Merge branch 'master' into mstoyanova/adding-skill

Author: kdinev

.github/codeql/custom-queries-javascript/ShellSanitizer.qll

@@ -0,0 +1,17 @@
+import javascript
+import semmle.javascript.security.dataflow.CommandInjectionCustomizations
+
+
+// General flow via config https://codeql.github.com/docs/codeql-language-guides/analyzing-data-flow-in-javascript-and-typescript/#sanitizers
+// Instead this follows https://github.com/github/codeql/blob/a3e9aed00ae5c1e70da8fbc4fc4a7cc803f177ca/javascript/documentation/library-customization.rst?plain=1#L244-L245
+// to modify the pre-defined javascript CommandInjection flow's Sanitizer
+
+/**
+ * Treat Util.sanitizeShellArg(x) as a sanitizer for shell‑command injection.
+ */
+class ShellArgSanitizer extends CommandInjection::Sanitizer {
+	ShellArgSanitizer() {
+		this.(DataFlow::MethodCallNode).getReceiver().toString() = "Util" and
+		this.(DataFlow::MethodCallNode).getMethodName() = "sanitizeShellArg"
+	}
+}

.github/codeql/custom-queries-javascript/qlpack.yml

@@ -0,0 +1,4 @@
+name: igniteui-cli-custom-javascript-queries
+version: 0.0.0
+dependencies:
+  codeql/javascript-queries: "*"

.github/workflows/codeql-analysis.yml

@@ -49,6 +49,7 @@ jobs:
         # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
+        queries: ./.github/codeql/custom-queries-javascript
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)

CHANGELOG.md

@@ -1,3 +1,16 @@
+## [14.9.2](https://github.com/IgniteUI/igniteui-cli/compare/14.9.1...14.9.2) (2026-03-11)
+
+### What's Changed
+* fix(igx-ts): update igniteui-angular versions and remove overrides by @Hristo313 in https://github.com/IgniteUI/igniteui-cli/pull/1508
+* fix(igx-ts): fix eslint configurations by @Hristo313 in https://github.com/IgniteUI/igniteui-cli/pull/1509
+* fix(upgrade-packages): correctly glob files on windows by @damyanpetev in https://github.com/IgniteUI/igniteui-cli/pull/1511
+* fix(igx-ts-legacy): fix grid type import and add missing override by @Hristo313 in https://github.com/IgniteUI/igniteui-cli/pull/1519
+* Fix start and other npm exec commands by @damyanpetev in https://github.com/IgniteUI/igniteui-cli/pull/1520
+* fix(schematics): fs writeFile create check by @damyanpetev in https://github.com/IgniteUI/igniteui-cli/pull/1526
+* fix(packages): disable non-functional registry login attempt on upgrade by @damyanpetev in https://github.com/IgniteUI/igniteui-cli/pull/1528
+
+**Full Changelog**: https://github.com/IgniteUI/igniteui-cli/compare/14.9.1...14.9.2
+
 ## [14.9.1](https://github.com/IgniteUI/igniteui-cli/compare/14.9.0...14.9.1) (2026-02-25)
 
 ### What's Changed
@@ -6,7 +19,6 @@
 
 **Full Changelog**: https://github.com/IgniteUI/igniteui-cli/compare/14.9.0...14.9.1
 
-
 # [14.9.0](https://github.com/IgniteUI/igniteui-cli/compare/v14.8.5...14.9.0) (2026-02-25)
 
 🎉 This update includes:

packages/cli/lib/commands/start.ts

@@ -7,16 +7,16 @@ import { PositionalArgs, StartCommandType } from "./types";
 import { ArgumentsCamelCase } from "yargs";
 
 const execSyncNpmStart = (port: number, options: ExecSyncOptions): void => {
-	const args = ['start'];
 	if (port) {
 		// Validate port is a number to prevent command injection
 		if (!Number.isInteger(port) || port < 0 || port > 65535) {
 			Util.error(`Invalid port number: ${port}`, "red");
 			return;
 		}
-		args.push('--', `--port=${port}`);
+		Util.execSync(`npm start -- --port=${port}`, options);
+		return;
 	}
-	Util.spawnSync('npm', args, options);
+	Util.execSync(`npm start`, options);
 };
 
 const command: StartCommandType = {

packages/cli/lib/templates/AngularTemplate.ts

@@ -45,7 +45,7 @@ export class AngularTemplate implements Template {
 	}
 
 	public registerInProject(projectPath: string, name: string, options?: AddTemplateArgs) {
-		let modulePath = "app.module.ts";
+		let modulePath = "app-module.ts";
 		if (options && options.modulePath) {
 			modulePath = options.modulePath;
 		}
@@ -63,7 +63,7 @@ export class AngularTemplate implements Template {
 			//1) import the component class name,
 			//2) and populate the Routes array with the path and component
 			//for example: { path: "combo", component: ComboComponent }
-			const routingModulePath = path.join(projectPath, "src/app/app-routing.module.ts");
+			const routingModulePath = path.join(projectPath, "src/app/app-routing-module.ts");
 			const routingModule = new TsUpdate(routingModulePath, false, { singleQuotes: false });
 
 			routingModule.addRoute({
@@ -84,7 +84,7 @@ export class AngularTemplate implements Template {
 		mainModule.addNgModuleMeta({
 			declare: [className],
 			from: relativePath,
-			export: modulePath !== "app.module.ts" ? [className] : []
+			export: modulePath !== "app-module.ts" ? [className] : []
 		});
 		mainModule.finalize();
 

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "igniteui-cli",
-  "version": "14.9.1",
+  "version": "14.9.2",
   "description": "CLI tool for creating Ignite UI projects",
   "keywords": [
     "CLI",
@@ -76,8 +76,8 @@
     "all": true
   },
   "dependencies": {
-    "@igniteui/angular-templates": "~21.1.1491",
-    "@igniteui/cli-core": "~14.9.1",
+    "@igniteui/angular-templates": "~21.1.1492",
+    "@igniteui/cli-core": "~14.9.2",
     "@inquirer/prompts": "^7.9.0",
     "@types/yargs": "^17.0.33",
     "chalk": "^5.3.0",

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@igniteui/cli-core",
-  "version": "14.9.1",
+  "version": "14.9.2",
   "description": "Base types and functionality for Ignite UI CLI",
   "repository": {
     "type": "git",

packages/core/packages/PackageManager.ts

@@ -1,11 +1,14 @@
-import { spawn } from "child_process";
+import { exec } from "child_process";
 import * as path from "path";
 import { TemplateManager } from "../../cli/lib/TemplateManager";
 import { Config, FS_TOKEN, IFileSystem, ProjectTemplate } from "../types";
 import { App, ProjectConfig, Util } from "../util";
 
 import componentsConfig = require("./components");
 
+/** @internal */
+export const REGISTRY_ATTEMPT_LOGIN = false;
+
 export class PackageManager {
 	private static ossPackage: string = "ignite-ui";
 	private static fullPackage: string = "@infragistics/ignite-ui-full";
@@ -45,6 +48,10 @@ export class PackageManager {
 			const version = ossVersion ? `@"${ossVersion}"` : "";
 			const errorMsg = "Something went wrong, " +
 				"please follow the steps in this guide: https://www.igniteui.com/help/using-ignite-ui-npm-packages";
+			Util.log(
+				"The project you've created requires the full version of Ignite UI from Infragistics private feed.",
+				"gray"
+			);
 			// fallback to @latest, in case when igniteui-full does not have a matching version to ossVersion
 			// ex: "ignite-ui": "^21.1.13" BUT  --> ignite-ui-full": "^21.1.11" (no 21.1.13 released).
 			// TODO: update temp fix - only working in 21.1.11 without errors
@@ -88,9 +95,8 @@ export class PackageManager {
 		const config = ProjectConfig.localConfig();
 		if (!config.packagesInstalled) {
 			let command: string;
-			let managerCommand: string;
+			const managerCommand = this.getManager();
 
-			managerCommand = this.getManager();
 			switch (managerCommand) {
 				case "npm":
 				/* passes through */
@@ -123,49 +129,52 @@ export class PackageManager {
 	}
 
 	public static removePackage(packageName: string, verbose: boolean = false): boolean {
+		let command: string;
 		const managerCommand = this.getManager();
-		let args: string[];
+		const sanitizePackage = Util.sanitizeShellArg(packageName);
 		switch (managerCommand) {
 			case "npm":
 			/* passes through */
 			default:
-				args = ['uninstall', packageName, '--quiet', '--save'];
+				command = `${managerCommand} uninstall ${sanitizePackage} --quiet --save`;
 				break;
 		}
 		try {
 			// tslint:disable-next-line:object-literal-sort-keys
-			Util.spawnSync(managerCommand, args, { stdio: "pipe", encoding: "utf8" });
+			Util.execSync(command, { stdio: "pipe", encoding: "utf8" });
 		} catch (error) {
-			Util.log(`Error uninstalling package ${packageName} with ${managerCommand}`);
+			Util.log(`Error uninstalling package ${sanitizePackage} with ${managerCommand}`);
 			if (verbose) {
 				Util.log(error.message);
 			}
 			return false;
 		}
 
-		Util.log(`Package ${packageName} uninstalled successfully`);
+		Util.log(`Package ${sanitizePackage} uninstalled successfully`);
 		return true;
 	}
 
 	public static addPackage(packageName: string, verbose: boolean = false): boolean {
 		const managerCommand = this.getManager();
-		const args = this.getInstallArgs(packageName);
+		const sanitizePackage = Util.sanitizeShellArg(packageName);
+		const command = this.getInstallCommand(managerCommand, sanitizePackage);
 		try {
 			// tslint:disable-next-line:object-literal-sort-keys
-			Util.spawnSync(managerCommand, args, { stdio: "pipe", encoding: "utf8" });
+			Util.execSync(command, { stdio: "pipe", encoding: "utf8" });
 		} catch (error) {
-			Util.log(`Error installing package ${packageName} with ${managerCommand}`);
+			Util.log(`Error installing package ${sanitizePackage} with ${managerCommand}`);
 			if (verbose) {
 				Util.log(error.message);
 			}
 			return false;
 		}
-		Util.log(`Package ${packageName} installed successfully`);
+		Util.log(`Package ${sanitizePackage} installed successfully`);
 		return true;
 	}
 
 	public static async queuePackage(packageName: string, verbose = false) {
-		const args = this.getInstallArgs(packageName).map(arg => arg === '--save' ? '--no-save' : arg);
+		const command = this.getInstallCommand(this.getManager(), Util.sanitizeShellArg(packageName))
+			.replace("--save", "--no-save");
 		const [packName, version] = packageName.split(/@(?=[^\/]+$)/);
 		const packageJSON = this.getPackageJSON();
 		if (!packageJSON.dependencies) {
@@ -190,24 +199,13 @@ export class PackageManager {
 		// D.P. Concurrent install runs should be supported
 		// https://github.com/npm/npm/issues/5948
 		// https://github.com/npm/npm/issues/2500
-		const managerCommand = this.getManager();
 		const task = new Promise<{ packageName, error, stdout, stderr }>((resolve, reject) => {
-			const child = spawn(managerCommand, args);
-			let stdout = '';
-			let stderr = '';
-			child.stdout?.on('data', (data) => {
-				stdout += data.toString();
-			});
-			child.stderr?.on('data', (data) => {
-				stderr += data.toString();
-			});
-			child.on('close', (code) => {
-				const error = code !== 0 ? new Error(`Process exited with code ${code}`) : null;
-				resolve({ packageName, error, stdout, stderr });
-			});
-			child.on('error', (err) => {
-				resolve({ packageName, error: err, stdout, stderr });
-			});
+			const child = exec(
+				command, {},
+				(error, stdout, stderr) => {
+					resolve({ packageName, error, stdout, stderr });
+				}
+			);
 		});
 		task["packageName"] = packName;
 		this.installQueue.push(task);
@@ -233,16 +231,17 @@ export class PackageManager {
 	}
 
 	public static ensureRegistryUser(config: Config, message: string): boolean {
-		const fullPackageRegistry = config.igPackageRegistry;
+		const fullPackageRegistry = Util.sanitizeShellArg(config.igPackageRegistry);
 		try {
 			// tslint:disable-next-line:object-literal-sort-keys
-			Util.spawnSync('npm', ['whoami', `--registry=${fullPackageRegistry}`], { stdio: 'pipe', encoding: 'utf8' });
+			Util.execSync(`npm whoami --registry=${fullPackageRegistry}`, { stdio: "pipe", encoding: "utf8" });
 		} catch (error) {
+			if (!REGISTRY_ATTEMPT_LOGIN) {
+				Util.log(message, "gray");
+				return true;
+			}
+
 			// try registering the user:
-			Util.log(
-				"The project you've created requires the full version of Ignite UI from Infragistics private feed.",
-				"gray"
-			);
 			Util.log(
 				"We are initiating the login process for you. This will be required only once per environment.",
 				"gray"
@@ -257,20 +256,16 @@ export class PackageManager {
 			if (process.stdin.isTTY) {
 				process.stdin.setRawMode(true);
 			}
-			const cmd = /^win/.test(process.platform) ? "npm.cmd" : "npm"; //https://github.com/nodejs/node/issues/3675
-			const login = Util.spawnSync(cmd,
-				["adduser", `--registry=${fullPackageRegistry}`, `--scope=@infragistics`, `--auth-type=legacy`],
-				{ stdio: "inherit" }
-			);
-			if (login?.status === 0) {
+
+			try {
+				Util.execSync(
+					`npm login --registry=${fullPackageRegistry} --scope=@infragistics --auth-type=legacy`,
+					{ stdio: "inherit" }
+				);
 				//make sure scope is configured:
-				try {
-					Util.spawnSync('npm', ['config', 'set', `@infragistics:registry`, fullPackageRegistry]);
-					return true;
-				} catch (error) {
-					return false;
-				}
-			} else {
+				Util.execSync(`npm config set @infragistics:registry ${fullPackageRegistry}`);
+				return true;
+			} catch (error) {
 				Util.log(message, "red");
 				return false;
 			}
@@ -292,11 +287,7 @@ export class PackageManager {
 		}
 	}
 
-	private static getInstallArgs(packageName: string): string[] {
-		return ['install', packageName, '--quiet', '--save'];
-	}
-
-	private static getManager(/*config:Config*/): string {
+	private static getManager(/*config:Config*/): 'npm' {
 		//stub to potentially swap out managers
 		return "npm";
 	}

packages/core/update/Update.ts

@@ -55,7 +55,7 @@ export async function updateWorkspace(rootPath: string): Promise<boolean> {
 	}
 	const pkgJSON = JSON.parse(fileString);
 
-	const errorMsg = "Something went wrong, please follow the steps in this guide: " + guideLink;
+	const errorMsg = "Can't detect/setup Infragistics feed login required for licensed packages.\nSee: " + guideLink;
 	if (!PackageManager.ensureRegistryUser(config, errorMsg)) {
 		return false;
 	}