[cs-raj]

Summary

Clean lock file regeneration plus dependency bumps for kickstart-angular, with a patch version bump. Base branch is development.

Version bump

Branch	package.json version
main	0.1.3
development (before this PR)	0.1.3 (not bumped)
this PR	0.1.4 (patch bump, above main)

What changed

• package.json: version 0.1.3 -> 0.1.4 and 24 range changes across dependencies, devDependencies, optionalDependencies and overrides (Angular 21.2.19 -> 21.2.25, @angular/cli and build-angular -> 21.2.29, @contentstack/delivery-sdk ^5.6.2, live-preview-utils ^4.5.3, and others). These edits were made by hand in the working tree before this run and are included as they were.
• package-lock.json: deleted together with node_modules, then regenerated with a clean npm install (lockfileVersion 3).

Snyk (snyk test, vulnerabilities only; license findings listed separately)

Scan	Critical	High	Medium	Low	Total
Before: committed lock on development	2	16	15	1	34
Lock regen only (committed package.json, fresh lock)	0	3	3	0	6
After: this PR (bumps + fresh lock)	0	0	0	0	0

Fixed by the lock regeneration alone (28): dompurify 3.4.13 (8, incl. 2 critical), axios 1.19.0 (13), follow-redirects 1.16.0 (3), qs 6.15.2 (4). IDs: SNYK-JS-DOMPURIFY-20361471, -20536984, -21460653, -21460655, -21460657, -21755399, -21755401, -21755403; SNYK-JS-AXIOS-20244996, -20245042, -20245044, -20245046, -20245048, -20245050, -20245056, -20245058, -20245060, -20245062, -20245064, -20245066, -20341520; SNYK-JS-FOLLOWREDIRECTS-21249784, -21280747, -21762031; SNYK-JS-QS-19432017, -19432019, -20943482, -21755395.

Fixed by the package.json bumps on top of the regen (6): @angular/router 21.2.19 (SNYK-JS-ANGULARROUTER-20361514, -21280762, -21280763), @angular/common, @angular/compiler and @angular/core 21.2.19 (SNYK-JS-ANGULARCOMMON-19778383, SNYK-JS-ANGULARCOMPILER-19778381, SNYK-JS-ANGULARCORE-19778382). These are exact pins, so the regen alone cannot move them.

Remaining vulnerabilities: none. New issues introduced: none.
License findings (unchanged, also present before): 2 medium MPL-2.0 for lightningcss-linux-x64-gnu and -musl 1.33.0.

Build and tests

• npm run build (runs generate-env.js then ng build): passes, only the usual CommonJS-optimization warnings from @contentstack/live-preview-utils.
• No test script in this repo.
• The build rewrites the tracked src/environments/*.ts files; they were restored and are not part of this PR.

Notes

• development is 5 commits behind main, so a back-merge is pending; this PR does not include it.
• Nothing was merged or pushed to main or development.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	2	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 2
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed