Unblock Dependabot PRs: Angular 22 + NgRx 22 + TS 6, audit fixes, CI hardening

[thomastran117]

Why

Six Dependabot PRs were stuck on CI. Their failures came from four separate causes. Some can only be fixed on main, and some bumps can never merge on their own:

PR	Failure	Root cause	Resolution here
#275 playwright / @types/node	Frontend Audit	New Angular 21.2.19 + qs advisories published against main; the prod audit gate fails for every PR	Angular upgrade + npm audit fix; bumps included
#276 backend group	Frontend Audit, Integration (events)	Same audit issue + flaky EventSeriesEndpointsTests (5s wait on the shared Elasticsearch node)	Wait raised to 30s; will pass once rebased
#226 angular 22	ERESOLVE everywhere	@angular/build@22 requires TypeScript >=6.0 <6.1	Done via ng update together with TS 6
#258 ngrx 22	ERESOLVE everywhere	@ngrx/*@22 requires @angular/core ^22	Done together with Angular 22
#255 jasmine-core 7	Frontend Unit Tests	jasmine 7 makes describe read-only; zone.js/testing reassigns it, so no spec loads	Stay on 6; Dependabot ignores the major
#257 Microsoft.OpenApi 3	All backend tests	Microsoft.AspNetCore.OpenApi 10 is built against OpenApi 2.x (csproj already pins 2.x on purpose)	Dependabot ignores the major

What changed

• Frontend: Angular 22.1.6 / CLI 22.1.8, NgRx 22.0.1, TypeScript 6.0.3, playwright 1.63, @types/node 24.13.4. Official migrations applied: withNoIncrementalHydration(), withXhr() in test HTTP providers, $safeNavigationMigration() template wrappers, extended-diagnostic suppressions, istanbul-lib-instrument.
• TS 6 fixes the migration doesn't make: removed deprecated baseUrl (paths now ./-relative), explicit rootDir in app/spec tsconfigs, and the third CanMatchFn argument in the guard spec.
• CI: the full-tree npm audit --audit-level=moderate is now blocking. Its comment said to do this once Angular 22 landed, and both audits now report 0 vulnerabilities.
• Tests: EventSeriesEndpointsTests public-listing wait goes from 5s to 30s.
• Dependabot: ignore majors for jasmine-core and Microsoft.OpenApi, and refresh the stale TypeScript ignore comment.

Verified locally

• npm run format:check, npm run typecheck, npm run build: pass. The initial-bundle budget warning was already on main (537 kB); it's now 547 kB.
• ng test --watch=false --code-coverage: pass, 91.7% statements.
• npm audit --omit=dev --audit-level=high and npm audit --audit-level=moderate: 0 vulnerabilities.
• Integration test project builds. Integration tests run only in CI.

After merge

• Close chore(deps): Bump the angular group across 1 directory with 11 updates #226, chore(deps): Bump the ngrx group across 1 directory with 3 updates #258, chore(deps-dev): Bump the frontend-dependencies group in /frontend with 2 updates #275 (superseded), and chore(deps-dev): Bump jasmine-core from 6.3.0 to 7.0.2 in /frontend #255, chore(deps): Bump Microsoft.OpenApi from 2.12.2 to 3.10.2 #257 (now ignored).
• Comment @dependabot rebase on chore(deps): Bump the backend-dependencies group with 17 updates #276.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​angular/​platform-browser@​21.2.19 ⏵ 22.1.6	+23
	npm/​@​ngrx/​effects@​21.1.1 ⏵ 22.0.1	+1			+5
	npm/​@​ngrx/​store-devtools@​21.1.1 ⏵ 22.0.1	+1		+1	+4
	npm/​@​ngrx/​store@​21.1.1 ⏵ 22.0.1	+1			+5
	npm/​@​angular/​ssr@​21.2.20 ⏵ 22.1.8	+2		+1	+1
	npm/​@​angular/​compiler-cli@​21.2.19 ⏵ 22.1.6
	npm/​@​angular/​router@​21.2.19 ⏵ 22.1.6	+21		+1
	npm/​@​angular/​platform-server@​21.2.19 ⏵ 22.1.6	+21	+22	+1	+1
	npm/​@​angular/​forms@​21.2.19 ⏵ 22.1.6	+21		+1
	npm/​@​angular/​cli@​21.2.20 ⏵ 22.1.8	+17			+1
	npm/​@​angular/​build@​21.2.20 ⏵ 22.1.8			+1	-1
	npm/​@​angular/​compiler@​21.2.19 ⏵ 22.1.6	+1	+2	+1
	npm/​@​angular/​core@​21.2.19 ⏵ 22.1.6	+20	+2	+1	+2
	npm/​@​angular/​common@​21.2.19 ⏵ 22.1.6	+1	+2
	npm/​playwright@​1.62.1 ⏵ 1.63.0	+1		+1
	npm/​@​types/​node@​24.13.3 ⏵ 24.13.4			+1	+1
	npm/​typescript@​5.9.3 ⏵ 6.0.3	+1		+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: frontend/package-lock.json → npm/@angular/build@22.1.8 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm lmdb is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: frontend/package-lock.json → npm/@angular/build@22.1.8 → npm/lmdb@3.5.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lmdb@3.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 41f76ad485

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Raise the advertised Node.js minimum for Angular 22

When installing with Node 24.0–24.14 or Node 25.x, this Angular upgrade conflicts with the project's existing engines.node declaration of >=24: the new Angular CLI and build packages require ^22.22.3 || ^24.15.0 || >=26.0.0 (for example, frontend/package-lock.json lines 547–549). Such environments are currently presented as supported but can be rejected by engine-strict installs or run an unsupported build toolchain, so update the project engine constraint and version pins to require a compatible Node release.

Useful? React with 👍 / 👎.