[dependabot]

Bumps @angular/common from 21.2.25 to 22.2.3.

Release notes

Sourced from @​angular/common's releases.

22.2.3

common

Commit	Description
	harden param encoding against prototype pollution

compiler

Commit	Description
	check @boundary blocks in the control flow content projection diagnostic
	compare the operand in ReadTemporaryExpr.isEquivalent
	do not scope comments placed inside of a selector
	harden JIT against prototype pollution
	support dots in class binding names
	support popover property bindings

compiler-cli

Commit	Description
	inline tcb when depending on local directive

core

Commit	Description
	avoid deleting idle bucket created during another bucket's drain
	do not swallow compilation errors in computeStandaloneComponentScope
	don't crash initEventReplay when two apps share an APP_ID
	error when destroying embedded view with animations
	keep activeConsumer and currentInjector constant using Store helper
	skip nested tick from onMicrotaskEmpty while a tick is running

forms

Commit	Description
	use addEventListener to avoid unconditional CD scheduling on blur

migrations

Commit	Description
	normalize .d.ts paths in output migration field IDs

router

Commit	Description
	check abort signal state on subscribe

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

... (truncated)

Commits

• dcb29a9 docs: fix @​param names that don't match their parameters
• fafec77 fix(common): harden param encoding against prototype pollution
• ad2f291 fix(common): let NgOptimizedImage pass a [srcset] binding through when srcset...
• 6dee7fe fix(http): forward reportProgress of httpResource as `reportDownloadProgr...
• 270abc9 docs(docs-infra): throw on absolute links in @​see tags
• b9de99d fix(common): remove abort listener on the abort path too in httpResource
• 1bc7e3c refactor(core): use native Promise.withResolvers() in remaining tests
• 0bdbbcf fix(docs-infra): only read a deprecation version from the start of the tag
• af26a8c fix(router): avoid view transitions when the user agent provides one
• 7596548 fix(common): use locale NaN symbol in number formatting
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hansi-codes]

🟡 Tier B · Needs changes before merging

The Angular version mismatch leaves the dependency graph invalid and blocks the CI build.

Updates @angular/common from 21.2.25 to 22.2.3 in the dependency manifest and lockfile. Other Angular framework packages remain on 21.2.x.

Verdict	New comments	Fixed	Still open
🛑 Changes requested	1	0	0

	Finding	Where
🟠	Keep Angular framework packages on the same major	package.json:14

Fix with agent prompt

### Issue 1
package.json:14
**Keep Angular framework packages on the same major**

`@angular/common@22.2.3` requires `@angular/core@22.2.3`, but this project still declares core 21.2.x; forms, platform-browser, and router also require common 21.2.25. This leaves an invalid peer dependency graph and causes the CI install/build to fail unless the Angular packages are upgraded together.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

📂 Walkthrough · 2

File	Change
package.json	Bumps the declared @angular/common dependency to 22.2.3.
package-lock.json	Locks @angular/common to 22.2.3.

---

_{Reviewed 9cccb49 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟡 Tier B · 1 blocking finding to address. Summary

[hansi-codes]

Keep Angular framework packages on the same major

@angular/common@22.2.3 requires @angular/core@22.2.3, but this project still declares core 21.2.x; forms, platform-browser, and router also require common 21.2.25. This leaves an invalid peer dependency graph and causes the CI install/build to fail unless the Angular packages are upgraded together.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 14

Comment:
**Keep Angular framework packages on the same major**

`@angular/common@22.2.3` requires `@angular/core@22.2.3`, but this project still declares core 21.2.x; forms, platform-browser, and router also require common 21.2.25. This leaves an invalid peer dependency graph and causes the CI install/build to fail unless the Angular packages are upgraded together.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{🟠 Major · bug · Reply if this doesn't apply.}