Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(@angular/build): update vite to version 5.4.14 #29472

Merged
merged 4 commits into from
Jan 27, 2025

Conversation

clydin
Copy link
Member

@clydin clydin commented Jan 24, 2025

Version update from 5.4.6 to address advisory GHSA-vg6x-rcgg-rjx6

Vite version 5.4.12+, which is now used by the Angular CLI with the application/browser-esbuild builders, contains a potentially breaking change for some development setups. Examples of such setups include those that use reverse proxies or custom host names during development. The change within a patch release was made by Vite to address a security vulnerability. For projects that directly access the development server via localhost, no changes should be needed. However, some development setups may now need to adjust the allowedHosts development server option. This option can include an array of host names that are allowed to communicate with the development server. The option sets the corresponding Vite option within the Angular CLI. For more information on the option and its specific behavior, please see the Vite documentation located here:
https://vite.dev/config/server-options.html#server-allowedhosts

The following is an example of the configuration option allowing example.com:

"serve": {
      "builder": "@angular-devkit/build-angular:dev-server",
      "options": {
        "allowedHosts": ["example.com"]
      },

@clydin clydin added the target: lts This PR is targeting a version currently in long-term support label Jan 24, 2025
@clydin clydin force-pushed the vite-allowed-hosts-18.2.x branch from f273866 to fd8c847 Compare January 24, 2025 14:11
Version update from 5.4.6 to address advisory GHSA-vg6x-rcgg-rjx6

Vite version 5.4.12+, which is now used by the Angular CLI with the `application`/`browser-esbuild`
builders, contains a potentially breaking change for some development setups. Examples of such
setups include those that use reverse proxies or custom host names during development.
The change within a patch release was made by Vite to address a security vulnerability.
For projects that directly access the development server via `localhost`, no changes should
be needed. However, some development setups may now need to adjust the
`allowedHosts` development server option. This option can include an array
of host names that are allowed to communicate with the development server. The option
sets the corresponding Vite option within the Angular CLI.
For more information on the option and its specific behavior, please see the Vite
documentation located here:
https://vite.dev/config/server-options.html#server-allowedhosts

The following is an example of the configuration option allowing `example.com`:
```
"serve": {
      "builder": "@angular-devkit/build-angular:dev-server",
      "options": {
        "allowedHosts": ["example.com"]
      },
```
@clydin clydin force-pushed the vite-allowed-hosts-18.2.x branch from fd8c847 to 9849b94 Compare January 24, 2025 14:27
…wn error: Chrome failed to start: crashed`

This fixes an issue where protractor integration tests are failing with

```
[07:38:37] I/direct - Using ChromeDriver directly...
[07:38:39] E/launcher - unknown error: Chrome failed to start: crashed.
  (unknown error: DevToolsActivePort file doesn't exist)
```

(cherry picked from commit 0718e1b)
…der during `ng add`

When using the `ng add` command, the package version selection logic was not correctly selected based on the available versions in desc order. This could lead to selecting an unintended version of the package.

Closes: angular#28985
(cherry picked from commit 4ef45ec)
Temporary disable this test due to

```
Failed to launch local browser installed at /home/runner/.cache/bazel/_bazel_runner/f47b8283cc0f5922f9455b06771398a1/sandbox/processwrapper-sandbox/410/execroot/angular_cli/bazel-out/k8-fastbuild/bin/tests/legacy-cli/e2e.npm_node22.sh.runfiles/org_chromium_chromium_linux_x64/chrome-linux/chrome. This could be because of a mismatch between the version of puppeteer and Chrome or Chromium. Try updating either of them, or adjust the executablePath option to point to another browser installation. Use the --puppeteer flag to run tests with bundled compatible version of Chromium.

dist/test-out/c48222bb-ca34-455e-bc1b-122521e1e71e/app.component.spec.js:
```

(cherry picked from commit 307eda1)
@clydin clydin added the action: merge The PR is ready for merge by the caretaker label Jan 27, 2025
@clydin clydin merged commit 50c6817 into angular:18.2.x Jan 27, 2025
28 of 30 checks passed
@clydin clydin deleted the vite-allowed-hosts-18.2.x branch January 27, 2025 17:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
action: merge The PR is ready for merge by the caretaker area: @angular/build area: @angular/cli target: lts This PR is targeting a version currently in long-term support
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants