Regression locating assets in node_modules when using workspaces.

[mshima]

Command

build

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

21.2.12

Description

Adding assets from packages started failing in 21.2.13 when the dependency is deduped in workspaces root.

assets: [
  {
    "glob": "axios.min.js",
    "input": "node_modules/axios/dist/",
    "output": "swagger-ui/"
  },
  {
    "glob": "{*.{png,css},swagger-ui-{bundle,standalone-preset}.js}",
    "input": "node_modules/swagger-ui-dist/",
    "output": "swagger-ui/"
   }
]

It now throws An unhandled exception occurred: The /home/runner/work/generator-jhipster/generator-jhipster/app/node_modules/axios/dist/ asset path must be within the workspace root..

Minimal Reproduction

https://github.com/jhipster/generator-jhipster/actions/runs/26615477703/job/78430139830?pr=33605

Exception or Error

An unhandled exception occurred: The /home/runner/work/generator-jhipster/generator-jhipster/app/node_modules/axios/dist/ asset path must be within the workspace root.

Your Environment

_                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/


Angular CLI       : 21.2.13
Angular           : 21.2.15
Node.js           : 24.14.1
Package Manager   : npm 11.12.1
Operating System  : darwin arm64

┌───────────────────────────┬───────────────────┬───────────────────┐
│ Package                   │ Installed Version │ Requested Version │
├───────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build            │ 21.2.13           │ ^21.2.13          │
│ @angular/cli              │ 21.2.13           │ ^21.2.13          │
│ @angular/common           │ 21.2.15           │ ^21.2.0           │
│ @angular/compiler         │ 21.2.15           │ ^21.2.0           │
│ @angular/compiler-cli     │ 21.2.15           │ ^21.2.0           │
│ @angular/core             │ 21.2.15           │ ^21.2.0           │
│ @angular/forms            │ 21.2.15           │ ^21.2.0           │
│ @angular/platform-browser │ 21.2.15           │ ^21.2.0           │
│ @angular/router           │ 21.2.15           │ ^21.2.0           │
│ rxjs                      │ 7.8.2             │ ~7.8.0            │
│ typescript                │ 5.9.3             │ ~5.9.2            │
│ vitest                    │ 4.1.7             │ ^4.0.8            │
└───────────────────────────┴───────────────────┴───────────────────┘

Anything else relevant?

No response

[alan-agius4]

This change is actually intended behavior and part of a recent security hardening effort.

We intentionally restricted assets from outside of the workspace directory from being accessed. While we previously blocked this for explicit string paths, a bug allowed glob patterns to bypass the check. This update simply closes that loophole to ensure consistent security boundaries across the workspace.