Which @angular/* package(s) are the source of the bug?

upgrade

Is this a regression?

No

Description

When using @angular/upgrade, changing the URL via $locationShim within AngularJS code causes APP_BASE_HREF to be duplicated inside the $locationShim state.

Specifically:

• APP_BASE_HREF is present at the ending of the $locationShim.$$absUrl string, which is the expected behavior.
• However, after the URL is updated via $locationShim, the APP_BASE_HREF value also appears inside the $locationShim.$$path string, which should not happen.

Please provide a link to a minimal reproduction of the bug

https://stackblitz.com/edit/stackblitz-starters-erxcslbg?file=src%2Fpage.ts,src%2Flegacy.ts,src%2Fmain.ts

Please provide the environment you discovered this bug in (run ng version)

I initially discovered this in version 19 while refactoring navigation. The application previously contained a legacy monkey-patch for $locationShim and setUpLocationSync, which was likely implemented to fix this exact duplication issue. This suggests that the bug probably exists in earlier versions as well.

Reporoduced in this environment:

Angular CLI       : 21.1.4
Angular           : 21.1.5
Node.js           : 20.19.1
Package Manager   : npm 10.8.2
Operating System  : linux x64

┌───────────────────────────┬───────────────────┬───────────────────┐
│ Package                   │ Installed Version │ Requested Version │
├───────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build            │ 21.1.4            │ ^21.1.0           │
│ @angular/cli              │ 21.1.4            │ ^21.1.0           │
│ @angular/common           │ 21.1.5            │ ^21.1.0           │
│ @angular/compiler         │ 21.1.5            │ ^21.1.0           │
│ @angular/compiler-cli     │ 21.1.5            │ ^21.1.0           │
│ @angular/core             │ 21.1.5            │ ^21.1.0           │
│ @angular/forms            │ 21.1.5            │ ^21.1.0           │
│ @angular/platform-browser │ 21.1.5            │ ^21.1.0           │
│ @angular/router           │ 21.1.5            │ ^21.1.0           │
│ @angular/upgrade          │ 21.1.5            │ ^21.1.0           │
│ rxjs                      │ 7.8.2             │ ^7.8.1            │
│ typescript                │ 5.9.3             │ ^5.9.3            │
│ zone.js                   │ 0.16.0            │ ^0.16.0           │
└───────────────────────────┴───────────────────┴───────────────────┘

Anything else?

Root Cause Analysis:
Based on my debugging, this occurs because when the browser URL updates, a full path including the APP_BASE_HREF is generated. This triggers an event with the full path value. $locationShim reacts to this event and attempts to parse the received value as-is, without prior normalization.

There might be a connection with @angular/router, though I am not entirely certain.