The Angular 13.x build toolchain (@angular/core, @angular/common, @angular/forms, @angular/platform-browser, @angular/compiler, @angular/compiler-cli, and a @babel/core copy nested inside @angular/compiler-cli) is known-vulnerable per npm audit. These are an accepted risk rather than fixed by upgrading, for the reasons below.

These packages live in vendor/package.json, a separate, independently-installed manifest — not the root package.json — so plain npm audit run at the repo root reports 0 vulnerabilities. Run npm audit --prefix vendor to review new findings in this toolchain specifically; expect it to list the packages above until the reasoning below no longer applies.

• All of the flagged advisories are runtime bugs in Angular itself (XSS via SVG/MathML/ sanitizer bypasses, HttpTransferCache cache-key issues, etc.) — bugs that matter when an Angular application renders untrusted content through Angular's own sanitizer/HTTP layer at runtime.
• @angular/* is used in this repo only as a build-time toolchain to compile packages/angular via ngc (see scripts/build-angular.js, which installs vendor/package.json on demand). Angular is never bundled into the published package — packages/angular/package.json only declares it as a peerDependency (>=13.0.0), and the build config lists it as a rollup external.
• ngc only compiles this repo's own trusted, first-party source (the .common.tsx templates and src/angular/components/*.ts), never end-user or untrusted templates. The sanitizer/XSS-class advisories aren't reachable through that build step.
• The nested @babel/core vulnerability (arbitrary file read via sourceMappingURL) is Angular's own vendored copy (vendor/node_modules/@angular/compiler-cli/node_modules/@babel/core), not this repo's own @babel/core devDependency — same build-time-only reasoning applies.

The suggested fix bumps @angular/* to 22.x. Angular's Ivy "partial compilation" output is forward-compatible only: a library compiled with an older Angular compiler links into newer Angular apps, but not the reverse. Compiling packages/angular with Angular 22 would produce output that Angular 13–2x consumers can no longer link, breaking the "@angular/core": ">=13.0.0" peer-dependency promise in packages/angular/package.json. @angular/compiler-cli@13 (the version this repo currently builds with) also caps typescript at <4.7, so bumping Angular for audit purposes would force a TypeScript upgrade path as well.

If the minimum supported Angular version is ever raised, @angular/*, zone.js, and typescript can be revisited together — re-run npm audit at that point to see whether a smaller bump than 22.x already clears these advisories.