Description

After upgrading Vite from 7.3.1 to 7.3.2, all Vitest tests that involve Angular components with external templates fail with:

Error: Denied ID /path/to/project/libs/ui/src/lib/components/button/button.component.html?raw
File: /path/to/project/libs/ui/src/lib/components/button/button.component.html?raw
❯ loadAndTransform node_modules/vite/dist/node/chunks/config.js:22620:33
❯ doTransform node_modules/vite/dist/node/chunks/config.js:22597:17

Root Cause

Vite 7.3.2 includes security fixes (GHSA-v2wj-q39q-566r, GHSA-4w7w-66w2-5vf9) that tighten server.fs enforcement for ?raw query parameters. The
@analogjs/vite-plugin-angular plugin resolves Angular templateUrl references as ?raw imports internally, which are now blocked by Vite's stricter
file system access checks.

Reproduction

1. Create an Angular project using @analogjs/vite-plugin-angular with Vitest
2. Have a component with templateUrl: './my.component.html'
3. Upgrade Vite to 7.3.2
4. Run tests → all component tests fail with "Denied ID" errors

Workaround

Adding server.fs.allow to the Vite config resolves the issue, but weakens the security fix:

server: {       
  fs: {
    allow: [__dirname],                                                                                                                                   
  },
},                                                                                                                                                        
                
Environment

- @analogjs/vite-plugin-angular: 2.4.0 (also reproduced with 2.2.3)                                                                                       
- @analogjs/vitest-angular: 2.4.0
- vite: 7.3.2                                                                                                                                             
- vitest: 3.2.4 
- Angular: 20