chore(dependencies): update Node.js version and Angular v22, TS 6

[nicobytes]

This pull request updates Node.js to version 22.22.3 across the project and refactors Angular ESLint configurations for better maintainability and clarity. It also relaxes Angular template strictness in several tsconfig files, simplifies test and story file exclusions, and makes a small adjustment to URL sanitization in the block editor utility.

Node.js version update:

• Updated .nvmrc, core-web/.nvmrc, and documentation references to require Node.js v22.22.3 instead of v22.15.0. (.nvmrc, core-web/.nvmrc, CLAUDE.md, ONBOARDING.md) [1] [2] [3]

ESLint configuration refactoring:

• Replaced use of FlatCompat for Angular template processing with direct rule configuration in all Angular ESLint configs, simplifying the setup and making rule overrides explicit. (core-web/apps/dotcdn/eslint.config.mjs, core-web/apps/dotcms-block-editor/eslint.config.mjs, core-web/apps/dotcms-ui/eslint.config.mjs, core-web/libs/block-editor/eslint.config.mjs, core-web/libs/data-access/eslint.config.mjs, core-web/libs/dot-layout-grid/eslint.config.mjs, core-web/libs/dot-rules/eslint.config.mjs, core-web/libs/dotcms-js/eslint.config.mjs) [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]

• Disabled @angular-eslint/prefer-on-push-component-change-detection in several configs for migration compatibility. [1] [2] [3] [4]

TypeScript and Angular compiler options:

• Set "strictTemplates": false in angularCompilerOptions for multiple tsconfig.app.json files to relax Angular template strictness for migration. (core-web/apps/dotcdn/tsconfig.app.json, core-web/apps/dotcms-binary-field-builder/tsconfig.app.json, core-web/apps/dotcms-block-editor/tsconfig.app.json, core-web/apps/dotcms-ui/tsconfig.app.json) [1] [2] [3]

• Cleaned up exclude arrays in tsconfig files and removed story file exclusions from test coverage collection. (core-web/libs/block-editor/tsconfig.lib.json, core-web/jest.preset.js) [1] [2]

Block editor utility adjustment:

• Removed direct use of Angular's internal DomSanitizer for icon data URLs and now casts trusted URLs directly to SafeUrl for simplicity and compatibility. (core-web/libs/block-editor/src/lib/shared/utils/suggestion.utils.ts) [1] [2] [3]

This PR fixes: #35930

[claude]

Claude finished @nicobytes's task in 3m 45s —— View job

---

Claude Code Review

Reviewed the diff against origin/main. This is an Angular 22 / TypeScript 6 / Node 22.22.3 migration PR. Scope is mostly config + lint + dependency bumps; the functional code changes are small. Rechecked all prior Copilot findings.

New Issues

• 🟡 Medium: core-web/tsconfig.base.json:16 — "strict": false is now set at the workspace base level. Combined with strictTemplates: false in the four tsconfig.app.json files, this materially weakens type/template safety across the entire monorepo, not just migrating libs. These are described as temporary migration flags but there's no tracking issue or removal plan referenced. Recommend filing a follow-up ticket and linking it in a comment near these flags so they don't become permanent tech debt. Fix this →

• 🟡 Medium: core-web/package.json:54 — @angular/cdk is pinned to 22.0.5 while all other @angular/* framework packages are 22.0.7. Angular strongly recommends keeping CDK in lockstep with the framework version to avoid peer-dependency drift. Bump to 22.0.7 unless there's a known incompatibility. Fix this →

• 🟡 Medium: core-web/libs/block-editor/src/lib/shared/components/suggestion-list/components/suggestions-list-item/suggestions-list-item.component.ts:51 — safeUrl calls bypassSecurityTrustUrl for any string starting with data:. Since [url] is a public @Input() bound into <img [src]="safeUrl">, this bypasses Angular sanitization for arbitrary data: payloads. Today the only callers pass controlled internal SVG constants (suggestion-icons.ts), so exploitability is low, but the getter is broader than it needs to be. Consider restricting the check to data:image/ prefixes. Assumption: no external/user-controlled value ever reaches this input — worth confirming. Fix this →

Resolved

• ✅ core-web/libs/block-editor/src/lib/shared/utils/suggestion.utils.ts — the prior approach (sanitizeUrl returning a bare cast / ɵDomSanitizerImpl outside DI) is gone. Icon URLs are now plain strings and sanitization was correctly moved into the component's safeUrl getter using an injected DomSanitizer#bypassSecurityTrustUrl. Copilot's original correctness concern is fixed.
• ✅ All 15 refactored eslint.config.mjs files — the unused FlatCompat/compat imports flagged by Copilot have been removed; no dead code remains in the changed configs.
• ✅ dot-history-timeline-list.component.ts:18 — getTimelineItemKey now derives the key from inode → bundleId → id (with a documented comment), fixing the earlier '[object Object]' collapse for DotCMSContentletVersion / push-publish items.
• ✅ core-web/pnpm-lock.yaml — lockfile is included in this PR (+3589/-3455), addressing the reproducible-install concern.
• ✅ dotFrontendOnboarding.md — Angular (22.0.7), Nx (23.1.0), and NgRx version bullets are now aligned with the workspace upgrade.

Notes (non-blocking)

• The four tsconfig.app.json files and tsconfig.base.json strict: false are the biggest risk surface here — they silently reduce compile-time safety repo-wide. Confirm this is intentional and temporary.
• jest.preset.js now collects coverage from *.stories.ts files (the !src/**/*.stories.ts exclusion was removed). This will inflate coverage denominators with Storybook files that typically have no test intent — minor, but likely unintended.

Overall the functional changes are safe and the prior review findings are addressed. No blocking issues.

[Copilot]

Pull request overview

This pull request upgrades the core-web workspace to Angular 22 / TypeScript 6, bumps the required Node.js version to v22.22.3, and refactors multiple ESLint flat-config files to simplify Angular lint rule overrides during migration.

Changes:

• Updated Node.js version requirements and docs (.nvmrc, core-web/.nvmrc, onboarding docs).
• Upgraded Angular/Nx/TypeScript dependencies and introduced TypeScript 6 migration flags (ignoreDeprecations: "6.0", relaxed strictTemplates).
• Refactored Angular ESLint flat configs (removing FlatCompat template processing blocks) and adjusted a block-editor URL “sanitization” helper.

Reviewed changes

Copilot reviewed 41 out of 42 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
ONBOARDING.md	Updates Node version requirement text.
dotFrontendOnboarding.md	Updates Node version requirement text (but leaves other stack versions stale).
docs/frontend/ANGULAR_STANDARDS.md	Updates frontend standards doc to Angular 22 / TS 6 / Nx 23 era.
core-web/tsconfig.base.json	Adds TS6 migration flags (ignoreDeprecations) and explicit strict: false.
core-web/package.json	Upgrades Angular/Nx/TypeScript and adds pnpm peer dependency rules.
core-web/libs/utils/eslint.config.mjs	Refactors Angular ESLint flat config away from compat inline-template processing block.
core-web/libs/utils-testing/eslint.config.mjs	Same ESLint refactor + disables OnPush preference rule for migration.
core-web/libs/ui/src/lib/components/dot-severity-icon/dot-severity-icon.component.spec.ts	Updates tests to assert PrimeIcons classes instead of icon components.
core-web/libs/ui/src/lib/components/dot-severity-icon/dot-severity-icon.component.html	Switches icon rendering to PrimeIcons <i class="pi ...">.
core-web/libs/ui/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/libs/template-builder/tsconfig.lib.json	Simplifies exclude list.
core-web/libs/template-builder/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/libs/portlets/edit-ema/ui/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/libs/portlets/edit-ema/portlet/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/libs/portlets/dot-experiments/portlet/eslint.config.mjs	Refactors Angular ESLint flat config away from compat inline-template processing block.
core-web/libs/portlets/dot-experiments/data-access/eslint.config.mjs	Refactors Angular ESLint flat config away from compat inline-template processing block.
core-web/libs/new-block-editor/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/libs/edit-content/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/libs/edit-content-bridge/tsconfig.lib.json	Simplifies exclude list.
core-web/libs/dotcms-js/eslint.config.mjs	Refactors Angular ESLint flat config away from compat inline-template processing block.
core-web/libs/dot-rules/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/libs/dot-layout-grid/eslint.config.mjs	Refactors Angular ESLint flat config away from compat inline-template processing block.
core-web/libs/data-access/eslint.config.mjs	Refactors Angular ESLint flat config away from compat inline-template processing block.
core-web/libs/block-editor/tsconfig.lib.json	Simplifies exclude list.
core-web/libs/block-editor/src/lib/shared/utils/suggestion.utils.ts	Changes URL “sanitization” implementation for suggestion icon data URLs.
core-web/libs/block-editor/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/jest.preset.js	Removes story exclusion from coverage collection.
core-web/apps/dotcms-ui/tsconfig.app.json	Disables Angular strictTemplates for migration.
core-web/apps/dotcms-ui/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/apps/dotcms-block-editor/tsconfig.app.json	Disables Angular strictTemplates for migration.
core-web/apps/dotcms-block-editor/eslint.config.mjs	Refactors Angular ESLint flat config away from compat inline-template processing block.
core-web/apps/dotcms-binary-field-builder/tsconfig.app.json	Disables Angular strictTemplates for migration.
core-web/apps/dotcms-binary-field-builder/eslint.config.mjs	Refactors Angular ESLint flat config + disables OnPush preference rule for migration.
core-web/apps/dotcdn/tsconfig.app.json	Disables Angular strictTemplates for migration.
core-web/apps/dotcdn/eslint.config.mjs	Refactors Angular ESLint flat config away from compat inline-template processing block.
core-web/.nvmrc	Pins Node to v22.22.3.
CLAUDE.md	Updates Node version requirement text.
.nvmrc	Pins Node to v22.22.3.

[Copilot]

Pull request overview

Copilot reviewed 53 out of 54 changed files in this pull request and generated 19 comments.

[alwaysmeticulous]

Meticulous was unable to execute a test run for this PR because the most recent commit is associated with multiple PRs. To execute a test run, please try pushing up a new commit that is only associated with this PR.

_{Last updated for commit 721eaa7. This comment will update as new commits are pushed.}