⭐ CI and Security

CodeQL: 10 real findings fixed (6x ReDoS via unanchored regex across two files, 4x prototype pollution across four modules' duplicated schematics-core copies) in carried-over Angular CLI source — found by CodeQL, not introduced by this repo, but fixed here regardless, each through a real branch + PR. The first batch (5x ReDoS + 1x prototype pollution) landed via PR #21; the prototype-pollution finding then recurred three more times as effects/entity/operators were added, each carrying the same still-vulnerable duplicated copy — fixed in all four at once rather than folded silently into the original count. The duplication itself was later eliminated — see Schematics Core.

Dependabot: 12 open alerts triaged — 10 fixed across 8 PRs grouped by vulnerable package (qs, braces, brace-expansion, @hono/node-server, esbuild, uuid, dot-prop, nanoid) using scoped yarn resolutions, so a fix to one transitive dependency's vulnerable copy never force-crossed an unrelated consumer to a major version it wasn't designed against. 2 dismissed with a documented reason (image-size, no upstream fix published). The nanoid fix (PR #139) landed separately for a high-severity CVE (CVE-2026-67213) that surfaced after the first batch was already closed out — same scoped-resolution technique, forcing the 3.x line to 3.3.18 rather than jumping to 5.x for a package only reachable through ng-packagr's postcss dependency.

Nx task graph: 2 intermittent CI race conditions traced to undeclared Nx dependsOn edges, not flaky infrastructure — fixed by declaring real task dependencies, verified by deliberately stress-testing with a clean cache and --parallel=4, not just "it passed once." Both the Quality and CodeQL workflows run green on every push.