[Snyk] Fix for 2 vulnerabilities

[RayG-XD]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Cross-site Scripting (XSS) SNYK-JS-ANGULARCOMPILER-14908872	651
	Cross-site Scripting (XSS) SNYK-JS-ANGULARCORE-14908871	651

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)

---

Summary by cubic

Fixes 2 high-severity XSS vulnerabilities by upgrading @angular/core and @angular/compiler to 19.2.18. This may require updating Node and aligning Angular peer dependencies.

• Dependencies

  • Upgrade: @angular/core, @angular/compiler 14.x -> 19.2.18
  • Resolves: SNYK-JS-ANGULARCOMPILER-14908872, SNYK-JS-ANGULARCORE-14908871
  • New requirements: Node >= 18.19.1 (or 20.11+/22+), zone.js ~0.15.0

• Migration

  • Align remaining Angular packages (animations, common, forms, platform-browser, etc.) to 19.x
  • Update zone.js to ~0.15.0 and ensure Node version meets the new range in CI/local
  • Rebuild and run tests to catch any breaking changes

^{Written for commit 039bafc. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
clips	Error		Jan 12, 2026 10:42am

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Warning

.coderabbit.yaml has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

💥 Parsing errors (1)

duplicated mapping key in ".coderabbit.yaml" (28:1)

 25 | 
 26 | knowledge_base:
 27 | code_guidelines:
 28 | enabled: true
------^
 29 | filePatterns:
 30 |   - "**/.cursorrules"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch snyk-fix-512b487170c289fe34ea0dc6e47ec11d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="package.json">

<violation number="1" location="package.json:18">
P0: **Critical version mismatch**: This PR only updates `@angular/compiler` and `@angular/core` to v19, while all other Angular packages remain at v14. Angular packages must be at the same major version. This will cause peer dependency errors during npm install and runtime failures. All `@angular/*` packages need to be upgraded together to v19, along with compatible versions of `zone.js`, `rxjs`, and `typescript`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P0: Critical version mismatch: This PR only updates @angular/compiler and @angular/core to v19, while all other Angular packages remain at v14. Angular packages must be at the same major version. This will cause peer dependency errors during npm install and runtime failures. All @angular/* packages need to be upgraded together to v19, along with compatible versions of zone.js, rxjs, and typescript.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 18:

<comment>**Critical version mismatch**: This PR only updates `@angular/compiler` and `@angular/core` to v19, while all other Angular packages remain at v14. Angular packages must be at the same major version. This will cause peer dependency errors during npm install and runtime failures. All `@angular/*` packages need to be upgraded together to v19, along with compatible versions of `zone.js`, `rxjs`, and `typescript`.</comment>

<file context>
@@ -15,8 +15,8 @@
     "@angular/common": "^14.0.0",
-    "@angular/compiler": "^14.0.0",
-    "@angular/core": "^14.0.0",
+    "@angular/compiler": "^19.2.18",
+    "@angular/core": "^19.2.18",
     "@angular/fire": "^7.1.0",
</file context>