chore(deps): lock file maintenance

[ferrlabs-renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Lock file maintenance only, no package.json specifiers changed. All bumps are transitive and patch-level: @types/node 26.6.1→26.6.2, rollup 4.63.3→4.63.4 (and its platform binaries), empathic 2.0.1→2.1.0, lru-cache 11.5.2→11.5.3, plus resolution-hash refreshes for @storybook/angular and minimizer-webpack-plugin that follow from those. Nothing here touches a breaking change surface.

Could not fetch check runs/status for this commit (403, integration lacks access to Checks API on this repo) so CI result is unverified from my side — worth confirming manually before merging.

[ferrfleet]

Re-reviewed at 36b26b6. Renovate regenerated the branch since my last pass, so my earlier "patch-level only" summary no longer describes this diff. The new lock is a much larger refresh, and part of it is a toolchain swap rather than version numbers.

What moved:

• Angular 22.1.7/22.1.8 → 22.2.0 across core, CDK, CLI, devkit and @angular/build. Specifiers are ^22.0.0, so in range.
• ng-packagr 22.1.1 → 22.2.1 with a different bundler underneath: rollup, rollup-plugin-dts and @rollup/wasm-node are gone, rolldown-plugin-dts and dts-resolver are new. Library dist output is produced by a different bundler after this merges.
• sass-embedded 1.105.0 newly pulled in alongside sass 1.101.0 → 1.105.0, with per-platform native binaries. Every platform package is present in the lock, so --frozen-lockfile installs still resolve.
• webpack-dev-server 5.2.6 → 6.0.0 and webpack-dev-middleware → 8.3.0, both major. Legitimate resolution, not a lock error: @angular-devkit/build-webpack@0.2202.0 widened its peer range to ^5.0.2 || ^6.0.0. This is the Storybook/webpack dev-server path.
• Dropped: terser, less, express, hono, zod. @modelcontextprotocol/sdk@1.30.0 is replaced by @modelcontextprotocol/core/server@2.0.0 (Angular CLI's MCP server).
• @typescript-eslint/*@8.70.0 deduped onto the 8.70.1 copy already in the lock. vite 8.1.5 → 8.3.0, webpack 5.109.2 → 5.111.0.

Consistency checks against the diff: no specifier: line changed, no edits to lockfileVersion, overrides, patchedDependencies or settings, every added resolution: is a registry sha512 integrity with no tarball or git URL, and no package kept its version while changing its hash.

Nit: the ng-packagr bundler change and the dev-server major are the two things a version scan doesn't cover. Worth running pnpm build and opening Storybook once locally before merging rather than relying on CI alone.

Checks API is still 403 for this integration, so CI state on 36b26b6 is unverified from my side.

[ferrfleet]

Re-approving at fd000fa. Diffed the lock against 36b26b6 directly: the only change is bundle-name 4.1.0 → 4.1.1 (transitive, under default-browser → open), registry sha512 integrity, no dependency edges added or removed. Everything I described in the previous review is otherwise byte-identical, so nothing new to raise and my earlier nit about exercising pnpm build and Storybook before merge still stands.

Checks API remains 403 for this integration, so CI state on fd000fa is unverified from my side.

[ferrfleet]

Re-approving at 7ec6eb3. Diffed the lock against fd000fa: the only package change is @types/node 26.6.2 → 26.6.3 (registry sha512 integrity, undici-types@8.9.0 unchanged). Everything else in the 751-line diff is the peer-suffix rewrite that bump forces (@inquirer/*, @angular/cli, @angular/build, vite) plus one storybook@10.6.0 resolution-hash refresh. No specifier changed, no lockfileVersion/overrides/settings edits, package set otherwise identical.

Checks API is still 403 for this integration, so CI state on 7ec6eb3 is unverified from my side.

[ferrfleet]

Re-approving at 22ce187. Renovate rebased onto the new main (the @ferrlabs/ui-foundation peer/devDep addition in packages/ui-ng/package.json), and the lock reflects it: packages/ui-ng carries @ferrlabs/ui-foundation: workspace:^ → link:../foundation, so --frozen-lockfile stays satisfiable.

Package changes vs 7ec6eb3, 16 in, 16 out, all transitive and all patch/minor:

• ng-packagr 22.2.1 → 22.2.2, browserslist 4.29.1 → 4.29.2, webpack-sources 3.5.3 → 3.6.0, ws 8.21.3 → 8.22.0, lint-staged 17.5.1 → 17.6.0, ansi-regex 6.3.0 → 6.4.0
• @peculiar/asn1-* (10 packages) 2.9.5 → 2.10.0

No specifier: line changed against the base, no lockfileVersion/overrides/patchedDependencies/settings edits, every added resolution: is a registry sha512, and no package kept its version while changing its hash.

Checks are readable this run: osv-scanner, snyk, gitleaks, zizmor green; Typecheck and Storybook accessibility still running at review time. The earlier nit stands, exercise pnpm build and Storybook locally once, since the ng-packagr bundler swap and the webpack-dev-server 6 major are not covered by a version scan.

[ferrfleet]

Re-reviewed at a7e313d and diffed the lock against 22ce187. Most of it is a normal refresh: Angular 22.2.0 → 22.2.1, Storybook 10.6.0 → 10.6.1, ng-packagr 22.2.2 → 22.2.4, typescript-eslint 8.70.1 → 8.71.0, rolldown bindings 1.2.11 → 1.2.12, @jsonjoy.com/fs-* 4.79 → 4.80, plus a few other patch/minor bumps. Specifiers, lockfileVersion, overrides and settings are unchanged, and there are no tarball or git resolutions.

Blocking: @angular/platform-browser-dynamic goes down from 22.2.0 to 20.0.7 (lock lines 414 and 7998). It's the only downgrade in the diff. The package comes in through the @storybook/angular@10.6.1 peer (>=18.0.0 < 23.0.0, auto-installed), and 22.2.1 satisfies that range. 20.0.7 pins its own peers to @angular/core/common/compiler/platform-browser 20.0.7 exactly, but the lock wires it to 22.2.1. So Storybook would run a v20 platform-browser-dynamic against v22 core, and those packages share private ɵ APIs that aren't stable across majors. The integrity hash matches the npm registry, so this looks like a peer-resolution quirk and not tampering, but it shouldn't be merged as is. Fix: have Renovate regenerate the lock (rebase checkbox), or run pnpm update @angular/platform-browser-dynamic locally, and confirm it resolves to 22.2.1. If it lands on 20.x again, add @angular/platform-browser-dynamic: ^22.0.0 as a devDependency of the Storybook package so pnpm can't choose the old major.

Typecheck, Storybook accessibility and two Secrets + CVE jobs were still running when I reviewed. The rest were green or skipped.

[ferrfleet]

Re-reviewed at 223b9e1. Compared with a7e313d, the only lock change is ignore 7.0.11 → 7.0.12, a transitive patch bump under @typescript-eslint with a registry sha512. That one is fine.

The blocking finding from my last review still stands. @angular/platform-browser-dynamic still resolves to 20.0.7 against Angular 22.2.1 (lock lines 414 and 7998), so the earlier fix still applies.

CI on 223b9e1 was still running when I reviewed.

[ferrfleet]

Re-reviewed at 4a898ed and diffed the lock against 223b9e1. Renovate rebased onto main, which picked up the @storybook/test-runner ^0.26.0 specifier that main already has (0.24.5 → 0.26.0). Other changes: minimizer-webpack-plugin 5.12.0 → 5.13.0 and shell-quote 1.11.0 → 1.12.0, both transitive, both with registry sha512 integrity. Nothing new to raise.

Still unresolved: @angular/platform-browser-dynamic stays at 20.0.7 against Angular 22.2.1 (lock lines 414 and 7998). main resolves it to 22.1.7, so this PR is still the one introducing the downgrade.

CI on 4a898ed was still running when I reviewed.

[ferrfleet]

Re-reviewed at 6436368 and diffed the lock against 4a898ed. The only package change is eslint 10.11.0 → 10.12.0 (registry sha512), plus the peer-suffix rewrites that follow from it. No specifier changes. Nothing new to raise.

My earlier blocking finding is unchanged and still applies (see the previous review).

CI on 6436368 was still running when I reviewed.

[ferrfleet]

Re-reviewed at d7c4860. pnpm-lock.yaml is byte-identical to 6436368, so this push is only a rebase and adds nothing new to review.

The blocking @angular/platform-browser-dynamic 20.0.7 downgrade is still unresolved (lock lines 414 and 7998). See my earlier review.

CI on d7c4860 was still running when I reviewed.

[ferrfleet]

Re-reviewed at 87866d9. pnpm-lock.yaml is byte-identical to d7c4860, so this push is a rebase only. Nothing new to raise, and the earlier blocking finding is unchanged.

CI on 87866d9 was still running when I reviewed.

[ferrfleet]

Re-reviewed at 864f078 and compared the lock with 87866d9. The only new changes are transitive bumps, each with a registry sha512: @inquirer/* patch releases (core 12.0.4, ansi 2.0.9, confirm 6.3.3 and the other prompts), @inquirer/type 4.1.1 → 4.2.0, and regenerate 1.4.2 → 1.5.0. No specifiers changed. Nothing new to raise.

The blocking finding is still not fixed: @angular/platform-browser-dynamic resolves to 20.0.7 against Angular 22.2.1 (lock lines 414 and 8016).

CI on 864f078 was still running when I reviewed.

[ferrfleet]

Re-reviewed at c82a4d4.

Since 864f078 the lock only has transitive patch/minor bumps, each with a registry sha512: Angular CLI/devkit/build/cdk 22.2.1 → 22.2.2, typescript-eslint 8.71.0 → 8.71.1, rolldown 1.2.12 → 1.2.13, playwright 1.63 → 1.64, @modelcontextprotocol/* 2.0.0 → 2.3.1, Babel patches. postcss@8.5.29 and verkit@0.5.0 are new. No specifier changed.

The shell.component.ts change is correct. The accessible name now comes from the visible "Search" text, which fixes the label-in-name mismatch. aria-keyshortcuts="Meta+K Control+K" matches what onKeydown handles, and hiding the ⌘K glyph stops screen readers from reading it out. No spec asserted the old label.

Still blocking: @angular/platform-browser-dynamic resolves to 20.0.7 against Angular 22.2.1 (lock lines 414 and 8048).

[ferrfleet]

Re-reviewed 612754c. pnpm-lock.yaml didn't change, so this covers only the accessible-name changes, and they're correct:

• App switcher, expanded: with no aria-label, the button takes its name from the visible "{label} Switch app" text. Collapsed, it still gets caption, label.
• User menu: the avatar is aria-hidden when the name is shown. When only the avatar shows (collapsed rail, or showName false), the fallback's new role="img" with aria-label gives the button the user's name. The image branch already did this through alt.
• The story now finds the trigger by role and name instead of reading aria-label, which matches the new behaviour.

Nothing new to raise.