fix: resolve glob CLI command injection vulnerability (Dependabot #642)

[Copilot]

AB#(Dependabot #642)

Describe your changes

High-severity command injection vulnerability in glob 10.2.0-10.4.5 allows arbitrary code execution via malicious filenames when using the CLI's -c option. The vulnerability exists in transitive dependencies through @angular/cli and @azure/static-web-apps-cli.

Changes:

• Updated Angular packages to patch versions (20.3.11→20.3.14, 20.3.9→20.3.13)
• The Angular package updates automatically resolve all transitive glob dependencies to the patched version 10.5.0

Result: All glob dependencies now resolve to 10.5.0. High-severity vulnerabilities reduced from 14 to 0.

Checklist before requesting a code review

• I have performed a self-review of my code
• I have added tests for my changes, or: Adding tests is unnecessary/irrelevant
• I have asked the design team to review these changes, or: The changes do not touch the UI/UX
• I have made sure that all automated checks pass before requesting a review
• I do not need any deviation from our PR guidelines
• I have updated all documentation where necessary

Portal preview-deployment

This PR does not have any preview deployments yet.

Original prompt

Can make a PR to resolve this issue highlighted by dependabot? https://github.com/global-121/121-platform/security/dependabot/642

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[RubenGeo]

Does this really need to be here?

[RubenGeo]

can you explain why this change is needed? @copilot

[RubenGeo]

@copilot Can you please answer my 2 comments?

[Copilot]

@copilot Can you please answer my 2 comments?

I've addressed both comments:

1. Glob override (lines 126-127): Removed in commit abb7a9d. Testing confirmed the Angular package updates alone resolve the glob vulnerability - all instances now use [email protected] without needing the override.

2. app.routes.ts formatting (lines 127-129): Reverted in commit abb7a9d. This was an unrelated automatic prettier formatting change that happened when I ran npm run fix. I've reverted it to keep the PR focused only on the security fix.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• scarf.sh
  • Triggering command: /usr/local/bin/node node ./report.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)