Merge branch 'main' into lmendoza/PD-3931

cryptalith · web-flow · commit eaacc5ce3738 · 2026-04-21T09:12:49.000-06:00
diff --git a/.github/workflows/bld_docker.yml b/.github/workflows/bld_docker.yml
@@ -120,14 +120,19 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
       - name: git-checkout-ref-action
         id: ref
         uses: ORCID/git-checkout-ref-action@main
         with:
           default_branch: ${{ github.event.repository.default_branch }}
           ref: ${{ inputs.ref }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ steps.ref.outputs.ref }}
           # checkout some history so we can scan commits for bump messages
@@ -141,10 +146,10 @@ jobs:
           version_tag: ${{ inputs.version_tag }}
           bump: ${{ inputs.bump }}
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Login to private registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ secrets.DOCKER_REG_PRIVATE }}
           username: ${{ secrets.DOCKER_USER }}
@@ -160,7 +165,7 @@ jobs:
         run: |
           echo ${{ steps.dynamic_defaults.outputs.default_file }}
 
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           push: ${{ inputs.push }}
           tags: ${{ secrets.DOCKER_REG_PRIVATE }}/${{ matrix.docker_name}}:${{ steps.version.outputs.version_tag_numeric }}
diff --git a/.github/workflows/bld_mvn.yml b/.github/workflows/bld_mvn.yml
@@ -53,14 +53,19 @@ jobs:
   bld_mvn:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
       - name: git-checkout-ref-action
         id: ref
         uses: ORCID/git-checkout-ref-action@main
         with:
           default_branch: ${{ github.event.repository.default_branch }}
           ref: ${{ inputs.ref }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ steps.ref.outputs.ref }}
           # checkout some history so we can scan commits for bump messages
@@ -75,7 +80,7 @@ jobs:
           bump: ${{ inputs.bump }}
 
       - name: Set up Open JDK 11
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
           distribution: 'temurin'
           java-version: '11'
diff --git a/.github/workflows/bld_yarn.yml b/.github/workflows/bld_yarn.yml
@@ -14,8 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 'v20.x'
           cache: 'yarn'
diff --git a/.github/workflows/deploy-ui-docs-pr.yml b/.github/workflows/deploy-ui-docs-pr.yml
@@ -17,14 +17,19 @@ on:
 jobs:
   build-and-deploy-preview:
     runs-on: ubuntu-latest
-    
+
     permissions:
       contents: write
       pull-requests: write  # To comment on PR with preview URL
-    
+
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
       
@@ -50,7 +55,7 @@ jobs:
           echo "Extracted ticket ID: $TICKET_ID"
       
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
           cache: 'yarn'
@@ -89,7 +94,7 @@ jobs:
           echo "✅ SPA support configured: 404.html created for PR preview"
       
       - name: Deploy to GitHub Pages (PR Preview)
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ${{ steps.set-output.outputs.directory }}
@@ -98,7 +103,7 @@ jobs:
           cname: false
       
       - name: Comment on PR with preview URL
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         if: github.event_name == 'pull_request'
         with:
           script: |
diff --git a/.github/workflows/deploy-ui-docs.yml b/.github/workflows/deploy-ui-docs.yml
@@ -17,18 +17,23 @@ on:
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
-    
+
     permissions:
       contents: write
-    
+
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
       
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
           cache: 'yarn'
@@ -63,7 +68,7 @@ jobs:
           echo "✅ SPA support configured: 404.html created for root deployment"
       
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/format_i18n.yml b/.github/workflows/format_i18n.yml
@@ -8,12 +8,17 @@ jobs:
   format_i18n:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # token with write permissions to protected branches
           # standard github token does not allow this
           token: ${{ secrets.RELEASE_TOKEN }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 'v20.x'
           cache: 'yarn'
diff --git a/.github/workflows/format_prettier.yml b/.github/workflows/format_prettier.yml
@@ -8,13 +8,18 @@ jobs:
   format_prettier:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # token with write permissions to protected branches
           # standard github token does not allow this
           token: ${{ secrets.RELEASE_TOKEN }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 'v20.x'
           cache: 'yarn'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -16,8 +16,13 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.10'
       - uses: pre-commit/action@576ff52938d158a24ac7e009dfa94b1455e7df99
diff --git a/.github/workflows/pull-translations.yml b/.github/workflows/pull-translations.yml
@@ -20,8 +20,13 @@ jobs:
       TX_TOKEN: ${{ secrets.TRANSIFEX_TOKEN }}
       GH_PAT: ${{ secrets.GH_PAT }}
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
           # Use GH_PAT so pushes trigger downstream workflows (not GITHUB_TOKEN)
@@ -198,7 +203,7 @@ jobs:
       - name: Open PR to main if differences (PAT)
         if: steps.diff.outputs.differs == 'true' && env.GH_PAT != ''
         id: openpr
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ env.GH_PAT }}
           script: |
diff --git a/.github/workflows/rel_tag.yml b/.github/workflows/rel_tag.yml
@@ -56,6 +56,11 @@ jobs:
   rel_tag:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
       - name: git-checkout-ref-action
         id: ref
         uses: ORCID/git-checkout-ref-action@main
@@ -64,7 +69,7 @@ jobs:
           ref: ${{ inputs.ref }}
 
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # token with write permissions to protected branches
           # standard github token does not allow this
diff --git a/.github/workflows/sast.yml b/.github/workflows/sast.yml
@@ -12,10 +12,15 @@ jobs:
   buildmavenDepTree:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Set up JDK 11
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
           java-version: '11'
           distribution: 'temurin'
@@ -26,7 +31,7 @@ jobs:
       - name: Create zip with all dependency trees
         run: find . -type f -name 'maven_dep_tree.txt' -exec zip -r deptree.zip {} +
       - name: Upload zip
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: deptree
           path: deptree.zip
@@ -43,9 +48,9 @@ jobs:
     if: (github.actor != 'dependabot[bot]')
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Download Maven Dependencies
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: deptree
       - name: Extract zip and run Semgrep
diff --git a/.github/workflows/test_yarn.yml b/.github/workflows/test_yarn.yml
@@ -8,8 +8,13 @@ jobs:
   test_yarn:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 'v20.x'
           cache: 'yarn'
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,15 @@
+## v2.132.20 - 2026-04-16
+
+[Full Changelog](https://github.com/ORCID/orcid-angular/compare/v2.132.19...v2.132.20)
+
+- [#2820](https://github.com/ORCID/orcid-angular/pull/2820): PD-5449
+
+## v2.132.19 - 2026-04-16
+
+[Full Changelog](https://github.com/ORCID/orcid-angular/compare/v2.132.18...v2.132.19)
+
+- [#2819](https://github.com/ORCID/orcid-angular/pull/2819): PD-0000 fix-format
+
 ## v2.132.18 - 2026-04-16
 
 [Full Changelog](https://github.com/ORCID/orcid-angular/compare/v2.132.17...v2.132.18)
diff --git a/src/app/core/error-handler/error-handler.service.ts b/src/app/core/error-handler/error-handler.service.ts
diff --git a/src/app/rum/README.md b/src/app/rum/README.md
diff --git a/src/app/rum/http-error-event-attrs.spec.ts b/src/app/rum/http-error-event-attrs.spec.ts
diff --git a/src/app/rum/http-error-event-attrs.ts b/src/app/rum/http-error-event-attrs.ts
diff --git a/src/app/rum/service/customEvent.service.ts b/src/app/rum/service/customEvent.service.ts
