Repository navigation
chore(deps): update test app lock files to resolve security alerts - #31617
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
package: angular
opensource-fork-sync Bot
pushed a commit
to cla7aye15I4nd/opensource-ionic-team__ionic-framework
that referenced
this pull request
Oct 31, 2026
…#31616) Issue number: resolves internal --------- ## What is the current behavior? Dependabot and `npm audit` report high and critical alerts against the lock files in `core` and `packages/*`. None of them reach users: lock files are not published, and our declared ranges already resolve to the patched versions on a fresh install. The alerts are noise that can bury a real one. ## What is the new behavior? - Updated the vulnerable packages, and the parents that pin them, within the existing ranges. - Added an override in `core` for `compression` under `serve`, since the latest `serve` pins the vulnerable version. Remove it once a `serve` release includes vercel/serve#868. - `migrate` moves to `vite` 7.3.7 rather than the latest 8.x, which would swap its test bundler for Rolldown. - Angular dev dependencies move from 22.0 to 22.2. Angular 22.2 dropped the private `contexts` field from the `ChildrenOutletContexts` typings, so `ion-router-outlet` now casts to a local type when it saves and restores tab state. The field still exists at runtime, so behavior is unchanged. - `@angular/cli` 22.2 no longer bundles its MCP server, which accounts for most of the removals in the Angular lock file. ## Does this introduce a breaking change? - [ ] Yes - [x] No ## Other information Test app and root lock files are updated in ionic-team#31617. The `postcss` 7 alerts in `core` remain: they come from `stylelint` 13 and need a `stylelint` upgrade, as noted in ionic-team#31436. --------- Co-authored-by: Brandy Smith <6577830+brandyscarney@users.noreply.github.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue number: internal
What is the current behavior?
Dependabot and
npm auditreport most of the repo's alerts against the test app and root lock files. None of them reach users, but they bury real alerts.What is the new behavior?
@angular/animationsand@angular/platform-browser-dynamicheld Angular at an early 20.x. Removed@angular/animations, which nothing imports, and raised@angular/platform-browser-dynamicto^20.1.0. The app now resolves to the latest Angular 20.@angular/buildand@angular/cli22.2.5, which pin a patchedvite. code-split's exact pins move from 22.0.1. Angular 22.2 renamed the--stats-jsonoutput tobrowser-stats.json, so the test script reads the new file.@angular/formstypes withimport type. On Angular 22.2, the webpack dev server rejects value imports of type-only names, which broke the ng22 apps.wait-onto v9, which drops its oldaxios, and added the samecompressionoverride as core forserve.Does this introduce a breaking change?
Other information
Remaining alerts need a tooling upgrade or have no patch: ng18 and ng19 (Angular versions out of support),
lerna5 in the root,cypress13, the olderviteandvitestin the React apps, andtypescript-eslintin ng20.