…t in unit-test builder

The unit-test builder did not pass the preserveSymlinks configuration to Vitest's custom configuration plugin and resolved it directly from buildTargetOptions in Karma executor without considering process arguments. This caused module resolution failures in unit tests for symlinked packages.

This change inherits preserveSymlinks from the referenced buildTarget options, falling back to process.execArgv if not defined. The resolved value is then successfully forwarded to the underlying bundlers and executors (Karma and Vitest).

(cherry picked from commit dc27e17)

Injects '@angular/localize/init' at the top of the internal virtual initialization file (angular:test-bed-init) if '@angular/localize' is installed in the workspace. This prevents ReferenceErrors when testing libraries that consume localization APIs.

Also updates the warning plugin to skip internal imports originating from the 'angular:' namespace.

(cherry picked from commit 75c1dce)

See associated pull request for more information.

… logic

Querying version target returns the resolved range/tag specifier instead of the resolved specific version number if the installed CLI version is outdated. This allows the package manager to natively enforce release-age policies (like pnpm's `minimum-release-age` or yarn's `npmMinimalAgeGate`) and select an appropriate older version during temporary installation rather than crashing.

(cherry picked from commit edb4594)

…d handler

Catch `PackageManagerError` in the global `CommandModule` handler and gracefully log the installation failure message along with the process output (stdout/stderr) using `logger.fatal`.

This ensures that any package manager error thrown during the execution of a command is reported cleanly to the terminal and sets the exit code to 1.

(cherry picked from commit 010cef6)

…sr-dev-server builder

spawnAsObservable() was joining command and args into a single string
before passing to spawn(). In startNodeServer(), outputPath from angular.json
was embedded in args with manual shell quoting and shell: true.

Bash evaluates $() inside double-quoted strings, so a crafted outputPath
value in angular.json can trigger arbitrary command execution on ng serve.

Fix: pass command and args separately to spawn() so Node.js uses execve()
directly. Remove the manual quoting around path and drop shell: true.

(cherry picked from commit 2d3eb7f)

When unit testing library targets with the unit-test builder, the build
target (ng-packagr) does not have a 'polyfills' configuration. This
caused the builder to fall back to the 'dynamic' zone testing strategy,
which only dynamically imports zone.js/testing at runtime if Zone is
already defined. Since the main zone.js library was never loaded, Zone
was undefined, and library tests relying on TestBed/fakeAsync failed.

This commit introduces a new 'dynamic-zone' zone testing strategy. If
polyfills is undefined (meaning we are running a library target) and
zone.js is installed/resolvable, both zone.js and zone.js/testing are
dynamically imported at startup, resolving the failure.

Fixes #33477

(cherry picked from commit 61e25fb)

Previously, when a redirect was triggered, any custom headers (such as cookies or cache control) configured on the RESPONSE_INIT object by components or guards were lost because the redirect response was created with the default headers only.

Closes #33473

(cherry picked from commit d9fb854)

…s to prevent parent paths

Ensure that custom resolvers created via createRequire use the strict paths resolution option when checking for the presence of local packages (such as zone.js, @angular/localize, @angular/core, or vitest test environments). This prevents Node's resolver from using the parent module context (located inside the virtual store .pnpm) and falsely finding packages that are not direct dependencies of the project.

(cherry picked from commit 0010b92)

(cherry picked from commit 0b3172e)

See associated pull request for more information.

See associated pull request for more information.