fix(sec): Upgrade Angular to 21.2.19 to resolve 5 CVEs

[petr-pokorny-absa]

Summary

Upgrades all @angular/* packages (runtime and CLI/build tooling) from 21.2.7 to 21.2.19, which is above the fixed versions for the following security advisories:

• CVE-2026-54267 — Angular Client Hydration DOM Clobbering & Response-Cache Poisoning (fixed in 22.0.1 / 21.2.17 / 20.3.25)
• CVE-2026-54268 — @angular/common DoS via crafted date format string (fixed in 22.0.1 / 21.2.17 / 20.3.25)
• CVE-2026-54266 — Weak 32-bit cache key hashing in HttpTransferCache (fixed in 22.0.1 / 21.2.17 / 20.3.25)
• CVE-2026-50171 — @angular/common DoS via malformed digitsInfo parameter (fixed in 22.0.0-rc.2 / 21.2.15 / 20.3.22 / 19.2.23)
• CVE-2026-50170 — Info leak via default caching of credentialed requests in HttpTransferCache (fixed in 22.0.0-rc.2 / 21.2.15 / 20.3.22 / 19.2.23)

Changes

• Bumped @angular/animations, @angular/common, @angular/compiler, @angular/core, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic, @angular/router, @angular/build, @angular/cli, and @angular/compiler-cli to ^21.2.19 in ui/package.json
• Regenerated ui/package-lock.json

Validation

• npm install — resolves cleanly
• npm run build — production build succeeds
• Unit tests (Jest) — verified passing

Release notes

• Angular version bumped to 21.2.19

Closes

Closes #60
Closes #61
Closes #62
Closes #63
Closes #64
Closes #55
Closes #54
Closes #53
Closes #52
Closes #51
Closes #50
Closes #49
Closes #48
Closes #47
Closes #46

[Copilot]

Pull request overview

Updates the Angular-based UI dependencies to patched Angular 21.2.x versions to remediate multiple reported CVEs affecting @angular/* packages used by StatusBoard’s frontend.

Changes:

• Bumped core Angular runtime packages (@angular/{core,common,compiler,...}) to ^21.2.19 in ui/package.json.
• Bumped Angular CLI/build toolchain packages (@angular/{build,cli,compiler-cli}) to ^21.2.19 in ui/package.json.
• Regenerated ui/package-lock.json to reflect the resolved dependency graph for the upgrade.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
ui/package.json	Updates Angular runtime + tooling dependency ranges to patched 21.2.19.
ui/package-lock.json	Refreshes the lockfile to the resolved versions for the upgraded Angular dependency set.

Files not reviewed (1)

• ui/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.