[dependabot]

Bumps @angular/compiler from 21.2.25 to 22.2.3.

Release notes

Sourced from @​angular/compiler's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• 54f3de5 fix(compiler): check @boundary blocks in the control flow content projectio...
• 5e50658 fix(compiler): compare the operand in ReadTemporaryExpr.isEquivalent
• 35a02f8 fix(compiler): harden JIT against prototype pollution
• b6f9cc5 fix(compiler): do not scope comments placed inside of a selector
• 08075e8 fix(compiler): support dots in class binding names
• c7a72c2 fix(compiler): support popover property bindings
• 5ff83c1 fix(compiler): strip script elements regardless of namespace
• 6fa2b08 refactor(compiler): remove img/video src attribute from the URL security cont...
• fa63bfa fix(compiler): avoid leaking ::ng-deep detection state between rules
• 725ffcf fix(compiler): match namespaced root nodes of control flow blocks against ng-...
• Additional commits viewable in compare view

[hansi-codes]

🟡 Tier B · Needs changes before merging

The existing open finding remains confirmed: npm ci fails with ERESOLVE because the Angular 21 toolchain requires compiler 21.

This updates @angular/compiler from 21.2.25 to 22.2.3 in the package manifest and npm lockfile. The lockfile also records the updated package tarball, integrity hash, and Node.js engine range.

Verdict	New comments	Fixed	Still open
💬 Commented	0	0	1

Fix with agent prompt

### Issue 1
package.json:15
**Keep compiler aligned with Angular 21**

This changes only `@angular/compiler` to 22.2.3, but `@angular/compiler-cli` and the Angular 21 packages remain at 21.2.25 and declare an exact peer dependency on compiler 21.2.25. That leaves an incompatible Angular toolchain, so dependency installation/build can fail; keep the compiler on 21.2.25 or upgrade the Angular packages together.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

📂 Walkthrough · 2

File	Change
package.json	Bumped the declared @angular/compiler version to 22.2.3.
package-lock.json	Updated the locked compiler tarball, integrity hash, and Node.js engine range.

⏳ Still open from earlier reviews · 1

• 🟠 Keep compiler aligned with Angular 21 · package.json:15

---

_{Reviewed 425009e · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟡 Tier B · 1 blocking finding to address. Summary

[hansi-codes]

Keep compiler aligned with Angular 21

This changes only @angular/compiler to 22.2.3, but @angular/compiler-cli and the Angular 21 packages remain at 21.2.25 and declare an exact peer dependency on compiler 21.2.25. That leaves an incompatible Angular toolchain, so dependency installation/build can fail; keep the compiler on 21.2.25 or upgrade the Angular packages together.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 15

Comment:
**Keep compiler aligned with Angular 21**

This changes only `@angular/compiler` to 22.2.3, but `@angular/compiler-cli` and the Angular 21 packages remain at 21.2.25 and declare an exact peer dependency on compiler 21.2.25. That leaves an incompatible Angular toolchain, so dependency installation/build can fail; keep the compiler on 21.2.25 or upgrade the Angular packages together.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{🟠 Major · bug · Reply if this doesn't apply.}