fix(@angular/cli): resolve executables strictly from PATH

Update executable invocation logic to resolve system binaries (such as `git` and `which`) strictly from the `PATH` environment variable.

This prevents bare command names passed to `execFileSync` / `execFile` from implicitly searching and resolving binaries relative to `process.cwd()` on Windows.

Fixes #33755

Author: alan-agius4

packages/angular/cli/src/commands/update/utilities/git.ts

@@ -8,6 +8,9 @@
 
 import { execFileSync } from 'node:child_process';
 import * as path from 'node:path';
+import { findExecutableOnPath } from '../../../utilities/executable';
+
+let cachedGitPath: string | undefined;
 
 /**
  * Execute a git command.
@@ -16,7 +19,9 @@ import * as path from 'node:path';
  * @returns The output of the command.
  */
 function execGit(args: string[], input?: string): string {
-  return execFileSync('git', args, { encoding: 'utf8', stdio: 'pipe', input });
+  cachedGitPath ??= findExecutableOnPath('git') ?? 'git';
+
+  return execFileSync(cachedGitPath, args, { encoding: 'utf8', stdio: 'pipe', input });
 }
 
 /**

packages/angular/cli/src/utilities/completion.ts

@@ -16,6 +16,7 @@ import { getWorkspace } from '../utilities/config';
 import { forceAutocomplete } from '../utilities/environment-options';
 import { isTTY } from '../utilities/tty';
 import { assertIsError } from './error';
+import { findExecutableOnPath } from './executable';
 import { askConfirmation } from './prompt';
 
 /** Interface for the autocompletion configuration stored in the global workspace. */
@@ -271,7 +272,8 @@ function getShellRunCommandCandidates(shell: string, home: string): string[] | u
 export function hasGlobalCliInstall(): Promise<boolean> {
   // List all binaries with the `ng` name on the user's `$PATH`.
   return new Promise<boolean>((resolve) => {
-    execFile('which', ['-a', 'ng'], (error, stdout) => {
+    const whichPath = findExecutableOnPath('which') ?? 'which';
+    execFile(whichPath, ['-a', 'ng'], (error, stdout) => {
       if (error) {
         // No instances of `ng` on the user's `$PATH`
 

packages/angular/cli/src/utilities/executable.ts

@@ -0,0 +1,55 @@
+/**
+ * @license
+ * Copyright Google LLC All Rights Reserved.
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.dev/license
+ */
+
+import { existsSync } from 'node:fs';
+import { delimiter, extname, join } from 'node:path';
+
+/**
+ * Searches the `PATH` environment variable for a given executable binary name.
+ * On Windows, checks extensions in `PATHEXT` (e.g. `.exe`, `.cmd`) if no extension is given.
+ * Returns the absolute path of the binary if found on `PATH`, or `undefined` if not found.
+ *
+ * This prevents `execFileSync` / `spawn` from implicitly resolving executables
+ * relative to `process.cwd()` on Windows when passed bare command names.
+ *
+ * @param binaryName Name of the binary to search for (e.g. 'git').
+ * @returns The absolute path to the binary if found on `PATH`, or `undefined`.
+ */
+export function findExecutableOnPath(binaryName: string): string | undefined {
+  const envPath = process.env.PATH || process.env.Path || '';
+  if (!envPath) {
+    return undefined;
+  }
+
+  const isWindows = process.platform === 'win32';
+  const pathExt = process.env.PATHEXT
+    ? process.env.PATHEXT.split(delimiter)
+    : ['.com', '.exe', '.bat', '.cmd'];
+
+  const hasExt = isWindows && extname(binaryName) !== '';
+  const extensions = isWindows && !hasExt ? pathExt : [''];
+
+  for (const dir of envPath.split(delimiter)) {
+    if (!dir) {
+      continue;
+    }
+
+    for (const ext of extensions) {
+      const candidate = join(dir, binaryName + ext);
+      try {
+        if (existsSync(candidate)) {
+          return candidate;
+        }
+      } catch {
+        // Ignore file system errors (e.g. invalid path or permission error)
+      }
+    }
+  }
+
+  return undefined;
+}

packages/angular/cli/src/utilities/executable_spec.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright Google LLC All Rights Reserved.
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.dev/license
+ */
+
+import { findExecutableOnPath } from './executable';
+
+describe('findExecutableOnPath', () => {
+  it('should find executable on PATH when it exists', () => {
+    // 'node' binary should be present on PATH in any Node test environment
+    const nodePath = findExecutableOnPath('node');
+    expect(nodePath).toBeDefined();
+    expect(nodePath).toContain('node');
+  });
+
+  it('should return undefined when binary does not exist on PATH', () => {
+    const nonExistentPath = findExecutableOnPath('non_existent_binary_123456789');
+    expect(nonExistentPath).toBeUndefined();
+  });
+});