[dependabot]

Bumps the npm-dependencies group with 28 updates in the /web/app directory:

Package	From	To
@angular/common	22.1.3	22.2.3
@angular/compiler	22.1.3	22.2.3
@angular/core	22.1.3	22.2.3
@angular/forms	22.1.3	22.2.3
@angular/platform-browser	22.1.3	22.2.3
@angular/router	22.1.3	22.2.3
aws-amplify	6.20.0	6.22.2
dompurify	3.4.14	3.4.17
jszip	3.10.1	3.10.2
katex	0.16.47	0.19.1
marked	18.0.10	18.1.1
marked-katex-extension	5.1.12	5.1.13
ngx-markdown	22.0.0	22.1.1
postcss	8.5.26	8.5.31
@angular/build	22.1.5	22.2.4
@angular/cli	22.1.5	22.2.4
@angular/compiler-cli	22.1.3	22.2.3
@playwright/test	1.62.1	1.64.1
@vitest/browser-playwright	4.1.11	5.0.5
@vitest/coverage-v8	4.1.11	5.0.5
dotenv	17.4.2	18.0.9
eslint	10.9.0	10.13.0
eslint-plugin-playwright	2.11.0	2.12.1
jsdom	30.0.1	30.1.3
monocart-coverage-reports	2.13.0	3.0.0
typescript	6.0.3	7.0.2
typescript-eslint	8.67.0	8.72.0
vitest	4.1.11	5.0.5

Updates @angular/common from 22.1.3 to 22.2.3

Release notes

Sourced from @​angular/common's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• dcb29a9 docs: fix @​param names that don't match their parameters
• fafec77 fix(common): harden param encoding against prototype pollution
• ad2f291 fix(common): let NgOptimizedImage pass a [srcset] binding through when srcset...
• 6dee7fe fix(http): forward reportProgress of httpResource as `reportDownloadProgr...
• 270abc9 docs(docs-infra): throw on absolute links in @​see tags
• b9de99d fix(common): remove abort listener on the abort path too in httpResource
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• 0bdbbcf fix(docs-infra): only read a deprecation version from the start of the tag
• af26a8c fix(router): avoid view transitions when the user agent provides one
• 7596548 fix(common): use locale NaN symbol in number formatting
• Additional commits viewable in compare view

Updates @angular/compiler from 22.1.3 to 22.2.3

Release notes

Sourced from @​angular/compiler's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• 54f3de5 fix(compiler): check @boundary blocks in the control flow content projectio...
• 5e50658 fix(compiler): compare the operand in ReadTemporaryExpr.isEquivalent
• 35a02f8 fix(compiler): harden JIT against prototype pollution
• b6f9cc5 fix(compiler): do not scope comments placed inside of a selector
• 08075e8 fix(compiler): support dots in class binding names
• c7a72c2 fix(compiler): support popover property bindings
• 5ff83c1 fix(compiler): strip script elements regardless of namespace
• 6fa2b08 refactor(compiler): remove img/video src attribute from the URL security cont...
• fa63bfa fix(compiler): avoid leaking ::ng-deep detection state between rules
• 725ffcf fix(compiler): match namespaced root nodes of control flow blocks against ng-...
• Additional commits viewable in compare view

Updates @angular/core from 22.1.3 to 22.2.3

Release notes

Sourced from @​angular/core's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• 90af679 fix(core): do not swallow compilation errors in computeStandaloneComponentScope
• eca5fa4 fix(core): don't crash initEventReplay when two apps share an APP_ID
• cc515b8 perf(forms): use addEventListener to avoid unconditional CD scheduling on blur
• dcb29a9 docs: fix @​param names that don't match their parameters
• d04f214 fix(migrations): normalize .d.ts paths in output migration field IDs
• 51ce6e5 docs: use consistent headers in best-practices.md
• e59a230 fix(core): error when destroying embedded view with animations
• 08075e8 fix(compiler): support dots in class binding names
• 913ae74 fix(core): skip nested tick from onMicrotaskEmpty while a tick is running
• b5208f9 fix(core): avoid deleting idle bucket created during another bucket's drain
• Additional commits viewable in compare view

Updates @angular/forms from 22.1.3 to 22.2.3

Release notes

Sourced from @​angular/forms's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• cc515b8 perf(forms): use addEventListener to avoid unconditional CD scheduling on blur
• dcb29a9 docs: fix @​param names that don't match their parameters
• 276248f docs(forms): document that minDate and maxDate expect UTC dates
• 26279ed test(forms): cover the deprecated disabled signatures
• 206f541 docs(forms): use the when option in disabled examples
• db91010 fix(docs-infra): stop generating member anchors that do not exist
• c91a8c4 fix(forms): use Object.is when comparing control bindings in signal forms
• b0710b8 fix(forms): don't crash when control is missing in setUpValidators
• 6a96a40 refactor(forms): modernize value accessor integration tests
• ef03596 fix(forms): skip class bindings for orphaned fields
• Additional commits viewable in compare view

Updates @angular/platform-browser from 22.1.3 to 22.2.3

Release notes

Sourced from @​angular/platform-browser's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• 1663b5e docs(platform-browser): link the styling guide from the namespacing APIs (#70...
• 6298b30 refactor(platform-browser): type async animation renderer
• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• ab0cfda refactor(platform-browser): type shadow DOM renderer fields
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• 83f7695 fix(core): throw coded RuntimeErrors instead of crashing when hydration/rende...
• 6f9a6be fix(platform-browser): disallow event handler attributes in Meta
• d35c17d refactor: correct typos in comments, docs, and error messages
• 1cb3d60 fix(platform-browser): throw a descriptive error when insertBefore reference ...
• ec372d6 refactor(platform-browser): modernize DOM renderer tests
• See full diff in compare view

Updates @angular/router from 22.1.3 to 22.2.3

Release notes

Sourced from @​angular/router's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• dcb29a9 docs: fix @​param names that don't match their parameters
• f9a4f75 fix(router): check abort signal state on subscribe
• 7bc6a1b refactor(router): Remove canLoad from 1p Router
• e0137cb fix(router): remove the navigate event abort listener once it fires
• fc91c72 fix(router): reset internal state on error handler redirect after state commit
• 576df28 fix(router): fall back when serializing protocol-relative URLs
• d98ee02 docs(router): note that shouldReuseRoute doesn't rerun guards and resolvers
• e9bf52a fix(router): require outlets to match a route before processing child segments
• 83abee3 Revert "fix(router): fall back when serializing protocol-relative URLs"
• 3b6796f fix(router): reject duplicate outlets in production builds
• Additional commits viewable in compare view

Updates aws-amplify from 6.20.0 to 6.22.2

Release notes

Sourced from aws-amplify's releases.

aws-amplify@6.22.2

Patch Changes

• #14977 c3cbb32 Thanks @​osama-rizk! - Delete server-side auth cookies with the same Path and Domain they were set with

  • @aws-amplify/core: CookieStorage.Adapter.delete() accepts optional DeleteCookieOptions (path, domain).
  • aws-amplify: the cookie-backed key-value storage passes the path and domain used by setItem when it removes an item.
  • @aws-amplify/adapter-nextjs: the server cookie adapters include Path and Domain in the cookie deletion, so auth cookies are removed on /_next/data, nested-route and API-route requests.

• Updated dependencies [c3cbb32, 9f9eed5, 85fff37]:

  • @​aws-amplify/core@​6.19.3
  • @​aws-amplify/datastore@​5.1.14
  • @​aws-amplify/auth@​6.21.2
  • @​aws-amplify/api@​6.4.3

aws-amplify@6.22.1

Patch Changes

• Updated dependencies [58609d9, dd20d26]:
  • @​aws-amplify/core@​6.19.2
  • @​aws-amplify/api@​6.4.2
  • @​aws-amplify/datastore@​5.1.13

aws-amplify@6.22.0

Minor Changes

• #14954 a5e8df2 Thanks @​soberm! - feat(events): resolve subscription readiness via channel.subscribe().ready and add subscription id to the SUBSCRIPTION_ACK Hub event

Patch Changes

• #14948 d8f5356 Thanks @​bobbor! - fix(auth): support user-pool sign-in through a local createAmplifyContext() without Amplify.configure()

  Makes a locally created AmplifyContext (createAmplifyContext(), without calling Amplify.configure()) usable end-to-end for Cognito user-pool auth:

  • Amplify.getConfig() again returns an empty config ({}) with a warning before configure() instead of throwing NoAmplifyContextError, restoring the released 6.20.0 contract that the explicit-AmplifyContext migration (#14931) unintentionally changed.
  • Cognito sign-in, fetchAuthSession, and the device APIs now resolve the per-context token orches...

    Description has been truncated

[blue-door-code-compass]

Chat-App API Regression

• Commit: fda4bea
• Status: SKIPPED
• Detail: regression orchestrator script not present in branch

Regression suite was not found in this branch, so this check was skipped.

[blue-door-code-compass]

✅ Code review complete - Approved by code-bot

[blue-door-code-compass]

Reviewed commit: fda4bea
✅ Code review PASSED (gating: major)
✅ Approved by code-bot

✅ Code review complete - No issues found!

[blue-door-code-compass]

Chat-App API Regression

• Commit: 669c5ff
• Status: SKIPPED
• Detail: regression orchestrator script not present in branch

Regression suite was not found in this branch, so this check was skipped.

[blue-door-code-compass]

✅ Code review complete - Approved by code-bot

[blue-door-code-compass]

Reviewed commit: 669c5ff
✅ Code review PASSED (gating: major)
✅ Approved by code-bot

✅ Code review complete - No issues found!

[blue-door-code-compass]

Chat-App API Regression

• Commit: c55cd6a
• Status: SKIPPED
• Detail: regression orchestrator script not present in branch

Regression suite was not found in this branch, so this check was skipped.

[blue-door-code-compass]

✅ Code review complete - Approved by code-bot

[blue-door-code-compass]

Reviewed commit: c55cd6a
✅ Code review PASSED (gating: major)
✅ Approved by code-bot

✅ Code review complete - No issues found!