[dependabot]

Bumps the npm-deps group in /frontend with 15 updates:

Package	From	To
@angular/cdk	21.2.13	22.2.2
@angular/common	21.2.15	22.2.1
@angular/compiler	21.2.15	22.2.1
@angular/core	21.2.15	22.2.1
@angular/forms	21.2.15	22.2.1
@angular/platform-browser	21.2.15	22.2.1
@angular/router	21.2.15	22.2.1
@ng-bootstrap/ng-bootstrap	20.0.0	21.0.0
angular-auth-oidc-client	21.0.2	22.0.1
ngx-echarts	21.0.0	22.0.0
zone.js	0.16.2	0.16.3
@angular-devkit/build-angular	21.2.13	22.2.2
@angular/cli	21.2.13	22.2.2
@angular/compiler-cli	21.2.15	22.2.1
@angular/localize	21.2.15	22.2.1

Updates @angular/cdk from 21.2.13 to 22.2.2

Release notes

Sourced from @​angular/cdk's releases.

22.2.2

google-maps

Commit	Description
	use console.error instead of hard error (#33917)

material

Commit	Description
	icon: do not copy event attributes (#33929)

cdk

Commit	Description
	drag-drop: remove old prefixes for fullscreen elements
	drag-drop: use consistent touch coordinates for bounded dragging (#33928)
	overlay: remove old prefixes for fullscreen elements

22.2.1

material

Commit	Description
	icon: keep FuncIRI references on current origin (#33812)
	select: glitchy animation when legacy animations are enabled (#33874)

cdk

Commit	Description
	overlay: allow users to opt into closing on any URL change (#33893)

22.2.0

material-luxon-adapter

Commit	Description
	add option to set zone (#33579)

material

Commit	Description
	icon: add material symbol classes automatically (#33750)
	menu: add disabledInteractive input to MatMenuItem (#33693)
	core: generate Material Symbols in schematic (#33797)
	form-field: support signal forms in MatFormFieldControl
	icon: false positive in font detection (#33805)
	menu: allow focus to land on disabledInteractive items (#33749)

cdk

Commit	Description
	overlay: temporarily hide getAttachedOverlays (#33854)
	testing: account for new DirectiveFixture API (#33771)
	testing: use directive fixture onDestroy (#33793)

aria

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/cdk's changelog.

22.2.2 "calcium-car" (2026-10-07)

cdk

Commit	Type	Description
237d951c6	fix	drag-drop: remove old prefixes for fullscreen elements
471f62afa	fix	drag-drop: use consistent touch coordinates for bounded dragging (#33928)
9c62976ba	fix	overlay: remove old prefixes for fullscreen elements

material

Commit	Type	Description
a069b18e1	fix	icon: do not copy event attributes (#33929)

google-maps

Commit	Type	Description
5b8c5fd62	fix	use console.error instead of hard error (#33917)

22.3.0-next.0 "tellurium-teleprompter" (2026-09-30)

No user facing changes in this release

22.2.1 "tellurium-telescope" (2026-09-30)

cdk

Commit	Type	Description
1a434cdc8	fix	overlay: allow users to opt into closing on any URL change (#33893)

material

Commit	Type	Description
e06c8deed	fix	icon: keep FuncIRI references on current origin (#33812)
a7a31a674	fix	select: glitchy animation when legacy animations are enabled (#33874)

22.2.0 "rubidium-rollercoaster" (2026-09-23)

aria

Commit	Type	Description
cd9c7da8b	fix	menu: make MenuItem value optional (#33715)

cdk

Commit	Type	Description
0f6e8d656	fix	overlay: temporarily hide getAttachedOverlays (#33854)
3d30bf1b4	fix	testing: account for new DirectiveFixture API (#33771)
aad74d364	fix	testing: use directive fixture onDestroy (#33793)

... (truncated)

Commits

• 09bce19 release: cut the v22.2.2 release
• a069b18 fix(material/icon): do not copy event attributes (#33929)
• 471f62a fix(cdk/drag-drop): use consistent touch coordinates for bounded dragging (#3...
• 9c62976 fix(cdk/overlay): remove old prefixes for fullscreen elements
• 237d951 fix(cdk/drag-drop): remove old prefixes for fullscreen elements
• 5f53103 build: attempt to resolve test failure on CI (#33925)
• 91f24de build: update pnpm to v12.8.1 (#33921)
• c21429e build: lock file maintenance (#33892)
• 66676b6 build: update cross-repo angular dependencies (#33906)
• f608498 build: update dependency aspect_rules_js to v3.5.1 (#33916)
• Additional commits viewable in compare view

Updates @angular/common from 21.2.15 to 22.2.1

Release notes

Sourced from @​angular/common's releases.

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

compiler-cli

Commit	Description
	support extendedConfigCache in readConfiguration

core

Commit	Description
	add debugName on afterRenderEffect
	block dangerous data: and vbscript: URLs in URL sanitizer
	extend data: URL allowlist for non-executable MIME types
	include signal and component name in NG0600 error message
	render error boundary fallbacks after HMR

http

Commit	Description
	forward reportProgress of httpResource as reportDownloadProgress

platform-server

Commit	Description
	reject protocol-relative paths in resolveUrl

router

Commit	Description
	do not copy URL-sized objects into every route snapshot
	fall back when serializing protocol-relative URLs
	limit absolute redirects from redirect functions
	reject duplicate outlets in production builds
	require outlets to match a route before processing child segments
	set initial blocking resource input synchronously on activation
	do not retain UrlTree instances in RouterLink

22.2.0

compiler

Commit	Description
	allow template to access private props
	do not encapsulate nested selectors if parent contains ::ng-deep
	scope nested CSS rules

compiler-cli

... (truncated)

Commits

• ad2f291 fix(common): let NgOptimizedImage pass a [srcset] binding through when srcset...
• 6dee7fe fix(http): forward reportProgress of httpResource as `reportDownloadProgr...
• 270abc9 docs(docs-infra): throw on absolute links in @​see tags
• b9de99d fix(common): remove abort listener on the abort path too in httpResource
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• 0bdbbcf fix(docs-infra): only read a deprecation version from the start of the tag
• af26a8c fix(router): avoid view transitions when the user agent provides one
• 7596548 fix(common): use locale NaN symbol in number formatting
• 862a0c8 fix(common): avoid prototype member collisions
• 732e505 fix(core): replace all hasOwnProperty usages with Object.hasOwn
• Additional commits viewable in compare view

Updates @angular/compiler from 21.2.15 to 22.2.1

Release notes

Sourced from @​angular/compiler's releases.

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

compiler-cli

Commit	Description
	support extendedConfigCache in readConfiguration

core

Commit	Description
	add debugName on afterRenderEffect
	block dangerous data: and vbscript: URLs in URL sanitizer
	extend data: URL allowlist for non-executable MIME types
	include signal and component name in NG0600 error message
	render error boundary fallbacks after HMR

http

Commit	Description
	forward reportProgress of httpResource as reportDownloadProgress

platform-server

Commit	Description
	reject protocol-relative paths in resolveUrl

router

Commit	Description
	do not copy URL-sized objects into every route snapshot
	fall back when serializing protocol-relative URLs
	limit absolute redirects from redirect functions
	reject duplicate outlets in production builds
	require outlets to match a route before processing child segments
	set initial blocking resource input synchronously on activation
	do not retain UrlTree instances in RouterLink

22.2.0

compiler

Commit	Description
	allow template to access private props
	do not encapsulate nested selectors if parent contains ::ng-deep
	scope nested CSS rules

compiler-cli

... (truncated)

Commits

• c451a3b fix(compiler): avoid incorrectly stripping parentheses in template pipeline
• 82a930d refactor(compiler): cleanup complier flags
• bbc556d fix(compiler): avoid stripping parentheses from some expressions
• 0ecaf8e fix(compiler): add explicit return types to generated functions
• 18edb1b fix(compiler): guard unverified ctor parameter types in class metadata
• 7a58550 fix(forms): create controls before listeners
• 949d66c refactor(compiler): add method to emitter context
• 710c2c7 fix(compiler): avoid hitting TypeScript limits if template has many translations
• 2f27d83 fix(core): loosen return types for arrow functions in generated code
• e20a92c fix(compiler): add return type to pure functions
• Additional commits viewable in compare view

Updates @angular/core from 21.2.15 to 22.2.1

Release notes

Sourced from @​angular/core's releases.

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

compiler-cli

Commit	Description
	support extendedConfigCache in readConfiguration

core

Commit	Description
	add debugName on afterRenderEffect
	block dangerous data: and vbscript: URLs in URL sanitizer
	extend data: URL allowlist for non-executable MIME types
	include signal and component name in NG0600 error message
	render error boundary fallbacks after HMR

http

Commit	Description
	forward reportProgress of httpResource as reportDownloadProgress

platform-server

Commit	Description
	reject protocol-relative paths in resolveUrl

router

Commit	Description
	do not copy URL-sized objects into every route snapshot
	fall back when serializing protocol-relative URLs
	limit absolute redirects from redirect functions
	reject duplicate outlets in production builds
	require outlets to match a route before processing child segments
	set initial blocking resource input synchronously on activation
	do not retain UrlTree instances in RouterLink

22.2.0

compiler

Commit	Description
	allow template to access private props
	do not encapsulate nested selectors if parent contains ::ng-deep
	scope nested CSS rules

compiler-cli

... (truncated)

Commits

• 78d0648 docs: add the missing inject import to the inject migration examples
• 14daa09 docs: rewrite the RouterTestingModule migration README
• d0ea72b docs: correct the RouterTestingModule schematic description
• 6040d24 Revert "fix(core): block dangerous data: and vbscript: URLs in URL sanitizer"
• 69a5e19 Revert "fix(core): extend data: URL allowlist for non-executable MIME types"
• d33f2d0 refactor(core): show the enclosing component in the NG0502 hydration error
• 9aeef8d fix(core): extend data: URL allowlist for non-executable MIME types
• 7c634ec fix(core): block dangerous data: and vbscript: URLs in URL sanitizer
• f34b87b refactor(migrations): remove unused skipped inputs set
• a8528d4 docs: align the service migration README with the schematic
• Additional commits viewable in compare view

Updates @angular/forms from 21.2.15 to 22.2.1

Release notes

Sourced from @​angular/forms's releases.

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

compiler-cli

Commit	Description
	support extendedConfigCache in readConfiguration

core

Commit	Description
	add debugName on afterRenderEffect
	block dangerous data: and vbscript: URLs in URL sanitizer
	extend data: URL allowlist for non-executable MIME types
	include signal and component name in NG0600 error message
	render error boundary fallbacks after HMR

http

Commit	Description
	forward reportProgress of httpResource as reportDownloadProgress

platform-server

Commit	Description
	reject protocol-relative paths in resolveUrl

router

Commit	Description
	do not copy URL-sized objects into every route snapshot
	fall back when serializing protocol-relative URLs
	limit absolute redirects from redirect functions
	reject duplicate outlets in production builds
	require outlets to match a route before processing child segments
	set initial blocking resource input synchronously on activation
	do not retain UrlTree instances in RouterLink

22.2.0

compiler

Commit	Description
	allow template to access private props
	do not encapsulate nested selectors if parent contains ::ng-deep
	scope nested CSS rules

compiler-cli

... (truncated)

Commits

• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• 7a58550 fix(forms): create controls before listeners
• 82372fd docs(forms): name the default error factories in the signal validators
• f825c9b docs: fix API links that point at missing member anchors
• 15bfc1a fix(forms): mark control as dirty before setting its value in FVC interop
• 467b37b docs(forms): document what required() considers empty
• b9fb456 docs(forms): close the unterminated code fences in the compatForm docs
• 8ca879e refactor(forms): expose consequentialHint annotation
• 8afd85c test(forms): migrate integration tests to zoneless scheduling
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• Additional commits viewable in compare view

Updates @angular/platform-browser from 21.2.15 to 22.2.1

Release notes

Sourced from @​angular/platform-browser's releases.

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

compiler-cli

Commit	Description
	support extendedConfigCache in readConfiguration

core

Commit	Description
	add debugName on afterRenderEffect
	block dangerous data: and vbscript: URLs in URL sanitizer
	extend data: URL allowlist for non-executable MIME types
	include signal and component name in NG0600 error message
	render error boundary fallbacks after HMR

http

Commit	Description
	forward reportProgress of httpResource as reportDownloadProgress

platform-server

Commit	Description
	reject protocol-relative paths in resolveUrl

router

Commit	Description
	do not copy URL-sized objects into every route snapshot
	fall back when serializing protocol-relative URLs
	limit absolute redirects from redirect functions
	reject duplicate outlets in production builds
	require outlets to match a route before processing child segments
	set initial blocking resource input synchronously on activation
	do not retain UrlTree instances in RouterLink

22.2.0

compiler

Commit	Description
	allow template to access private props
	do not encapsulate nested selectors if parent contains ::ng-deep
	scope nested CSS rules

compiler-cli

... (truncated)

Commits

• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• ab0cfda refactor(platform-browser): type shadow DOM renderer fields
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• 83f7695 fix(core): throw coded RuntimeErrors instead of crashing when hydration/rende...
• 6f9a6be fix(platform-browser): disallow event handler attributes in Meta
• d35c17d refactor: correct typos in comments, docs, and error messages
• 1cb3d60 fix(platform-browser): throw a descriptive error when insertBefore reference ...
• ec372d6 refactor(platform-browser): modernize DOM renderer tests
• fb6b354 fix(platform-browser): prevent ReDoS in SOURCEMAP_URL_REGEXP
• c0eaaed refactor(core): cleanup Meta service
• Additional commits viewable in compare view

Updates @angular/router from 21.2.15 to 22.2.1

Release notes

Sourced from @​angular/router's releases.

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

compiler-cli

Description has been truncated

Commit	Description
	support extendedConfigCache in readConfiguration

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml