chore(deps): bump Angular to 21.2.17, axios 1.16.0, esbuild 0.28.1

[4gray]

What

Consolidated dependency bump that supersedes several open dependabot PRs.

Package(s)	From	To	Supersedes
@angular/* framework + @angular/cli + @angular-devkit/*	21.2.9 / 21.2.10	21.2.17	#1072, #1074, #1075, #1076
@angular/material, @angular/cdk	21.2.9	21.2.14 (latest 21.2.x)	—
axios	1.15.2	1.16.0	#1019
esbuild	0.27.0	0.28.1	#1055

Why

Dependabot only opened PRs for 4 of ~16 @angular/* packages. Merging those alone would leave the framework partially bumped (core group at 21.2.17, the rest at 21.2.9). This PR bumps the whole Angular 21.2.x line at once to keep framework packages in sync, and folds in the two other green dependency PRs.

@angular/material/@angular/cdk don't publish a 21.2.17 — 21.2.14 is the latest patch in their release line.

@angular-eslint/* (21.3.1) is intentionally left untouched — it's a separate release track.

Validation

• ✅ nx test web — 114/114
• ✅ nx test electron-backend — 508/508
• ✅ nx build web (production / AOT)
• ✅ nx lint web + nx lint electron-backend

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR consolidates several Dependabot dependency bumps: Angular framework packages (including CLI, devkit, and build tools) are updated from 21.2.9 to 21.2.17, @angular/material and @angular/cdk are updated to their latest patch (21.2.14 — no 21.2.17 exists for those packages), axios goes from 1.15.2 to 1.16.0, and esbuild from 0.27.0 to 0.28.1. The PR description explains the motivation well: bumping only the subset of Angular packages that Dependabot targeted would have left the framework partially in sync.

• Angular 21.2.17: All core framework packages and devkit packages are updated consistently; @angular/material/@angular/cdk stay at 21.2.14, the latest compatible patch in their line.
• esbuild 0.28.1: Includes a security fix preventing directory traversal via backslashes on Windows in esbuild's local dev server, plus minification bug fixes for using/await using declarations.
• axios 1.16.0 and the transitive @babel/traverse (7.29.0 → 7.29.7) bump cleanly with no API surface changes visible in the lock file.

Confidence Score: 5/5

This is a well-scoped patch-level dependency bump with all tests and the production build verified by the author before opening the PR.

All Angular packages are updated atomically and consistently across both dependencies and devDependencies; the minor version gap between Angular core (21.2.17) and material/cdk (21.2.14) is intentional and documented. The esbuild 0.28.x changes are net-positive (security hardening, minification bug fixes) and do not affect this project's build configuration. The lock file peer-dependency resolution strings are correctly regenerated. 114+508 tests passing across both targets, plus a clean production build, give high confidence there are no regressions.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	All Angular 21.2.x packages bumped consistently to 21.2.17 (or 21.2.14 for material/cdk); axios and esbuild also updated. Versions in both dependencies and devDependencies sections are kept in sync.
pnpm-lock.yaml	Lock file reflects all version changes from package.json; peer-dependency resolution strings are correctly updated to the new Angular versions throughout, including for ngrx, ngx-*, and @angular-eslint packages.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph Angular["Angular Framework (21.2.9 to 21.2.17)"]
        A1["@angular/core"]
        A2["@angular/common"]
        A3["@angular/compiler / compiler-cli"]
        A4["@angular/router"]
        A5["@angular/forms"]
        A6["@angular/platform-browser / -dynamic"]
        A7["@angular/animations"]
        A8["@angular/service-worker"]
        A9["@angular/build / cli"]
        A10["@angular-devkit/core / schematics"]
        A11["@angular/language-service"]
    end

    subgraph Material["Angular Material (21.2.9 to 21.2.14)"]
        B1["@angular/material"]
        B2["@angular/cdk"]
    end

    subgraph Other["Other Packages"]
        C1["axios (1.15.2 to 1.16.0)"]
        C2["esbuild (0.27.0 to 0.28.1)"]
    end

    Angular --> Material
    Angular --> Other
    Material --> |"peer: @angular/core 21.2.17"| A1

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    subgraph Angular["Angular Framework (21.2.9 to 21.2.17)"]
        A1["@angular/core"]
        A2["@angular/common"]
        A3["@angular/compiler / compiler-cli"]
        A4["@angular/router"]
        A5["@angular/forms"]
        A6["@angular/platform-browser / -dynamic"]
        A7["@angular/animations"]
        A8["@angular/service-worker"]
        A9["@angular/build / cli"]
        A10["@angular-devkit/core / schematics"]
        A11["@angular/language-service"]
    end

    subgraph Material["Angular Material (21.2.9 to 21.2.14)"]
        B1["@angular/material"]
        B2["@angular/cdk"]
    end

    subgraph Other["Other Packages"]
        C1["axios (1.15.2 to 1.16.0)"]
        C2["esbuild (0.27.0 to 0.28.1)"]
    end

    Angular --> Material
    Angular --> Other
    Material --> |"peer: @angular/core 21.2.17"| A1

Loading

_{Reviews (1): Last reviewed commit: "chore(deps): bump Angular to 21.2.17, ax..." | Re-trigger Greptile}