Bump esbuild and @angular-devkit/build-angular in /frontend

[dependabot]

Bumps esbuild to 0.26.0 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates esbuild from 0.20.1 to 0.26.0

Release notes

Sourced from esbuild's releases.

v0.26.0

• Enable trusted publishing (#4281)

  GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.

  Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).

v0.25.12

• Fix a minification regression with CSS media queries (#4315)

  The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.

• Update the list of known JavaScript globals (#4310)

  This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

  From ES2017:

  • Atomics
  • SharedArrayBuffer

  From ES2020:

  • BigInt64Array
  • BigUint64Array

  From ES2021:

  • FinalizationRegistry
  • WeakRef

  From ES2025:

  • Float16Array
  • Iterator

  Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:

  // This can now be tree-shaken by esbuild:
  class ExampleIterator extends Iterator {}

• Add support for the new @view-transition CSS rule (#4313)

  With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):

  /* Original code */
  @view-transition {
    navigation: auto;
    types: check;
  }

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

• Fix regression with --define and import.meta (#4010, #4012, #4013)

  The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

  This fix was contributed by @​sapphi-red.

0.24.1

• Allow es2024 as a target in tsconfig.json (#4004)

  TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

  {
    "compilerOptions": {
      "target": "ES2024"
    }
  }

  As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

  This fix was contributed by @​billyjanitsch.

• Allow automatic semicolon insertion after get/set

  This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

  class Foo {
    get
    *x() {}
    set
    *y() {}
  }

  The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

• Allow quoted property names in --define and --pure (#4008)

  The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

• 17ff82b publish 0.26.0 to npm
• f87181f enable trusted publishing (#4319)
• fdece95 some deno-related fixes
• 38cf8bc add a dummy publish.yml
• 208f539 publish 0.25.12 to npm
• 5f03afd update release notes
• 6b2ee78 minify: remove css rules containing empty :is()
• f361deb add some additional known static methods
• 07aa646 automatically mark "RegExp.escape()" calls as pure
• 9039c46 simplify some call expression checks
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Updates @angular-devkit/build-angular from 17.3.17 to 21.0.0

Release notes

Sourced from @​angular-devkit/build-angular's releases.

21.0.0

@​angular/cli

Commit	Description
	add --json output to ng version
	add advanced filtering to MCP example search
	add ai-tutor mcp tool
	add builder info to list_projects MCP tool
	add fallback support for packages without direct ng add functionality
	add style language detection to list_projects tool
	add unit test framework detection to list_projects tool
	enhance ng version output with more details
	make documentation search tool version-aware
	make find_examples tool version-aware
	make get_best_practices tool version-aware
	overhaul ng version command output
	promote MCP find_examples tool to a stable tool
	provide detailed peer dependency conflict errors in ng add
	remove direct support for cnpm
	add schema versioning and metadata to example database
	add snippet support to example search MCP tool
	add vitest to version command output
	correct boolean parsing in MCP example front matter
	correct frontmatter parsing in MCP examples tool
	correct query in find_examples to prevent runtime error
	enhance find_examples MCP tool with structured output
	improve JSON schema parsing for command options
	improve list_projects MCP tool to find all workspaces in monorepos
	promote zoneless migration MCP tool to stable
	show planned actions in ng add dry run
	support multi-database search in find_examples MCP tool
	cache dependency lookups during ng add
	parallelize peer dependency checks in ng add

@​schematics/angular

Commit	Description
	Add addTypeToClassName option to relevant schematics
	add include option to jasmine-to-vitest schematic
	add AGENTS.md support to ai-config schematic
	add Jasmine spy API transformations to jasmine-to-vitest schematic
	add matcher transformations to jasmine-to-vitest schematic
	add misc transformations to jasmine-to-vitest schematic
	add Tailwind CSS option to application schematic and ng new
	Applications are zoneless by default
	configure Vitest for new projects and allow runner choice
	introduce initial jasmine-to-vitest unit test refactor schematic
	set packageManager in package.json on new projects
	support different file name style guides in ng new
	add 'update-typescript-lib' migration
	add addImports option to jasmine-vitest schematic

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

21.0.0 (2025-11-19)

Breaking Changes

@​angular/cli

• The ng commands will no longer automatically detect and use cnpm as the package manager. As an alternative use the .npmrc file to ensure npm uses the cnpm registry.

@​angular/build

• • TypeScript versions older than 5.9 are no longer supported.
• The javascriptEnabled option for Less is no longer supported. Projects relying on inline JavaScript within Less files will need to refactor their stylesheets to remove this dependency.

@​schematics/angular

Commit	Type	Description
e417c89f9	feat	Add addTypeToClassName option to relevant schematics
ede5e52bc	feat	add include option to jasmine-to-vitest schematic
c119910f4	feat	add AGENTS.md support to ai-config schematic
d0d2a17b8	feat	add Jasmine spy API transformations to jasmine-to-vitest schematic
e7d955bed	feat	add matcher transformations to jasmine-to-vitest schematic
629f5cb18	feat	add misc transformations to jasmine-to-vitest schematic
4912f3990	feat	add Tailwind CSS option to application schematic and ng new
2a518016d	feat	Applications are zoneless by default
2ffc527b1	feat	configure Vitest for new projects and allow runner choice
58474ec7d	feat	introduce initial jasmine-to-vitest unit test refactor schematic
9f255f2b3	feat	set packageManager in package.json on new projects
4e6c94f21	feat	support different file name style guides in ng new
77741f5ee	fix	add 'update-typescript-lib' migration
f89750b27	fix	add addImports option to jasmine-vitest schematic
9dab5780a	fix	add fixture.whenStable in spec files when zoneless apps
8f0f6a5f1	fix	add migration to update moduleResolution to bundler
e8feba9ee	fix	add missing typeSeparator to main.ts.template file
515b09c4f	fix	add Vitest config generation and runner checks
0e83fe1a8	fix	add warnings and improve Karma config generation
b91fa31f2	fix	align Karma project generation with unified unit-test builder
c967a447c	fix	correct spacing in application spec tsconfig
00d941c43	fix	correct style guide paths for standalone components
e33e77d12	fix	flag '--file-name-style-guide=2016' - wrong import in main.ts
f35b9f331	fix	improve comment preservation in jasmine-to-vitest
6615fcf03	fix	issues in apps generated with '--file-name-style-guide=2016' flag
e304821d5	fix	make ai-config schematic non-destructive
512ad282a	fix	preserve blank lines in jasmine-to-vitest schematic
b524ba426	fix	remove empty i18n-extract target for new projects
8e6e0a293	fix	remove explicit flag for host bindings
afb4d3e37	fix	remove extra space before async in spec templates
b983ea8e5	fix	respect skip-install for tailwind schematic
54c4eae2a	fix	transform Jasmine type annotations in jasmine-to-vitest schematic
14c0a9bac	perf	optimize AST traversal utilities

... (truncated)

Commits

• a06ccb3 release: cut the v21.0.0 release
• 9257e3f build: update FW and ng-packagr dependencies for major release
• 3655ad3 release: cut the v21.0.0-rc.6 release
• e33e77d fix(@​schematics/angular): flag '--file-name-style-guide=2016' - wrong import ...
• 907c899 release: cut the v21.0.0-rc.5 release
• fa5c923 fix(@​angular/build): prioritize string type for runnerConfig schema
• e8feba9 fix(@​schematics/angular): add missing typeSeparator to main.ts.template file
• 6615fcf fix(@​schematics/angular): issues in apps generated with '--file-name-style-gu...
• f7c9f26 test(@​angular/build): temporarily disable Vitest coverage check on Windows
• e0a8183 test: improve vitest e2e test stability and performance
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.