Replaces #186 - Fixing critical vulnerabilities (superseded by this PR)
Breaking Changes
Minimum Angular version is now 18.0.0
browserTarget is actively rejected with helpful error message ("Use buildTarget instead")
Key Changes
Angular 20+ Compatibility
Handle missing outputPath in Angular 20+ projects
Default browser to 'browser' when outputPath object omits it
CI tests against Angular 18, 19, 20, and 21
gh-pages v6 Upgrade (Security)
Fixes critical vulnerability reported in #185
Native CNAME and .nojekyll file creation (delegated to gh-pages)
Commander Fork
We forked commander v3.0.2 to preserve critical --no- flag behavior that broke in newer versions:
Angular CLI passes --no-dotfiles as { noDotfiles: true }, NOT { dotfiles: false }
Modern commander versions changed this behavior
Our fork maintains backwards compatibility while stripping unused features (subcommands, action handlers)
npm Trusted Publishers
This package now uses provenance statements with OIDC. Every published version includes cryptographic provenance attestation. You can verify that the npm package was built from this exact GitHub repository, from a specific commit, through a transparent CI pipeline. Deployed by @JohannesHoppe.
Improved CI Metadata
GitHub Actions: Now includes build URL (/actions/runs/{id}) - parity with Travis/CircleCI
Travis CI: Uses TRAVIS_BUILD_WEB_URL (works for .com and enterprise)
Documentation
Added --no-notfound and --no-nojekyll to standalone CLI docs
