ehoandClaude Opus 5
1866947438
CI / changes (push) Successful in 7s
CI / lint (push) Successful in 1m57s
CI / frontend (push) Successful in 2m45s
CI / backend (push) Successful in 1m57s
CI / e2e (push) Failing after 4m10s
CI / semgrep (push) Successful in 1m18s
CI / api-client-drift (push) Successful in 2m9s
CI / storybook-a11y (push) Successful in 11m5s
Angular 22.1.x emits `var(--%NS%name)` for every CSS custom property in a component `styles:` block. No `@angular/core` release substitutes the placeholder, so all `--rhc-*` tokens resolve to nothing and the UI breaks. `npm run ci` does not catch it; only the Storybook axe job does. Pin every `@angular*` entry to the exact version 22.0.5, so a plain `npm install` cannot pull 22.1.x back in. Holding at 22.0.5 leaves three moderate advisories open, which made the audit step fail: GHSA-p297-fm68-3q8c and GHSA-hh8m-fm6v-7cvg. Neither is reachable. The app calls no `withRequestsMadeViaParent` and no `provideClientHydration`, and binds no untrusted value into a directive host binding. The audit gate therefore runs at `--audit-level=high`. A high advisory still fails the build. Restore the default audit level together with the upgrade, after an Angular release substitutes the placeholder. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>