[amadib]

@capitalone/acronym-decoder-admin-team, please review.

Why

Angular 19 is past end of support, and master is already on its final release (build-angular 19.2.27). That release pins the vulnerable versions of piscina, webpack-dev-middleware and webpack-dev-server, so Angular 19 can't pick up these fixes. Dependabot's attempts to fix them (#178, #179, #185, #206, #209, #210, #211) all fail CI: they jump the build tooling to Angular 21/22 while the app stays on 19.

This PR does the upgrade properly instead.

Supersedes

Once this merges, close these Dependabot PRs. Their security fixes are included here:

PR	Dependency fixed	Dependabot's (failing) approach
#178	@sigstore/core	@angular/cli 19 → 22
#179	sigstore	@angular/cli 19 → 22
#185	tar	@angular/cli 19 → 22
#206	piscina	build-angular 19 → 21, custom-webpack 19 → 22
#209	serialize-javascript	build-angular 19 → 21, custom-webpack 19 → 22
#210	webpack-dev-middleware	build-angular 19 → 21, custom-webpack 19 → 22
#211	esbuild	build-angular 19 → 21, custom-webpack 19 → 22

(GitHub's Closes #… keywords only close issues, not PRs, so these won't close automatically. Dependabot will likely close them itself once master no longer needs them; anything left gets closed by hand.)

Changes

1. Remove @angular-builders/custom-webpack. It isn't referenced anywhere (angular.json uses @angular-devkit/build-angular builders directly). It was the package pulling Dependabot PRs into major bumps.
2. Remove @ng-bootstrap/ng-bootstrap (and @popperjs/core). NgbModule was imported but no ng-bootstrap component is used. It only supports Angular 16 and blocked ng update. Bootstrap's CSS is still included.
3. Upgrade to Angular 20, with versions pinned consistently. src/tsconfig.spec.json moves from module: commonjs to es2020 to match the new moduleResolution: bundler.
4. Upgrade to Angular 21 with the official migrations: templates move to the @if/@for control-flow syntax, and main.ts provides zone change detection explicitly.

TypeScript stays at ~5.9.3. TypeScript 6 is outside Angular 21's supported range and turns on strict mode by default.

Verification (local, Node 22)

	master (19)	this PR (21)
npm run test:ci	28/28	28/28
ng build --configuration=production	✅	✅
npm run build (incl. webpack)	✅	✅
npm audit (critical / high / total)	4 / 34 / 73	2 / 22 / 48

The esbuild, piscina, serialize-javascript, webpack-dev-middleware, tar and sigstore advisories are all cleared. Angular 21 supports CI's Node 20 (^20.19).

Reviewer checklist

• Load the unpacked extension from dist and smoke-test the popup, the options page and on-page lookup. These templates went through the control-flow migration.
• Check that the fxLayout rows still lay out correctly. @angular/flex-layout is abandoned at 15.0 beta but still works on 21.

Follow-ups (not in this PR)

• Angular 22: needs TypeScript 6 (fix strict-null errors in background.ts and popup.component.ts), CI on Node 24, and @angular/flex-layout replaced with CSS flexbox. This clears the remaining vite and @angular/cli tooling advisories.
• Remove deprecated tslint, codelyzer and protractor, which account for most of the remaining audit findings.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​angular/​animations@​19.2.18 ⏵ 21.2.25	+1			-47
	@​angular/​platform-browser-dynamic@​19.2.18 ⏵ 21.2.25	+1			-47
	@​angular/​language-service@​19.2.18 ⏵ 21.2.25			+3
	@​angular/​platform-browser@​19.2.18 ⏵ 21.2.25
	@​angular/​compiler-cli@​19.2.18 ⏵ 21.2.25	+1		+1
	@​angular/​router@​19.2.18 ⏵ 21.2.25		+22
	@​angular/​forms@​19.2.18 ⏵ 21.2.25	+1		+1
	@​angular/​cli@​19.2.19 ⏵ 21.2.27	-3		+1
	@​angular/​compiler@​19.2.20 ⏵ 21.2.25		+20
	@​angular/​cdk@​19.2.19 ⏵ 21.2.14
	@​angular/​core@​19.2.20 ⏵ 21.2.25		+26	-1
	@​angular/​common@​19.2.18 ⏵ 21.2.25	+1	+50
	@​angular/​material@​19.2.19 ⏵ 21.2.14	+1		+1
	@​angular-devkit/​build-angular@​19.2.27 ⏵ 21.2.27			+1
	typescript@​5.8.3 ⏵ 5.9.3	+1		+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm caniuse-lite License: LicenseRef-CC-BY-4.0-0c618849 - The applicable license policy does not permit this license (5) (package/LICENSE) From: package-lock.json → npm/webpack@5.109.2 → npm/@angular/compiler-cli@21.2.25 → npm/@angular-devkit/build-angular@21.2.27 → npm/karma-coverage@2.2.1 → npm/caniuse-lite@1.0.30001817 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001817. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm typescript License: LicenseRef-CC-BY-4.0-0c618849 - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: package-lock.json → npm/typescript@5.9.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@5.9.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report