[fleizean]

Summary

Overrides two dev-only frontend dependencies to their patched releases so the npm audit gate passes again.

Why

Three high advisories were published on 2026-10-20, and the Dependency gates job now fails on every branch (seen on #12):

• GHSA-22jm-h49p-29qw and GHSA-46jr-4wx8-v453 in @modelcontextprotocol/sdk < 1.32.0
• GHSA-587h-7wmj-h5pm in vite <= 7.3.6

@angular/cli 21.2.27 pins @modelcontextprotocol/sdk 1.31.0 and @angular/build 21.2.27 pins vite 7.3.6 exactly, so a plain update cannot pick up the fixes.

Changes

• package.json overrides: @modelcontextprotocol/sdk 1.32.1 and vite 7.3.7. Both are patch or minor releases within the same major.
• package-lock.json regenerated with npm install --package-lock-only. Only these two entries change.

Notes for reviewers

• node .github/scripts/npm-audit-gate.mjs src/frontend passes locally. The frontend build and tests were not run locally; CI is the check.
• Drop the overrides once an @angular/cli / @angular/build release ships with the patched versions.
• fix: pub.dev per-version changelogs and public-only GitHub repositories #12 needs this merged first (or develop merged into it) to get a green Dependency gates job.

Checklist

• The pull request targets develop and is about one thing
• Commit messages follow Conventional Commits (feat(scope): ..., fix(scope): ...)
• CI is green (backend tests, frontend build and tests, dependency gate)
• Schema changes are EF Core migrations generated by the tool, not hand-edited
• A changed backend DTO has its TypeScript twin updated in src/frontend/src/app/core/models
• New dependencies are justified and their lock files are updated in the same commit
• No secrets, tokens or personal data in code, logs or this description
• Code comments are kept to a minimum; the reasoning lives in this description