chore(deps): resolve vulnerability scanner gripes (#2453)

* chore(deps): update dependency @angular/common to v20.3.14 [security] (#2429)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): update dependency @angular/ssr to v20.3.17 [security] (#2432)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): update dependency rollup to v4.59.0 [security] (#2433)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* build(deps): bump form-data from 4.0.3 to 4.0.5 (#2403)

Bumps [form-data](https://github.com/form-data/form-data) from 4.0.3 to 4.0.5.
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.3...v4.0.5)

---
updated-dependencies:
- dependency-name: form-data
  dependency-version: 4.0.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: bump internal angular package versions

* test: fix jest issue with updated angular ssr

* build: fix vulnerable axios version issue

* build: fix vulnerable upstream braces dependency

v3.0.3 fixes the vulnerbility

* build: fix vulnerable upstream dset dependency

v3.1.4 fixes the vulnerbility

* build: fix vulnerable upstream astro dependency

v4.16.19 fixes the vulnerability. This minor bump within astro 4.x
(constrained by @tutorialkit/astro alpha peer dep) also lifts rollup,
cookie, and prismjs out of their vulnerable ranges in the
tutorials/create-app lockfile.

* build: fix vulnerable upstream esbuild dependency

v0.25.0+ fixes the vulnerability. astro 4.x and vite 5.4.x pin
esbuild to ^0.21.x, so a yarn resolutions override is the only
path to a safe esbuild without a major astro bump (blocked by
the @tutorialkit/astro alpha peer).

* build: fix vulnerable upstream on-headers dependency

v1.1.0 fixes the vulnerability. Bumping serve from ^14.2.0 to
^14.2.5 brings compression to 1.8.1 which depends on on-headers
~1.1.0 across the root and hello-world-ng21 lockfiles.

* build: fix vulnerable upstream tmp dependency

v0.2.4+ fixes the vulnerability. Both available package-edit chains
(cypress 13->15 or nx 21->22) were major bumps to load-bearing
devDeps; a resolutions override on the tmp utility itself is lower
risk because tmp's API is stable across 0.2.x patches.

* build: pin zod-to-json-schema to fix create-app build

astro's loose `zod-to-json-schema: ^3.23.5` range over-resolves to
3.25.x, which requires zod >=3.25.28 (and at runtime imports the
`zod/v3` subpath). @tutorialkit/astro pins zod to exact 3.23.8 so
the build fails with 'Package subpath ./v3 is not defined'.

Pin zod-to-json-schema to 3.23.5 via yarn resolutions — the last
version with peer zod ^3.23.3. Regression was introduced when
the dset fix bumped astro 4.10.2 -> 4.15.10.

* chore: tweak integration lockfile

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: 3 people