chore: resolve open dependabot security alerts

[jonathannorris]

Summary

Resolved 10 open Dependabot security alerts in test/angular-integration by upgrading vulnerable dependencies.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#62	postcss	high	Bumped override to ^8.5.18 (fixes path traversal in sourceMappingURL auto-loading)
#60	fast-uri	high	Pinned override to exact 3.1.4 (fixes host confusion via literal backslash authority delimiter)
#59	fast-uri	high	Pinned override to exact 3.1.4 (fixes host confusion via failed IDN canonicalization)
#57	vite	high	Bumped to ^6.4.3 in devDependencies and overrides
#58	vite	medium	Bumped to ^6.4.3 in devDependencies and overrides
#56	@babel/core	low	Added @babel/core: ^7.29.6 override (transitive via @angular/compiler-cli)
#54	@angular/core	high	Upgraded Angular from 19.x to 20.3.25 (no patch exists for 19.x line)
#55	@angular/common	high	Upgraded Angular from 19.x to 20.3.25 (no patch exists for 19.x line)
#53	@angular/common	high	Upgraded Angular from 19.x to 20.3.25 (no patch exists for 19.x line)
#52	@angular/compiler	medium	Upgraded Angular from 19.x to 20.3.25 (no patch exists for 19.x line)

The Angular 19.x vulnerabilities have no patch in the 19.x line; the advisories are fixed in Angular 20.3.25+. The integration test suite has been upgraded to Angular 20 accordingly, along with compatible versions of @openfeature/angular-sdk (1.3.1), @angular/compiler-cli, @analogjs/vitest-angular, and TypeScript (~5.8.0, required by Angular 20). fast-uri (transitive via ajv/@angular-devkit) is pinned via override to exact 3.1.4 per CodeRabbit review suggestion. postcss (transitive via Vite/Angular build tooling) is pinned via override to ^8.5.18.

All 58 integration tests pass after the upgrades.

[coderabbitai]

📝 Walkthrough

Walkthrough

The generated Go client is refreshed with renamed enum identifiers, removed bearer-auth declarations, manifest capability response headers, and parsing changes. Angular integration dependencies, development tooling, and package overrides are also upgraded.

Changes

Generated API client

Layer / File(s)	Summary
Client contracts and generated declarations internal/api/client/sync_client.gen.go	The generated client updates generator metadata, removes bearer-auth declarations, renames manifest value-type constants, and refreshes generated model, interface, request, and method comments.
Response wrappers and capability headers internal/api/client/sync_client.gen.go	Successful manifest response wrappers expose X-Manifest-Capabilities, and parsers bind the header for the relevant 200 and 201 responses.

Angular integration tooling

Layer / File(s)	Summary
Angular integration dependency updates test/angular-integration/package.json	Angular, OpenFeature SDK, TypeScript, Vite, test tooling, and selected dependency overrides are upgraded.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant HTTPResponse
  participant ResponseParser
  participant RuntimeBinder
  participant ResponseWrapper
  HTTPResponse->>ResponseParser: return successful manifest response and capability header
  ResponseParser->>RuntimeBinder: bind X-Manifest-Capabilities
  RuntimeBinder->>ResponseWrapper: populate status-specific headers

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies dependency updates that resolve open Dependabot security alerts.
Description check	✅ Passed	The description explains the dependency upgrades and security alerts addressed by the pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates the Angular integration test project dependencies to address outstanding Dependabot security alerts by upgrading Angular/Vite and related tooling, plus adding targeted npm overrides.

Changes:

• Upgraded Angular dependencies from 19.2.25 to 20.3.25 and aligned Angular-related dev tooling (@angular/compiler-cli, typescript).
• Bumped Vite from 6.4.2 to 6.4.3 (including an override) and refreshed the lockfile accordingly.
• Added an override for @babel/core to address a transitive vulnerability.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.

File	Description
test/angular-integration/package.json	Updates Angular/Vite/TypeScript versions and adds @babel/core override to resolve security alerts.
test/angular-integration/package-lock.json	Regenerates the lockfile to reflect the dependency upgrades and new overrides.

Files not reviewed (1)

• test/angular-integration/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

internal/api/client/sync_client.gen.go (1)

797-905: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add regression tests for X-Manifest-Capabilities parsing.

Cover each success status with the header present and absent, and verify that non-success responses do not populate the success-header wrapper. This protects the new public response contract from generator or parser regressions.

Also applies to: 932-988, 1015-1064, 1091-1154, 1322-1339, 1398-1413, 1464-1480, 1544-1562

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/api/client/sync_client.gen.go` around lines 797 - 905, Add
regression tests for the response parsing paths associated with
GetOpenfeatureV0ManifestResponse and the other affected response types, covering
every success status with X-Manifest-Capabilities present and absent. Assert the
header value is populated only when present, and verify non-success responses
leave the success-header wrapper unset. Reuse the existing generated-client test
patterns to cover all listed affected endpoints.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/angular-integration/package.json`:
- Line 36: Update the fast-uri dependency entry in the test Angular integration
package manifest from the caret range to the exact version 3.1.4. If this
project tracks dependency resolution in a lockfile, regenerate or update it so
the locked fast-uri version remains exactly 3.1.4.

---

Nitpick comments:
In `@internal/api/client/sync_client.gen.go`:
- Around line 797-905: Add regression tests for the response parsing paths
associated with GetOpenfeatureV0ManifestResponse and the other affected response
types, covering every success status with X-Manifest-Capabilities present and
absent. Assert the header value is populated only when present, and verify
non-success responses leave the success-header wrapper unset. Reuse the existing
generated-client test patterns to cover all listed affected endpoints.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a5a9502-deff-459c-b1ef-5c81ee8e998e

📥 Commits

Reviewing files that changed from the base of the PR and between 784196c and 54c1c6f.

⛔ Files ignored due to path filters (1)

• test/angular-integration/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• internal/api/client/sync_client.gen.go
• test/angular-integration/package.json