fix(deps): update angular to v21.2.10

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | devDependencies | patch | [`8.0.10` -> `8.0.11`](https://renovatebot.com/diffs/npm/vite/8.0.10/8.0.11) |

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v8.0.11`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-8011-2026-05-07-small)

[Compare Source](https://github.com/vitejs/vite/compare/v8.0.10...v8.0.11)

##### Features

- update rolldown to 1.0.0-rc.18 ([#&#8203;22360](https://github.com/vitejs/vite/issues/22360)) ([3f80524](https://github.com/vitejs/vite/commit/3f80524aa1fa40bfa831f1a1bf2641c3979ba396))

##### Bug Fixes

- **deps:** update all non-major dependencies ([#&#8203;22334](https://github.com/vitejs/vite/issues/22334)) ([672c962](https://github.com/vitejs/vite/commit/672c96288fd5440bbecddc65551e713edeb8d403))
- **deps:** update all non-major dependencies ([#&#8203;22382](https://github.com/vitejs/vite/issues/22382)) ([5c0cfcb](https://github.com/vitejs/vite/commit/5c0cfcb83dde2c6e25b6c3215dd622956bf29631))
- **glob:** align hmr matcher options with glob enumeration ([#&#8203;22306](https://github.com/vitejs/vite/issues/22306)) ([30028f9](https://github.com/vitejs/vite/commit/30028f94516fa06dd0212567373169b3b3f6e393))
- make separate object instance for each environment ([#&#8203;22276](https://github.com/vitejs/vite/issues/22276)) ([7c2aa3b](https://github.com/vitejs/vite/commit/7c2aa3b40ba00ce1299e4f31932c7929f179a80a))

##### Documentation

- **create-vite:** list react-compiler templates in README ([#&#8203;22347](https://github.com/vitejs/vite/issues/22347)) ([7c3a61f](https://github.com/vitejs/vite/commit/7c3a61f42da6445904e93f0e29e9a2a838fa684a))
- explain mergeConfig skips null/undefined ([#&#8203;22325](https://github.com/vitejs/vite/issues/22325)) ([2151f70](https://github.com/vitejs/vite/commit/2151f701dc98270c905c540b209fb6d23d53d3ad))
- mention native config loader in CLI options ([#&#8203;22348](https://github.com/vitejs/vite/issues/22348)) ([0420c5d](https://github.com/vitejs/vite/commit/0420c5d37b6049476b6e6c16662be372575dd683))
- update evan's x handle ([640202a](https://github.com/vitejs/vite/commit/640202a2167b0c19b94e4d3b8ff87309ae1f44d0))

##### Miscellaneous Chores

- **deps:** update dependency tsdown to ^0.21.10 ([#&#8203;22333](https://github.com/vitejs/vite/issues/22333)) ([3b51e05](https://github.com/vitejs/vite/commit/3b51e050214c5a817c163838ab8643fe34c7d0c3))
- **deps:** update rolldown-related dependencies ([#&#8203;22383](https://github.com/vitejs/vite/issues/22383)) ([555ff36](https://github.com/vitejs/vite/commit/555ff36de70a43b3b3dc22f958bf78fe75e11d67))
- **deps:** update transitive packages to fix npm audit alerts ([#&#8203;22316](https://github.com/vitejs/vite/issues/22316)) ([86aee62](https://github.com/vitejs/vite/commit/86aee6268aa879d74f68a890392c1dee973ebf05))

##### Code Refactoring

- devtools integration ([#&#8203;22312](https://github.com/vitejs/vite/issues/22312)) ([3c8bf06](https://github.com/vitejs/vite/commit/3c8bf064ec76e311f2d8be3a37dcfdcdd4e4253c))
- remove unnecessary async ([#&#8203;22296](https://github.com/vitejs/vite/issues/22296)) ([b31fd35](https://github.com/vitejs/vite/commit/b31fd355d93eb166573362bd09c07745b9f76755))
- show direct path type in bad character warning ([#&#8203;22339](https://github.com/vitejs/vite/issues/22339)) ([0c162e9](https://github.com/vitejs/vite/commit/0c162e96a6545c93808e7338b9adeca2636596fa))

##### Tests

- **create-vite:** use short help alias ([#&#8203;22389](https://github.com/vitejs/vite/issues/22389)) ([994ab66](https://github.com/vitejs/vite/commit/994ab66bc4dc872278d8353d710ffc4bbd881f8d))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

Reviewed-on: https://git.unespace.com/julien/apf_portal/pulls/46
Co-authored-by: APF Portal Bot <jgautier.webdev+apf-portal-bot@gmail.com>
Co-committed-by: APF Portal Bot <jgautier.webdev+apf-portal-bot@gmail.com>

.gitea/workflows/ci.yml

@@ -55,14 +55,22 @@ jobs:
 
   scan:
     runs-on: [self-hosted, on-prem]
+    # Step ordering matters here: Trivy and gitleaks BOTH run before
+    # `pnpm install`. Reason: gitleaks scans the working tree
+    # (`--no-git --source .`), and after install, `node_modules/`
+    # and `.pnpm-store/` are full of upstream packages whose READMEs
+    # and test fixtures contain demo RSA keys / fake API tokens —
+    # gitleaks then false-positives on them by the hundreds (caught
+    # the hard way: 381 hits on the first run). Trivy reads
+    # `pnpm-lock.yaml` for its vuln scan, not `node_modules`, so it
+    # also doesn't need install. `pnpm ci:audit` does the same — it
+    # queries the advisory DB against the lockfile.
     steps:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm ci:audit
       # Dependency vulnerability scan. Trivy is a Go binary, not an npm
       # package, so it cannot live in package.json scripts as cleanly
       # as audit/lint do.
@@ -101,17 +109,60 @@ jobs:
           tar -xzf /tmp/trivy.tar.gz -C /usr/local/bin trivy
           trivy --version
       - name: Run Trivy
+        # `--scanners vuln`: limit Trivy to vulnerability scanning. Its
+        # secret scanner false-positives on demo RSA keys embedded in
+        # the README/fixtures of cryptographic npm packages (which
+        # land under .pnpm-store/), and we already have gitleaks below
+        # as the dedicated secret-scan gate. Trivy's intent in this
+        # job, per ADR-0015, was always "dependency vulnerability
+        # scan" — restoring that scope.
         run: |
           trivy fs \
+            --scanners vuln \
             --ignore-unfixed \
             --skip-dirs node_modules \
             --exit-code 1 \
             --severity CRITICAL,HIGH \
             .
-      # Secret scan, same reasoning (gitleaks is a Go binary).
+      # Secret scan. Same install pattern as Trivy: gitleaks is a Go
-      - uses: gitleaks/gitleaks-action@v2
+      # binary, and the official `gitleaks/gitleaks-action@v2` wrapper
+      # is now paywalled for organisations (a GITLEAKS_LICENSE secret
+      # from gitleaks.io is required, otherwise the action errors out
+      # with `🛑 missing gitleaks license`). The binary itself stays
+      # MIT-licensed and free — installing it directly bypasses the
+      # wrapper and gives us version pinning for free.
+      - name: Install gitleaks
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Bump deliberately. Same caveat as TRIVY_VERSION above —
+          # not Renovate-tracked out of the box. Releases:
+          # https://github.com/gitleaks/gitleaks/releases.
+          GITLEAKS_VERSION: '8.21.0'
+          GITHUB_TOKEN: ${{ secrets.GITHUBCOM_TOKEN }}
+        run: |
+          curl -sfL \
+            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+            -o /tmp/gitleaks.tar.gz \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          tar -xzf /tmp/gitleaks.tar.gz -C /usr/local/bin gitleaks
+          gitleaks version
+      - name: Run gitleaks
+        # `--no-git --source .` scans the working tree only. The scan
+        # job uses a shallow checkout, so a git-history scan would not
+        # see beyond HEAD anyway; the weekly security-scheduled
+        # workflow does the deep history scan with a full clone.
+        # `--redact` masks any matched secret in the log output so we
+        # do not leak it via the CI logs themselves.
+        run: |
+          gitleaks detect \
+            --no-git \
+            --source . \
+            --redact \
+            --exit-code 1
+      # npm-advisory check (against pnpm-lock.yaml). Run last so
+      # `pnpm install` does not pollute the working tree before the
+      # scanners above.
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm ci:audit
 
   commits:
     # PRs opened by Renovate (apf-portal-bot) carry commit messages

.gitea/workflows/security-scheduled.yml

@@ -14,25 +14,71 @@ on:
 jobs:
   full-tree-scan:
     runs-on: [self-hosted, on-prem]
+    # Step ordering mirrors ci.yml: scanners run before `pnpm install`
+    # so the working tree is not polluted with node_modules content
+    # (READMEs / fixtures of upstream packages contain demo
+    # secrets that gitleaks false-positives on by the hundreds).
+    # The deep-history gitleaks scan here doesn't strictly need it
+    # (history doesn't contain node_modules), but consistency with
+    # ci.yml keeps the two workflows reading the same way.
     steps:
+      # fetch-depth: 0 → full history. The per-PR gitleaks scan is
+      # shallow + working-tree-only; this scheduled job is where we
+      # do the deep history scan that catches secrets ever committed
+      # (and not just what's currently checked in).
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-          cache: 'pnpm'
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm audit
       # Full-tree Trivy (no skip-dirs, no severity filter — the per-PR
       # gate filters by severity for speed; this run wants the full
-      # surface for the security feed).
+      # surface for the security feed). Manual install + curl, same
-      - uses: aquasecurity/trivy-action@master
+      # pattern as ci.yml — see the rationale there.
-        with:
+      - name: Install Trivy
-          scan-type: fs
-          ignore-unfixed: true
-      - uses: gitleaks/gitleaks-action@v2
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TRIVY_VERSION: '0.70.0'
+          GITHUB_TOKEN: ${{ secrets.GITHUBCOM_TOKEN }}
+        run: |
+          curl -sfL \
+            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+            -o /tmp/trivy.tar.gz \
+            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          tar -xzf /tmp/trivy.tar.gz -C /usr/local/bin trivy
+          trivy --version
+      - name: Run Trivy
+        run: |
+          trivy fs \
+            --scanners vuln \
+            --ignore-unfixed \
+            .
+      # Deep gitleaks scan (full git history). Same install pattern as
+      # ci.yml. `--redact` masks any matched secret in the log so we
+      # don't leak it via CI logs themselves.
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: '8.21.0'
+          GITHUB_TOKEN: ${{ secrets.GITHUBCOM_TOKEN }}
+        run: |
+          curl -sfL \
+            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+            -o /tmp/gitleaks.tar.gz \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          tar -xzf /tmp/gitleaks.tar.gz -C /usr/local/bin gitleaks
+          gitleaks version
+      - name: Run gitleaks (full history)
+        run: |
+          gitleaks detect \
+            --source . \
+            --redact \
+            --exit-code 1
+      # npm-advisory check (against pnpm-lock.yaml). Run last so
+      # `pnpm install` does not pollute the working tree before the
+      # scanners above.
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm audit
 
   lighthouse-prod:
     # Skipped silently if the prod URL hasn't been configured yet.
@@ -44,7 +90,6 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-          cache: 'pnpm'
       - run: pnpm install --frozen-lockfile
       - run: pnpm exec lhci collect --url=${{ vars.LHCI_PROD_URL }} --numberOfRuns=3
       - run: pnpm exec lhci assert --config=./lighthouserc.js