keep those
folders out of the StackBlitz/download bundle.
With the launcher gone nothing reads these files anymore, so remove the
seven `dev.nix` configs and the now-dead `'idx'` exclude entry.
(cherry picked from commit f6a00ffde5)
Fenced shell code blocks prepended a `$` prompt to every rendered line via a CSS `::before`, including blank lines are not commands to run.
(cherry picked from commit aca7371431)
The Console tab's error-count badge lives in an `<ng-template
mat-tab-label>`, but the component didn't import `MatTabLabel`, so
Material ignored the templated label and fell back to the plain
"Console" text. Import it so the badge renders when there are errors.
(cherry picked from commit f94da4d5ca)
When the embedded editor fails to boot the preview sandbox, the error
card showed only a text message. Add the press-kit Error pose above the
message so the failure state matches the mascot treatment already used
for the loading steps and the empty search states.
The card is also centered in the preview pane (previously pinned 5% from
the top) so the pose and message read as one block. Behaviour is
unchanged; this is presentation only.
(cherry picked from commit 72cc548d34)
The search dialog picked its empty state ("Start typing" vs "No results
found") with `!resultsResource.hasValue()`, which during a re-query looks
identical to a freshly opened dialog since the resource resets its value and
reports `loading`. This flipped the message and mascot back to "Start typing"
mid-search, causing a question -> magnifying-glass -> question flicker on every
keystroke. Add an `emptyState` signal that holds the previous state while a
search is settling, so the dialog only changes once results resolve.
(cherry picked from commit e6378eb330)
In the WebMCP specification, tools are unregistered by aborting the `AbortSignal` provided in `registerTool(tool, {signal})`. The deprecated `unregisterTool` method on `ModelContext` is no longer needed or part of the standard, and is now removed from the TypeScript interface definition.
(cherry picked from commit ce4f7adc95)
This reverts commit 9b9b0e93c9.
This broke g3. Not sure yet why it didn't break externally. We can
investigate and fix following this revert.
(cherry picked from commit 1fb4678207)
`translate()` looked up substitutions with `message.substitutions.hasOwnProperty(placeholder)`. A message whose placeholder is named `hasOwnProperty` stores that key on the plain substitutions object, shadowing the method, so the lookup calls the substitution value and throws a TypeError. Use `Object.hasOwn` instead, which resolves through `Object` and is unaffected by the shadowed key, matching the recent `I18nSelectPipe` fix.
(cherry picked from commit 2a4f582731)
Register the custom writeback test control as an NG_VALUE_ACCESSOR
so it is recognized as a valid formField host during debounce
writeback testing.
(cherry picked from commit 12fe700ad8)
Use controlValue() instead of value() when synchronizing
ControlValueAccessor instances.
When debounce is active, value() can still contain the
previous model value while controlValue() reflects the
latest user-entered value. This prevents stale values
from being written back to the CVA before the debounce
is flushed.
Adds a regression test covering the debounce scenario.
(cherry picked from commit 2e0cb52dbf)
This is a follow-up to #67997, which allowed explicit read generics with input transforms, such as `input<boolean>(false, {transform: booleanAttribute})`.
That fixed the declaration, but static template attributes like `dismissible="true"` and bare `dismissible` were still checked as strings against the read type. Allow the fallback write type to include static attribute strings so these template forms compile.
(cherry picked from commit 9b9b0e93c9)
The ng-add walkthrough references two files it never shows: the
collection points to `ng-add/schema.json` and `index.ts` imports its
`Schema` interface from `ng-add/schema.ts`. Add the missing code blocks,
mirroring the generation-support section, so the example is complete.
Fixes#57005
(cherry picked from commit 454af71609)
While the embedded editor's preview sandbox boots, the pane shows a plain
text label for each step (Booting, Creating project, Installing packages,
Initializing dev server). Add an Angie pose above the label so the wait
tells a small story. Behaviour is unchanged; this is presentation only.
Poses map to the existing LoadingStep values:
Starting / Booting / Creating project -> greeting
Installing packages -> coding-01
Initializing dev server -> superhero
The mascot sits in a fixed-size box (object-fit: contain) so swapping
poses of different aspect ratios never shifts the label or progress bar.
(cherry picked from commit c92d995260)
Add a dedicated error reference page for NG05703 (suspicious URL origin
change during SSR) and update the error to use RuntimeError with a
negative code so the error message automatically includes a link to the
docs page in both dev and production builds.
Update affected tests in url_spec.ts, platform_location_spec.ts, and
integration_spec.ts to match the new NG05703-prefixed error message
format.
Fixes: #69667
(cherry picked from commit 13b6bbd6a0)
Even if we have an `EmptyExpr`, add that expression to the expressions array when a literal is parsed.
The lack of the expression results in a discrepancy in the sizes of the `elements` and the `expressions`
arrays of a `TemplateLiteral`, that result in an error when we visit that same literal due to the missing
expression.
Fixes#69699
(cherry picked from commit da52137724)
loadTranslations stores parsed translations into the shared global
$localize.TRANSLATIONS keyed by message id. Those ids come verbatim from
the translations map (typically parsed from a translation file), so a
translation whose id is __proto__ assigns through the inherited __proto__
setter, reparenting the map rather than storing the entry (and throwing
under --disable-proto=throw). Create the map with Object.create(null) in
loadTranslations and clearTranslations so __proto__ is an ordinary key.
(cherry picked from commit 5de0ea5f23)
When a parent form element defines an async validator, its resource's `params` function needs to evaluate `syncValid()`, which causes unvisited child form nodes to be lazily instantiated. If any of these lazily instantiated child nodes also define an async validator, their resource is initialized while the parent's `params` function is still evaluating. This incorrectly triggers Angular core's `NG0992` guard (`Cannot create a resource inside the params of another resource`).
This commit exports `ɵsetInParamsFunction` and `ɵisInParamsFunction` from `@angular/core` and uses them in `FieldMetadataState.runMetadataCreateLifecycle` to explicitly detach the lazy creation of form metadata from the parent's reactive `params` context.
fixes#69620
(cherry picked from commit 5cb8c733a3)
Replaces the plain "Page Not Found" text with the sad Angie mascot
speaking the message from a speech bubble, for a warmer, more on-brand
not-found page. Copy is unchanged and the "Feeling lucky?" search
results are untouched.
The sad pose is added as an SVG asset (cropped tight to the artwork) under
assets/images/angie/. The mascot is decorative (aria-hidden), and it scales
down to stay beside the bubble on mobile.
(cherry picked from commit 3ac2c7b2bc)
Matthew Beck