fix(@angular/build): skip HTML fallback for dotfile requests

The HTML fallback middleware currently rewrites dotfile requests
(e.g., /.env, /.npmrc) to /index.html, returning 200 instead of 404.
This change skips the SPA fallback when the last URL path segment
starts with a dot, providing a small defense-in-depth improvement
for the dev server.

Made-with: Cursor

Author: instantraaamen

packages/angular/build/src/tools/vite/middlewares/html-fallback-middleware.ts

@@ -27,6 +27,15 @@ export function angularHtmlFallbackMiddleware(
   }
 
   if (req.url) {
+    // No fallback for dotfile requests (e.g., .env, .npmrc)
+    const pathname = req.url.split('?')[0];
+    const lastSegment = pathname.substring(pathname.lastIndexOf('/') + 1);
+    if (lastSegment.startsWith('.')) {
+      next();
+
+      return;
+    }
+
     const mimeType = lookupMimeTypeFromRequest(req.url);
     if (
       (mimeType === 'text/html' || mimeType === 'application/xhtml+xml') &&