25-Oct-2026 — apply the vulnerability sweep on client and server #434

build 1019 — commit 5f6df4b

Client and server packages are updated together so both sides stay on the same patched versions of shared libraries such as CSV parsing, dates and Mongo.
Angular stays on the 21.2 line, with the CLI and build tools on the latest 21.2 patch that clears the current high-severity advisories.
Mail sending, ZIP handling and image conversion on the server move to patched releases. Word document image conversion still works with the stricter image library.
Dependabot PRs are not used for this pass. Fixes are applied in the lockfiles here. Remaining KaTeX warnings in markdown diagrams need a later Angular 22 upgrade.