[dependabot]

Bumps the npm-deps group in /frontend with 19 updates:

Package	From	To
@angular/animations	21.2.15	22.2.3
@angular/cdk	21.2.13	22.2.3
@angular/common	21.2.15	22.2.3
@angular/compiler	21.2.15	22.2.3
@angular/core	21.2.15	22.2.3
@angular/forms	21.2.15	22.2.3
@angular/platform-browser	21.2.15	22.2.3
@angular/platform-browser-dynamic	21.2.15	22.2.3
@angular/router	21.2.15	22.2.3
@ng-bootstrap/ng-bootstrap	20.0.0	21.0.0
angular-auth-oidc-client	21.0.2	22.0.1
bootstrap-icons	1.13.1	1.13.2
dompurify	3.4.16	3.4.17
ngx-echarts	21.0.0	22.0.0
zone.js	0.16.2	0.16.3
@angular-devkit/build-angular	21.2.13	21.2.27
@angular/cli	21.2.13	22.2.2
@angular/compiler-cli	21.2.15	22.2.3
@angular/localize	21.2.15	22.2.3

Updates @angular/animations from 21.2.15 to 22.2.3

Release notes

Sourced from @​angular/animations's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• d0a748c docs(animations): stop the query() usage notes truncating at a code sample
• 732e505 fix(core): replace all hasOwnProperty usages with Object.hasOwn
• c73a001 fix(animations): detect object trigger values with Object.hasOwn
• 1b13db7 refactor(animations): remove outdated comment
• 861d37e build: update minimum supported Node.js versions
• a7dab60 refactor(core): use the @Service decorator where possible.
• b8d3f36 feat(compiler-cli): add support for Node.js 26.0.0
• 6672192 test: remove duplicate tests (#67518)
• d550bf7 build: update minimum supported Node.js versions
• See full diff in compare view

Updates @angular/cdk from 21.2.13 to 22.2.3

Release notes

Sourced from @​angular/cdk's releases.

22.2.3

material

Commit	Description
	chips: implement touch-target pattern/styles on chip component (#33614)

cdk

Commit	Description
	a11y: treat inert elements as non-focusable (#33846)

22.2.2

google-maps

Commit	Description
	use console.error instead of hard error (#33917)

material

Commit	Description
	icon: do not copy event attributes (#33929)

cdk

Commit	Description
	drag-drop: remove old prefixes for fullscreen elements
	drag-drop: use consistent touch coordinates for bounded dragging (#33928)
	overlay: remove old prefixes for fullscreen elements

22.2.1

material

Commit	Description
	icon: keep FuncIRI references on current origin (#33812)
	select: glitchy animation when legacy animations are enabled (#33874)

cdk

Commit	Description
	overlay: allow users to opt into closing on any URL change (#33893)

22.2.0

material-luxon-adapter

Commit	Description
	add option to set zone (#33579)

material

Commit	Description
	icon: add material symbol classes automatically (#33750)
	menu: add disabledInteractive input to MatMenuItem (#33693)
	core: generate Material Symbols in schematic (#33797)
	form-field: support signal forms in MatFormFieldControl
	icon: false positive in font detection (#33805)

... (truncated)

Changelog

Sourced from @​angular/cdk's changelog.

22.2.3 "rhenium-rotor" (2026-10-14)

cdk

Commit	Type	Description
a307978dc	fix	a11y: treat inert elements as non-focusable (#33846)

material

Commit	Type	Description
e0c2d4df7	fix	chips: implement touch-target pattern/styles on chip component (#33614)

22.3.0-next.1 "calcium-crown" (2026-10-07)

cdk

Commit	Type	Description
cc3829f62	fix	drag-drop: remove old prefixes for fullscreen elements
84a2366bb	fix	drag-drop: use consistent touch coordinates for bounded dragging (#33928)
f6c2a193e	fix	overlay: remove old prefixes for fullscreen elements

material

Commit	Type	Description
cffa9cfea	fix	icon: do not copy event attributes (#33929)

google-maps

Commit	Type	Description
52a1ef36c	fix	use console.error instead of hard error (#33917)

22.2.2 "calcium-car" (2026-10-07)

cdk

Commit	Type	Description
237d951c6	fix	drag-drop: remove old prefixes for fullscreen elements
471f62afa	fix	drag-drop: use consistent touch coordinates for bounded dragging (#33928)
9c62976ba	fix	overlay: remove old prefixes for fullscreen elements

material

Commit	Type	Description
a069b18e1	fix	icon: do not copy event attributes (#33929)

google-maps

Commit	Type	Description
5b8c5fd62	fix	use console.error instead of hard error (#33917)

... (truncated)

Commits

• 7c47fa5 release: cut the v22.2.3 release
• a307978 fix(cdk/a11y): treat inert elements as non-focusable (#33846)
• 01b48b1 build: ban new usages of fakeAsync (#33946)
• e0c2d4d fix(material/chips): implement touch-target pattern/styles on chip component ...
• 09bce19 release: cut the v22.2.2 release
• a069b18 fix(material/icon): do not copy event attributes (#33929)
• 471f62a fix(cdk/drag-drop): use consistent touch coordinates for bounded dragging (#3...
• 9c62976 fix(cdk/overlay): remove old prefixes for fullscreen elements
• 237d951 fix(cdk/drag-drop): remove old prefixes for fullscreen elements
• 5f53103 build: attempt to resolve test failure on CI (#33925)
• Additional commits viewable in compare view

Updates @angular/common from 21.2.15 to 22.2.3

Release notes

Sourced from @​angular/common's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• dcb29a9 docs: fix @​param names that don't match their parameters
• fafec77 fix(common): harden param encoding against prototype pollution
• ad2f291 fix(common): let NgOptimizedImage pass a [srcset] binding through when srcset...
• 6dee7fe fix(http): forward reportProgress of httpResource as `reportDownloadProgr...
• 270abc9 docs(docs-infra): throw on absolute links in @​see tags
• b9de99d fix(common): remove abort listener on the abort path too in httpResource
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• 0bdbbcf fix(docs-infra): only read a deprecation version from the start of the tag
• af26a8c fix(router): avoid view transitions when the user agent provides one
• 7596548 fix(common): use locale NaN symbol in number formatting
• Additional commits viewable in compare view

Updates @angular/compiler from 21.2.15 to 22.2.3

Release notes

Sourced from @​angular/compiler's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• 54f3de5 fix(compiler): check @boundary blocks in the control flow content projectio...
• 5e50658 fix(compiler): compare the operand in ReadTemporaryExpr.isEquivalent
• 35a02f8 fix(compiler): harden JIT against prototype pollution
• b6f9cc5 fix(compiler): do not scope comments placed inside of a selector
• 08075e8 fix(compiler): support dots in class binding names
• c7a72c2 fix(compiler): support popover property bindings
• 5ff83c1 fix(compiler): strip script elements regardless of namespace
• 6fa2b08 refactor(compiler): remove img/video src attribute from the URL security cont...
• fa63bfa fix(compiler): avoid leaking ::ng-deep detection state between rules
• 725ffcf fix(compiler): match namespaced root nodes of control flow blocks against ng-...
• Additional commits viewable in compare view

Updates @angular/core from 21.2.15 to 22.2.3

Release notes

Sourced from @​angular/core's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• 90af679 fix(core): do not swallow compilation errors in computeStandaloneComponentScope
• eca5fa4 fix(core): don't crash initEventReplay when two apps share an APP_ID
• cc515b8 perf(forms): use addEventListener to avoid unconditional CD scheduling on blur
• dcb29a9 docs: fix @​param names that don't match their parameters
• d04f214 fix(migrations): normalize .d.ts paths in output migration field IDs
• 51ce6e5 docs: use consistent headers in best-practices.md
• e59a230 fix(core): error when destroying embedded view with animations
• 08075e8 fix(compiler): support dots in class binding names
• 913ae74 fix(core): skip nested tick from onMicrotaskEmpty while a tick is running
• b5208f9 fix(core): avoid deleting idle bucket created during another bucket's drain
• Additional commits viewable in compare view

Updates @angular/forms from 21.2.15 to 22.2.3

Release notes

Sourced from @​angular/forms's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• cc515b8 perf(forms): use addEventListener to avoid unconditional CD scheduling on blur
• dcb29a9 docs: fix @​param names that don't match their parameters
• 276248f docs(forms): document that minDate and maxDate expect UTC dates
• 26279ed test(forms): cover the deprecated disabled signatures
• 206f541 docs(forms): use the when option in disabled examples
• db91010 fix(docs-infra): stop generating member anchors that do not exist
• c91a8c4 fix(forms): use Object.is when comparing control bindings in signal forms
• b0710b8 fix(forms): don't crash when control is missing in setUpValidators
• 6a96a40 refactor(forms): modernize value accessor integration tests
• ef03596 fix(forms): skip class bindings for orphaned fields
• Additional commits viewable in compare view

Updates @angular/platform-browser from 21.2.15 to 22.2.3

Release notes

Sourced from @​angular/platform-browser's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
<... Description has been truncated

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml