build: update cross-repo angular dependencies

[angular-robot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@angular/animations (source)	22.2.0-next.7 → 22.2.0-rc.0
@angular/build	22.2.0-next.7 → 22.2.0-rc.0
@angular/cdk	22.2.0-next.5 → 22.2.0-rc.0
@angular/cli	22.2.0-next.7 → 22.2.0-rc.0
@angular/common (source)	22.2.0-next.7 → 22.2.0-rc.0
@angular/compiler (source)	22.2.0-next.7 → 22.2.0-rc.0
@angular/compiler-cli (source)	22.2.0-next.7 → 22.2.0-rc.0
@angular/core (source)	22.2.0-next.7 → 22.2.0-rc.0
@angular/fire	21.0.0-rc.0 → 21.0.0-rc.1
@angular/forms (source)	22.2.0-next.7 → 22.2.0-rc.0
@angular/material	22.2.0-next.5 → 22.2.0-rc.0
@angular/platform-browser (source)	22.2.0-next.7 → 22.2.0-rc.0
@angular/router (source)	22.2.0-next.7 → 22.2.0-rc.0

---

• If you want to rebase/retry this PR, check this box

---

Release Notes

angular/angular (@​angular/animations)

v22.2.0-rc.0: 22.2.0-rc.0

Compare Source

compiler

Commit	Description
	wrap @for collection expression before appending non-null assertion

compiler-cli

Commit	Description
	add strictUnclaimedEventNames option to catch misspelled output bindings

core

Commit	Description
	return null when getDirectiveMetadata is called with null or undefined
	update FakeNavigation to match WHATWG HTML spec

forms

Commit	Description
	mark control as dirty before setting its value in FVC interop

router

Commit	Description
	maintain frozen state on rollback until resource loading completes
	mark router_resource module-level symbols as side-effect free

angular/angular-cli (@​angular/build)

v22.2.0-rc.0: 22.2.0-rc.0

Compare Source

@​angular/cli

Commit	Description
	skip eager yargs help message formatting during command execution

@​angular/build

Commit	Description
	include inline component stylesheets in referenced watch files
	pass load cache to compiler plugin and escape extension regex in polyfills
	prevent stale bundler caching and correctly resolve load cache
	key Sass package resolutions without containing URL qualification

angular/components (@​angular/cdk)

v22.2.0-rc.0: 22.2.0-rc.0

Compare Source

material-luxon-adapter

Commit	Description
	add option to set zone (#​33579)

material

Commit	Description
	core: generate Material Symbols in schematic (#​33797)
	icon: false positive in font detection (#​33805)

cdk

Commit	Description
	table: update rows when row definitions change (#​33670)
	testing: use directive fixture onDestroy (#​33793)

angular/angularfire (@​angular/fire)

v21.0.0-rc.1

Compare Source

What's Changed

Upgrading to v21

• fix: ng update @angular/fire updates your project's firebase dependency to the supported ^12.18.0, and ng add aligns it during setup, preventing duplicated-SDK installs by @​armando-navarro in #​3722
• fix: require rxfire 6.2.0 or newer. Older rxfire versions ask for firebase 11, which can install a second Firebase SDK copy next to your firebase 12. by @​armando-navarro in #​3723
• build: require firebase 12.18.0 or newer. AngularFire wraps four new Cloud Messaging functions: onRegistered, onUnregistered, register and unregister. by @​armando-navarro in #​3761
• build: require Angular 21.2 or newer. Angular 21 is in long-term support, which ships only critical fixes and security patches, so 21.2 is the final 21.x minor line. Projects still on Angular 21.0 or 21.1 should run ng update @angular/core @angular/cli before updating AngularFire. by @​armando-navarro in #​3763
• fix: drop the @angular/fire/ai import of the removed Imagen API, which made fresh installs fail to build against firebase 12.18.0. ng update warns remaining Imagen users with migration guidance. by @​armando-navarro in #​3750
• feat: ng update @angular/fire rewrites imports from the removed Vertex AI module to its replacement, @angular/fire/ai (Firebase AI Logic), including the renamed symbols, and a new guide covers upgrading from AngularFire 20 to 21 by @​armando-navarro in #​3725
• fix: ng update @angular/fire uses AgentPlatformBackend instead of the deprecated VertexAIBackend. Location defaults to global instead of us-central1. The migration warns for every file whose region changed. by @​armando-navarro in #​3762

Setting up (ng add)

• feat: ng add @angular/fire warns when multiple versions of firebase are installed, and shows the dependency chain. Prevents various hard-to-diagnose bugs. by @​armando-navarro in #​3760
• fix: ng add generates working @angular/fire/ai imports when the AI feature is selected, instead of imports from a removed module path. Docs updated to use the Firebase AI Logic naming. by @​coturiv in #​3685
• fix: remove the @angular/platform-browser-dynamic peer dependency, which made ng add @angular/fire fail with ERESOLVE on Angular 20.1 and newer. by @​armando-navarro in #​3718
• fix: ng add writes only accepted keys into the app config, which previously did not compile. The whole Firebase CLI response was inlined into initializeApp(), including management fields such as projectNumber that FirebaseOptions rejects, producing TS2769. by @​armando-navarro in #​3707
• feat: ng add @angular/fire and selecting Firestore generates a .firebaserc file, a firestore.rules file, and a firestore.indexes.json file. by @​armando-navarro in #​3714
• fix: ng add @angular/fire@next records prerelease installs as the exact installed version. Prevents later installs replacing your chosen AngularFire release candidate. by @​armando-navarro in #​3709
• fix: ng add @angular/fire prints a helpful message when no features are selected. Previously, the setup ended silently, as if it had worked. by @​armando-navarro in #​3717
• fix: log the caught error when dataconnect.yaml parsing fails, instead of discarding it by @​armando-navarro in #​3711
• fix: accept firebase-tools 15. Eliminates peer dependency warnings on install for projects on the current Firebase CLI. by @​armando-navarro in #​3702
• fix: update the firebase-tools version check error message. by @​Muneersahel in #​3662

Deploying (ng deploy)

• fix: ng deploy no longer crashes on launch with ERR_INVALID_ARG_TYPE. The schematics ship as a CommonJS bundle, which turned the code's import.meta lookup into undefined before it reached any real work. by @​armando-navarro in #​3729
• fix: the Cloud Function generated for SSR now asks for Node 22, instead of Node 14, a runtime Cloud Functions decommissioned in early 2025. by @​armando-navarro in #​3743
• fix: the generated Cloud Function imports region from the firebase-functions/v1 subpath, where firebase-functions 6 moved it. Calling it from the package root threw on the function's first request. by @​armando-navarro in #​3743
• fix: the Cloud Function generated for SSR now uses a public firebase-functions logger entry point, instead of an internal path that crashed the function at startup by @​armando-navarro in #​3730
• fix: the package.json generated for SSR deployments declares firebase-admin with a real, installable range. It was omitted even though firebase-functions requires it at load time, so the deployed function could crash with Cannot find module 'firebase-admin/app-check'. by @​armando-navarro in #​3745
• fix: declare the three packages the schematics require at runtime (jsonc-parser, @angular-devkit/core, @angular-devkit/architect). The published package.json never listed them, so ng deploy failed to resolve modules under pnpm's default layout and Yarn Plug'n'Play. by @​armando-navarro in #​3747
• fix: ng deploy writes the generated entry paths with forward slashes regardless of the deploying machine. Running it from Windows with the Cloud Run SSR option wrote backslash paths, which the Linux-based Cloud Run runtime cannot resolve. by @​fr-esco in #​3274

Security hardening

• fix: ng deploy no longer places values read from angular.json into shell commands, closing a command-injection hole by @​herdiyana256 in #​3738
• fix: the code and Dockerfile that ng deploy generates for SSR now escape or validate the angular.json values they interpolate (output path, function name, Node version). A crafted value could previously place arbitrary code in the generated files. by @​herdiyana256 in #​3739
• fix: ng deploy passes gcloud arguments as an array. It previously built the command as one string and re-split it on whitespace, so a deploy option containing a space (a region, project, or function name from angular.json) could smuggle extra flags into the gcloud invocation. by @​herdiyana256 in #​3726
• fix: the provideDataConnect(...) call that ng add generates escapes the values it takes from your dataconnect.yaml/connector.yaml. A value containing a quote character could previously place arbitrary code in the generated file. by @​herdiyana256 in #​3727

CI and repository health

• ci: upgrade the Java version used by the test emulators from 11 to 21. Current firebase-tools requires Java 21 or newer, so every emulator-backed CI job had been failing at emulator startup. This change is what turned the repo's test pipeline green again. by @​mwilman in #​3687
• ci: resolve the zizmor security findings in the GitHub Actions workflows by @​jhuleatt in #​3700

Documentation

• docs: the quickstart and README match what ng add actually does today, with current scaffold names, the Firebase Hosting and App Hosting deploy paths, and the prerequisites called out up front by @​armando-navarro in #​3736
• docs: the auth guide's Server-side Rendering section is rewritten around a verified working setup. The old snippet did not compile, and each of the four required steps explains what silently breaks without it. by @​armando-navarro in #​3740
• docs: new guide, Deploying SSR to App Hosting, including how to detect and fix the silent fallback to client-side rendering by @​armando-navarro in #​3720
• docs: new Data Connect guide, linked from the README feature table by @​armando-navarro in #​3724
• docs: new injection-context recipe showing how to keep AngularFire calls in an injection context in async code by @​armando-navarro in #​3721
• docs: the copy-paste samples in the product guides compile as written again by @​armando-navarro in #​3732
• docs: fix stale links and grammar, remove obsolete doc files by @​armando-navarro in #​3734
• docs: log the token value in the auth idToken example by @​armando-navarro in #​3728
• docs: import the pipes correctly in the route-guard examples by @​Erick2280 in #​3623
• docs: the auth guide's user$ example references the injected this.auth by @​arolleaguekeng in #​3640
• docs: fix invalid code in the README's Firestore example by @​dominicbachmann in #​3661
• docs: fix a mismatched observable name in the README's @for example by @​IdanCo in #​3606

Sample app and code cleanup

• chore: the sample app now runs on Angular 21 as the v21 CLI generates it (zoneless change detection, incremental hydration, Express 5), with a working Cloud Functions demo on Node 22 by @​markgoho in #​3671
• build: classify which newer firebase functions AngularFire should wrap, and how. Adds a docs/zones.md section on what a call outside an injection context loses, and removes an ng update migration that did nothing. by @​armando-navarro in #​3759
• refactor: derive the firebase-tools version message from a shared constant, so the message and the check cannot drift apart again by @​armando-navarro in #​3704
• build: declare the ES2022 standard library in the tsconfigs by @​armando-navarro in #​3706
• chore: fix a misspelled variable name in the deploy builder by @​Damiencastro in #​3567

New Contributors

• @​mwilman made their first contribution in #​3687
• @​jhuleatt made their first contribution in #​3700
• @​Muneersahel made their first contribution in #​3662
• @​dominicbachmann made their first contribution in #​3661
• @​arolleaguekeng made their first contribution in #​3640
• @​IdanCo made their first contribution in #​3606
• @​Damiencastro made their first contribution in #​3567
• @​armando-navarro made their first contribution in #​3702
• @​coturiv made their first contribution in #​3685
• @​herdiyana256 made their first contribution in #​3738
• @​fr-esco made their first contribution in #​3274

Action required when upgrading: update firebase together with @angular/fire

AngularFire 21 requires firebase version 12.18.0 or newer. If your project's own package.json still requests firebase 11 (typical for apps coming from AngularFire 20), npm will not report a conflict. It silently installs BOTH SDK versions side by side, and the two copies reject each other's objects at runtime. This one situation caused the three most-reported rc.0 bugs: the Firestore Expected type 'Query' crash (#​3684), the Timestamp.toDate() type error (#​3681), and the Realtime Database too much recursion error (#​3682).

• ng update @angular/fire fixes this automatically: the #​3722 migration updates your firebase dependency to ^12.18.0 and reinstalls.
• Upgrading by hand? Run npm install firebase@^12 together with the AngularFire update, then check npm ls firebase shows a single version.

Thanks to everyone who tested rc.0 and reported issues. The reports on #​3684, #​3681, and #​3682 are what identified the duplicated-SDK cause, and they are why ng update can correct it for you.

Full Changelog: angular/angularfire@21.0.0-rc.0...21.0.0-rc.1

[gemini-code-assist]

Code Review

This pull request updates various Angular dependencies, including @angular/cdk, @angular/material, @angular/build, and @angular/cli, from pre-release next versions to the 22.2.0-rc.0 release candidate across multiple package files and workspaces. It also updates the corresponding lockfiles (pnpm-lock.yaml), which includes upgrading transitive dependencies such as Babel, Sass, Vite, and Zod. There are no review comments to address, and I have no additional feedback to provide.