chore(deps): bump vite and @angular-devkit/build-angular

[dependabot[bot]]

Bumps vite to 6.0.11 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates vite from 5.4.6 to 6.0.11

Release notes

Sourced from vite's releases.

v6.0.11

Please refer to CHANGELOG.md for details.

v6.0.10

Please refer to CHANGELOG.md for details.

v6.0.9

This version contains a breaking change due to security fixes. See https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v6.0.8

Please refer to CHANGELOG.md for details.

v6.0.7

Please refer to CHANGELOG.md for details.

v6.0.6

Please refer to CHANGELOG.md for details.

v6.0.5

Please refer to CHANGELOG.md for details.

v6.0.4

Please refer to CHANGELOG.md for details.

v6.0.3

Please refer to CHANGELOG.md for details.

v6.0.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.0.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.0.0

Please refer to CHANGELOG.md for details.

v6.0.0-beta.10

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

6.0.11 (2025-01-21)

• fix: preview.allowedHosts with specific values was not respected (#19246) (aeb3ec8), closes #19246
• fix: allow CORS from loopback addresses by default (#19249) (3d03899), closes #19249

6.0.10 (2025-01-20)

• fix: try parse server.origin URL (#19241) (2495022), closes #19241

6.0.9 (2025-01-20)

• fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (bd896fb)
• fix!: default server.cors: false to disallow fetching from untrusted origins (b09572a)
• fix: verify token for HMR WebSocket connection (029dcd6)

6.0.8 (2025-01-20)

• fix: avoid SSR HMR for HTML files (#19193) (3bd55bc), closes #19193
• fix: build time display 7m 60s (#19108) (cf0d2c8), closes #19108
• fix: don't resolve URL starting with double slash (#19059) (35942cd), closes #19059
• fix: ensure server.close() only called once (#19204) (db81c2d), closes #19204
• fix: resolve.conditions in ResolvedConfig was defaultServerConditions (#19174) (ad75c56), closes #19174
• fix: tree shake stringified JSON imports (#19189) (f2aed62), closes #19189
• fix: use shared sigterm callback (#19203) (47039f4), closes #19203
• fix(deps): update all non-major dependencies (#19098) (8639538), closes #19098
• fix(optimizer): use correct default install state path for yarn PnP (#19119) (e690d8b), closes #19119
• fix(types): improve ESBuildOptions.include / exclude type to allow readonly (string | RegExp)[] (ea53e70), closes #19146
• chore(deps): update dependency pathe to v2 (#19139) (71506f0), closes #19139

6.0.7 (2025-01-02)

• fix: fix minify when builder.sharedPlugins: true (#19025) (f7b1964), closes #19025
• fix: skip the plugin if it has been called before with the same id and importer (#19016) (b178c90), closes #19016
• fix(html): error while removing vite-ignore attribute for inline script (#19062) (a492253), closes #19062
• fix(ssr): fix semicolon injection by ssr transform (#19097) (1c102d5), closes #19097
• perf: skip globbing for static path in warmup (#19107) (677508b), closes #19107
• feat(css): show lightningcss warnings (#19076) (b07c036), closes #19076

6.0.6 (2024-12-26)

... (truncated)

Commits

• a0ed405 release: v6.0.11
• 3d03899 fix: allow CORS from loopback addresses by default (#19249)
• aeb3ec8 fix: preview.allowedHosts with specific values was not respected (#19246)
• 9654348 release: v6.0.10
• 2495022 fix: try parse server.origin URL (#19241)
• a55f8ba release: v6.0.9
• bd896fb fix!: check host header to prevent DNS rebinding attacks and introduce `serve...
• 029dcd6 fix: verify token for HMR WebSocket connection
• b09572a fix!: default server.cors: false to disallow fetching from untrusted origins
• c0f72a6 release: v6.0.8
• Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 18.2.8 to 19.1.3

Release notes

Sourced from @​angular-devkit/build-angular's releases.

v19.1.3

19.1.3 (2025-01-20)

@​angular/build

Commit	Description
	allow asset changes to reload page on incremental updates
	handle relative @ng/components
	perform full reload for templates with $localize usage

v19.1.2

19.1.2 (2025-01-17)

@​angular/build

Commit	Description
	perform incremental background file updates with component updates
	prevent full page reload on HMR updates with SSR enabled
	reset component updates on dev-server index request

v19.1.1

19.1.1 (2025-01-16)

@​angular/build

Commit	Description
	resolve HMR-prefixed files in SSR with Vite

v19.1.0

19.1.0 (2025-01-15)

@​schematics/angular

Commit	Description
	use @angular/build package in library generation schematic
	application migration should migrate ng-packagr builder package

@​angular-devkit/architect

Commit	Description
	require build schemas from modules
	avoid Node.js resolution for relative builder schema

@​angular-devkit/core

Commit	Description
	handle Windows drive letter case insensitivity in path functions

@​angular-devkit/schematics

Commit	Description
	update Rule type to support returning a Promise of Tree

@​angular/build

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

19.1.3 (2025-01-20)

@​angular/build

Commit	Type	Description
7d8c34172	fix	allow asset changes to reload page on incremental updates
9fa29af37	fix	handle relative @ng/components
c4de34703	fix	perform full reload for templates with $localize usage

19.1.2 (2025-01-17)

@​angular/build

Commit	Type	Description
939d1612a	fix	perform incremental background file updates with component updates
304027207	fix	prevent full page reload on HMR updates with SSR enabled
148acbd58	fix	reset component updates on dev-server index request

19.1.1 (2025-01-16)

@​angular/build

Commit	Type	Description
298506751	fix	resolve HMR-prefixed files in SSR with Vite

19.1.0 (2025-01-15)

Deprecations

@​angular/build

• The baseHref option under i18n.locales and i18n.sourceLocale in angular.json is deprecated in favor of subPath.

  The subPath defines the URL segment for the locale, serving as both the HTML base HREF and the directory name for output. By default, if not specified, subPath will use the locale code.

... (truncated)

Commits

• 4508725 release: cut the v19.1.3 release
• 3ce086a test: improve stability of strategy tests
• 2114f02 build: ensure source maps are used for jasmine stack traces
• e5e0947 build: migrate @angular-devkit/architect-cli tests to rules_js
• 4700c5d build: migrate @angular-devkit/schematics tests to rules_js
• c9bf07d build: migrate @angular-devkit/core tests to rules_js
• d278d94 build: migrate @angular/cli tests to use rules_js
• 676ce57 build: ensure package substitutions work with pnpm workspace:* links
• 7afc051 test(@​angular/build): enable i18n localize watch test for dev-server
• c4de347 fix(@​angular/build): perform full reload for templates with $localize usage
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.