fix(deps): resolve Dependabot security alerts

[bobbyg603]

Summary

Resolves the open Dependabot security alerts by bumping the Angular 21 runtime and build tooling to the latest in-major 21.2.x patch releases and regenerating package-lock.json so the patched build-chain transitives are pulled in.

All changes stay within Angular v21 (no major/framework upgrade) and the production library build is verified passing.

Files changed

• package.json — raised the version floors for the @angular/* runtime + build tooling to their patched 21.2.x releases (12 lines).
• package-lock.json — regenerated to resolve the whole stack to latest 21.2.x and pull patched transitives.

Version bumps

Package(s)	From	To
@angular/{animations,common,compiler,core,forms,platform-browser,platform-browser-dynamic,router,compiler-cli,language-service}	21.2.12	21.2.18 (v21-lts)
@angular-devkit/build-angular, @angular/cli, @angular/build	21.2.11	21.2.19

The @angular/build 21.2.19 bump is what clears the deep build-tooling transitives: vite 7.3.6, esbuild 0.28.1, undici 7.28.0, piscina 5.2.0, http-proxy-middleware 3.0.7, webpack-dev-server 5.2.5. The lockfile regen also picked up patched ws, tmp, shell-quote, qs, js-yaml, tar, hono, sigstore, @babel/core, and launch-editor.

npm audit: before → after

	critical	high	moderate	low	total
before	1	17	15	2	35
after	0	0	5	1	6

The @angular/{core,common,compiler} advisories are patched in-major (21.2.12 → 21.2.18), so this is a low-risk minor/patch bump.

Remaining alerts (6) and why

Both are dev-only, deeply nested transitives with no clean upstream fix, and neither is exploitable in this library's build/publish workflow:

1. esbuild (GHSA-g7r4-m6w7-qqqr, low) — nested esbuild@0.27.7 under ng-packagr, which pins esbuild@^0.27.0. The top-level @angular/build tree already uses the patched esbuild@0.28.1. The advisory only affects esbuild's dev server on Windows; ng-packagr is a library bundler and never runs it. Forcing it via an override risks breaking the very tool that builds the library.
2. uuid < 11.1.1 (GHSA-w5hq-g745-h8pq, moderate) — pulled by sockjs → webpack-dev-server (dev server only, never used in build:lib or production). npm audit reports "No fix available" since sockjs has no release on uuid@11. The 4 additional moderate entries (sockjs, webpack-dev-server, @angular-devkit/build-angular, @angular-devkit/build-webpack) are transitive reflections of this same uuid issue.

Verification

• npm install (fresh lockfile) — clean, 1654 packages.
• npm run build:lib (ng build bugsplat-ng --configuration=production, ng-packagr) — passes, Angular package built + assets copied.
• npm run lint — the 6 reported errors (@angular-eslint/prefer-inject, no-output-native) are pre-existing on main in source files untouched by this PR; @angular-eslint is pinned at 21.3.0 and unchanged. Not a regression.
• Karma tests not run (require a headless browser; not offline/quick).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates Angular v21 dependencies to patched 21.2.x releases to address Dependabot security alerts, along with a regenerated lockfile to pull in patched transitive tooling versions.

Changes:

• Bumps @angular/* runtime packages to 21.2.18.
• Bumps Angular build tooling (@angular-devkit/build-angular, @angular/cli) to 21.2.19.
• Regenerates package-lock.json to resolve patched transitive dependencies.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
package.json	Updates Angular runtime + build tool version ranges to patched v21.2.x releases.
package-lock.json	Regenerated lockfile to realize the updated Angular/tooling versions and patched transitives.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bobbyg603]

Declined — keeping the caret ranges.

• These caret ranges are pre-existing; this PR only raises the version floor (^21.2.3 → ^21.2.18) and never touched the range operator. Switching just these lines to ~ would make them inconsistent with the rest of package.json, where every other @angular/* entry (and most devDeps) uses ^.
• Caret is Angular's own convention (ng new / ng update generate ^ ranges), so ~ would fight the framework tooling.
• package-lock.json pins the exact patched versions and CI runs npm ci, so 21.2.18 is installed regardless of the operator — the security remediation is fully realized. The caret only permits a bump on a deliberate npm update/lockfile regen.
• The PR's stated intent is in-major (no v21→v22 jump), which ^21.2.x already honors. This is also the private my-angular-crasher demo app's manifest, not the published bugsplat-ng library, so the range never reaches consumers.

[bobbyg603]

Declined — same rationale as the runtime deps thread.

@angular-devkit/build-angular and @angular/cli already used caret before this PR; only the floor moved (^21.2.2 → ^21.2.19). package-lock.json pins the exact 21.2.19 and CI installs via npm ci, so the patched build chain is what actually resolves regardless of ^ vs ~. Keeping ^ stays consistent with Angular's tooling conventions and the rest of the manifest. The "in-major" intent (no v21→v22 upgrade) is already satisfied by the caret.