chore(deps): pin Angular to 22.0.5 and gate audit at high

Angular 22.1.x emits `var(--%NS%name)` for every CSS custom property in a component `styles:` block. No `@angular/core` release substitutes the placeholder, so all `--rhc-*` tokens resolve to nothing and the UI breaks. `npm run ci` does not catch it; only the Storybook axe job does. Pin every `@angular*` entry to the exact version 22.0.5, so a plain `npm install` cannot pull 22.1.x back in. Holding at 22.0.5 leaves three moderate advisories open, which made the audit step fail: GHSA-p297-fm68-3q8c and GHSA-hh8m-fm6v-7cvg. Neither is reachable. The app calls no `withRequestsMadeViaParent` and no `provideClientHydration`, and binds no untrusted value into a directive host binding. The audit gate therefore runs at `--audit-level=high`. A high advisory still fails the build. Restore the default audit level together with the upgrade, after an Angular release substitutes the placeholder. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-21 13:53:05 +02:00
parent 6330773fd5
commit 1866947438
5 changed files with 42 additions and 32 deletions
@@ -58,7 +58,10 @@ catches a miss before CI does.

 `.npmrc` sets `legacy-peer-deps=true` (Storybook's peer range lags Angular 22).
 Do not run `npm audit fix --force` — it downgrades Angular 22→21. Dev-only
-advisories are pinned via `package.json` `overrides`; the shipped bundle audits clean.
+advisories are pinned via `package.json` `overrides`. Angular is pinned to the exact
+version 22.0.5: 22.1.x emits `var(--%NS%name)` and breaks every `--rhc-*` token, so the
+two moderate advisories it fixes stay open. Neither is reachable, so the audit gate runs
+at `--audit-level=high` (see the comment in `ci.yml`).

 ## Model routing for agent delegation