[gkrajniak]

Summary

Resolves the fixable npm audit findings and Dependabot alerts in
portal/. package.json is unchanged; only the lockfile moves.

Angular (re-resolved within the existing ^22.0.0 ranges)

• @angular/common, compiler, compiler-cli, core, forms,
  platform-browser, router 22.1.3 → 22.2.3 (@angular/router
  GHSA-ff3f-86qr-9cv3, GHSA-62vg-58rm)
• @angular/build, @angular/cli 22.1.5 → 22.2.4; this brings piscina
  5.2.0 → 5.3.2 (critical, GHSA-67c8-pqhq-4rmx) and replaces
  @modelcontextprotocol/sdk 1.30.0 with @modelcontextprotocol/server
  2.3.1, which also drops hono, ip-address and proxy-addr

Lockfile updates (npm audit fix)

• vite 8.2.2 → 8.3.5, fast-uri 3.1.6 → 3.1.9, follow-redirects 1.16.0 →
  1.16.1, source-map-js 1.2.1 → 1.2.2, brace-expansion 5.0.9 → 5.0.12,
  engine.io 6.6.9 → 6.6.11, qs 6.15.3 → 6.16.1

Not fixable

• braces 3.0.3 (GHSA-vfj7-8cjw-p6xm), dev only, via karma/chokidar; no
  patched version is published

Verification

npm ci, npm install and npm run build pass (the CI and
deploy/portal.Dockerfile steps). The portal has no tests (no spec
files) and CI does not run ng test. ng test itself fails at startup
on main as well (Cannot assign to read only property 'describe',
zone.js with jasmine-core 7 since #697).

Controller build (pinned Go dependencies)

Why

The controller image has not built since #705 moved
sigs.k8s.io/controller-runtime to 0.25 (and k8s.io/client-go to 0.37):
github.com/kcp-dev/multicluster-provider v0.8.0, its latest release
(and its main branch), is built against controller-runtime 0.24, and
go build ./cmd/wild-west/... fails with
*ScopedCluster does not implement cluster.Cluster (wrong type for method GetEventRecorder). The last successful build of the images on
main was #698 (2026-08-31).

What changed

• sigs.k8s.io/controller-runtime, sigs.k8s.io/multicluster-runtime
  v0.25.2 → v0.24.1 (the versions multicluster-provider v0.8.0 requires)
• k8s.io/api, k8s.io/apimachinery, k8s.io/client-go v0.37.1 → v0.36.5,
  k8s.io/apiextensions-apiserver v0.37.0 → v0.36.5 (controller-runtime
  0.24 and kcp-dev/sdk v0.33.1 require 0.36)
• renovate.json: holds controller-runtime and multicluster-runtime
  below 0.25 and the k8s.io modules below 0.37, so Renovate does not
  re-introduce the break; remove the rules once multicluster-provider
  releases a version built against controller-runtime 0.25

Verification

go build of ./cmd/wild-west/..., ./cmd/init/... and
./cmd/armament-sync/... (also for linux/amd64 and linux/arm64, as in
the Dockerfiles) and go vet ./... pass; the module has no Go tests.
Only the six modules above change in the compiled build list, and
govulncheck reports no vulnerabilities outside the Go standard
library. renovate-config-validator accepts renovate.json.