[fleizean]

Summary

Applies the five open Dependabot updates in one pull request and corrects the lock files that kept three of them from passing CI.

Why

Closes #30

Every push to develop deploys, so a bundle gives one deployment instead of five. Supersedes #23, #24, #25, #26 and #27.

Changes

• prom/prometheus v3.15.0 to v3.15.1, with the digest from chore(deps): Bump prom/prometheus from v3.15.0 to v3.15.1 in the compose-images group #23
• node 22.23.3-alpine to 22.23.4-alpine, with the digest from chore(deps): Bump node from 22.23.3-alpine to 22.23.4-alpine in /src/frontend in the other-images group across 1 directory #24
• @angular/cli 21.2.27 to 21.2.28 and postcss 8.5.30 to 8.5.31 (chore(deps): Bump @angular/cli from 21.2.27 to 21.2.28 in /src/frontend in the angular group #25, chore(deps): Bump postcss from 8.5.30 to 8.5.31 in /src/frontend in the npm-minor-patch group #26)
• Markdig 1.4.1 to 1.5.0 and Swashbuckle.AspNetCore 10.3.0 to 10.3.1 (chore(deps): Bump the nuget-minor-patch group with 2 updates #27)
• package-lock.json keeps the @emnapi/core and @emnapi/runtime entries that the Dependabot versions removed, which broke npm ci
• PkgDiff.Tests/packages.lock.json moves to the new versions, which chore(deps): Bump the nuget-minor-patch group with 2 updates #27 missed and which broke locked restore

Notes for reviewers

package-lock.json was built from the exact changes in #25 and #26 on top of current develop, because npm install drops the @emnapi entries and resolves newer patches than those two pull requests target. The node image also runs the render server, so merging replaces the runtime of the frontend container.

Checklist

• This pull request is linked to an issue (Closes #NNN above)
• The pull request targets develop and is about one thing
• Commit messages follow Conventional Commits (feat(scope): ..., fix(scope): ...)
• CI is green (backend tests, frontend build and tests, dependency gate)
• Schema changes are EF Core migrations generated by the tool, not hand-edited
• A changed backend DTO has its TypeScript twin updated in src/frontend/src/app/core/models
• New dependencies are justified and their lock files are updated in the same commit
• No secrets, tokens or personal data in code, logs or this description
• Code comments are kept to a minimum; the reasoning lives in this description

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​angular/​cli@​21.2.27 ⏵ 21.2.28				+1
	npm/​postcss@​8.5.30 ⏵ 8.5.31	+1		+1
	nuget/​markdig@​1.4.1 ⏵ 1.5.0
	nuget/​swashbuckle.aspnetcore@​10.3.0 ⏵ 10.3.1
	nuget/​swashbuckle.aspnetcore.swagger@​10.3.0 ⏵ 10.3.1
	nuget/​swashbuckle.aspnetcore.swaggergen@​10.3.0 ⏵ 10.3.1
	nuget/​swashbuckle.aspnetcore.swaggerui@​10.3.0 ⏵ 10.3.1

View full report