chore(deps): bump the npm_and_yarn group across 13 directories with 17 updates

[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Bumped dependencies across tools, JS workspace, and sample apps to current versions, including @modelcontextprotocol/sdk and Angular. This pulls in security fixes and updates build tooling for better compatibility.

• Dependencies

  • Tools: @modelcontextprotocol/sdk → 1.26.0, axios → 1.13.5, @trpc/server → 10.45.3, glob → 12, js-yaml → 4.1.1.
  • JS test apps: @modelcontextprotocol/sdk → 1.26.0.
  • Sample servers: express → 4.22.1, esbuild → 0.27.x, tsx → 4.21.0, genkit-cli → 1.31.0.
  • Angular samples: upgrades to Angular 19.2.x and 21.2.x where applicable; CLI/build tooling aligned.
  • Security patches: brace-expansion 1.1.13/2.0.3, qs 6.14.2, node-forge 1.4.0.
  • Lockfiles updated across all affected projects.

• Migration

  • Use Node 18+ for updated build tools.
  • Run a clean install in each workspace and rebuild (e.g., pnpm install/npm install).
  • If using a global Angular CLI, update to v21 to match upgraded projects.

^{Written for commit ab17224. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 24 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/js-angular/genkit-app/package.json">

<violation number="1" location="samples/js-angular/genkit-app/package.json:29">
P1: `@angular-devkit/build-angular` was bumped to v21, but this project is still on Angular 19 and TypeScript 5.8. That introduces peer dependency conflicts and can break install/build.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: @angular-devkit/build-angular was bumped to v21, but this project is still on Angular 19 and TypeScript 5.8. That introduces peer dependency conflicts and can break install/build.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/js-angular/genkit-app/package.json, line 29:

<comment>`@angular-devkit/build-angular` was bumped to v21, but this project is still on Angular 19 and TypeScript 5.8. That introduces peer dependency conflicts and can break install/build.</comment>

<file context>
@@ -26,8 +26,8 @@
   "devDependencies": {
-    "@angular-devkit/build-angular": "^19.2.1",
-    "@angular/cli": "^19.2.1",
+    "@angular-devkit/build-angular": "^21.2.6",
+    "@angular/cli": "^21.2.6",
     "@angular/compiler-cli": "^19.2.0",
</file context>

Suggested change

	"@angular-devkit/build-angular": "^21.2.6",
	"@angular/cli": "^21.2.6",
	"@angular-devkit/build-angular": "^19.2.1",
	"@angular/cli": "^19.2.1",