Skip to content

chore(git): sync with main - #31681

Merged
ShaneK merged 11 commits into
nextfrom
sync-next-with-main
Nov 2, 2026
Merged

ShaneK merged 11 commits into
nextfrom
sync-next-with-main

Conversation

@ShaneK

@ShaneK ShaneK commented Nov 2, 2026

Copy link
Copy Markdown
Member

Sync next with main.

OS-jacobbell and others added 11 commits October 23, 2026 17:30
…31459)

Issue number: internal

---------

## What is the current behavior?

Some components check `document.dir === 'rtl'` to determine whether to
be left-to-right or right-to-left.

## What is the new behavior?

- Components consistently use `isRTL(this.el)`. This way, any element in
the parent chain can define RTL, not just the root document element.
- The host element is a required parameter to `isRTL`.

## Does this introduce a breaking change?

- [ ] Yes
- [X] No

---------

Co-authored-by: Shane <shane.king@outsystems.com>
Co-authored-by: ionitron <hi@ionicframework.com>
…nt (#31643)

Issue number: resolves #30811

---------

## What is the current behavior?

Currently, an `ion-alert` with checkbox inputs calls `preventDefault()`
on every Enter keydown on the page because the check lives in its
document-level keydown listener. This happens even while the alert is
closed, so textareas don't get new lines and buttons don't activate,
including the alert's own OK and Cancel buttons.

## What is the new behavior?

The Enter block now lives on the checkbox buttons, so Enter still can't
toggle a checkbox but works everywhere else.

## Does this introduce a breaking change?

- [ ] Yes
- [X] No

## Other information

Current dev build:
```
9.0.10-dev.11792788258.1f71cfee
```
Issue number: resolves #30848

---------

## What is the current behavior?

Currently, passing a route object to `router-link` renders `[object
Object]` as the `href`, so hovering, copying or ctrl/cmd-clicking the
link goes to the wrong place. A normal click still navigates correctly.

## What is the new behavior?

This bumps `@stencil/vue-output-target` to 0.14.7, which has the fix
from
[stenciljs/output-targets#866](stenciljs/output-targets#866).
Route objects now resolve through Vue Router to a real `href`, and
string links do too, so hash history and a router `base` are included.

## Does this introduce a breaking change?

- [ ] Yes
- [X] No

## Other information
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@capacitor/core](https://capacitorjs.com)
([source](https://redirect.github.com/ionic-team/capacitor)) | [`8.5.3`
→
`8.6.0`](https://renovatebot.com/diffs/npm/@capacitor%2fcore/8.5.3/8.6.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@capacitor%2fcore/8.6.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@capacitor%2fcore/8.5.3/8.6.0?slim=true)
|

---

### Release Notes

<details>
<summary>ionic-team/capacitor (@&#8203;capacitor/core)</summary>

###
[`v8.6.0`](https://redirect.github.com/ionic-team/capacitor/blob/HEAD/CHANGELOG.md#860-2026-10-28)

[Compare
Source](https://redirect.github.com/ionic-team/capacitor/compare/8.5.3...8.6.0)

##### Bug Fixes

- **android:** keep callbacks on non-public base classes from R8
([02e43f8](https://redirect.github.com/ionic-team/capacitor/commit/02e43f83f7e101f1773e9d33cd12e3c52e7d2c4b))
- **android:** keep plugin annotation types from R8 full mode
([#&#8203;8646](https://redirect.github.com/ionic-team/capacitor/issues/8646))
([9dc5aeb](https://redirect.github.com/ionic-team/capacitor/commit/9dc5aebd0335e0553827d81b4ce0f79e8a1c51aa))
- **cli:** bump xcode to ^4.0.0 to drop vulnerable uuid\@&#8203;7
([#&#8203;8674](https://redirect.github.com/ionic-team/capacitor/issues/8674))
([463225f](https://redirect.github.com/ionic-team/capacitor/commit/463225f31d9edade1098ccbadef766deb1aafbe8))
- **cli:** redact sensitive values from telemetry payloads
([#&#8203;8665](https://redirect.github.com/ionic-team/capacitor/issues/8665))
([d19f1ea](https://redirect.github.com/ionic-team/capacitor/commit/d19f1ea0bd7018a2eb13a643c76c6b4ba60795bb))
- **cli:** report npm 12 blocked install scripts in doctor and migrate
([#&#8203;8655](https://redirect.github.com/ionic-team/capacitor/issues/8655))
([841017a](https://redirect.github.com/ionic-team/capacitor/commit/841017a3c7ddb84c614be389e74a24ea0a629ff5))

##### Features

- **android:** recognize
[@&#8203;capacitor-community/ssl-pinning](https://redirect.github.com/capacitor-community/ssl-pinning)
for cert pinning
([#&#8203;8669](https://redirect.github.com/ionic-team/capacitor/issues/8669))
([19d2a40](https://redirect.github.com/ionic-team/capacitor/commit/19d2a40b920120ac97a118ec56105b202ee99d0a))
- **cli:** recognize
[@&#8203;capacitor-community/ssl-pinning](https://redirect.github.com/capacitor-community/ssl-pinning)
for auto cert copy
([#&#8203;8666](https://redirect.github.com/ionic-team/capacitor/issues/8666))
([50a3c51](https://redirect.github.com/ionic-team/capacitor/commit/50a3c511e1b02083b6961f8359b76cc2bab92d14))

##### Reverts

- Revert "chore(ios): add `App/CapApp-SPM/Package.resolved` to
`.gitignore`
([#&#8203;8649](https://redirect.github.com/ionic-team/capacitor/issues/8649))"
([175c933](https://redirect.github.com/ionic-team/capacitor/commit/175c93398b1bb4de34c55386e18aaee2e5551c83)),
closes
[#&#8203;8649](https://redirect.github.com/ionic-team/capacitor/issues/8649)

####
[8.5.3](https://redirect.github.com/ionic-team/capacitor/compare/8.5.2...8.5.3)
(2026-10-07)

##### Bug Fixes

- **cli:** change Cordova AppDelegate.h imports for SPM
([#&#8203;8618](https://redirect.github.com/ionic-team/capacitor/issues/8618))
([145560e](https://redirect.github.com/ionic-team/capacitor/commit/145560ee590d86637dc9dd2e2c9f4c08b0f631c0))

####
[8.5.2](https://redirect.github.com/ionic-team/capacitor/compare/8.5.1...8.5.2)
(2026-09-11)

##### Bug Fixes

- **android:** add null checks for plugin annotation when retrieving
permissions
([#&#8203;8400](https://redirect.github.com/ionic-team/capacitor/issues/8400))
([035b16a](https://redirect.github.com/ionic-team/capacitor/commit/035b16aca15eab136efc49eaec64b45987cfefeb))
- **ios:** do not forward scene lifecycle events to the page before it
has loaded
([#&#8203;8595](https://redirect.github.com/ionic-team/capacitor/issues/8595))
([c567328](https://redirect.github.com/ionic-team/capacitor/commit/c567328d0feb90c306ea824edc5a799bdfe26542))
- resolve issues with safe area / systembars plugin
([#&#8203;8535](https://redirect.github.com/ionic-team/capacitor/issues/8535))
([e37d9c6](https://redirect.github.com/ionic-team/capacitor/commit/e37d9c60785368acf2a83cfd4c20f47076672bdd))

####
[8.5.1](https://redirect.github.com/ionic-team/capacitor/compare/8.5.0...8.5.1)
(2026-08-31)

##### Bug Fixes

- block navigation to the internal HTTP proxy path
([ee586ae](https://redirect.github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922))
- **cli:** use POSIX paths in CapApp-SPM Package.swift
([#&#8203;8549](https://redirect.github.com/ionic-team/capacitor/issues/8549))
([5e5bb3b](https://redirect.github.com/ionic-team/capacitor/commit/5e5bb3befc312477900252ab07e23b596f8cb0d1))
- **core:** prevent removeListener from removing wrong listener
([#&#8203;8271](https://redirect.github.com/ionic-team/capacitor/issues/8271))
([5ac4dd6](https://redirect.github.com/ionic-team/capacitor/commit/5ac4dd613ae989d8dc8738ea25b77efbd4fa21fe))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "every weekday before 11am"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/ionic-team/ionic-framework).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODguMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE4OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Issue number: internal

---------

## What is the current behavior?

Some test apps are on a Playwright version that doesn't support Ubuntu
26.04, so their e2e jobs fail to install Chromium on the new
`ubuntu-latest` runners.

## What is the new behavior?

Bumps `@playwright/test` to `^1.64.1` across all framework test apps so
they're on the same version and install on Ubuntu 26.04.

## Does this introduce a breaking change?

- [ ] Yes
- [X] No

## Other information

On November 4th, `ubuntu-latest` will point at 26.04, so we need this
fixed ([it's already impacting us though
regardless](https://github.com/ionic-team/ionic-framework/actions/runs/41091745745/job/124188182479))
….3 (#31673)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@stencil/angular-output-target](https://stenciljs.com/)
([source](https://redirect.github.com/stenciljs/output-targets)) |
[`1.5.2` →
`1.5.3`](https://renovatebot.com/diffs/npm/@stencil%2fangular-output-target/1.5.2/1.5.3)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@stencil%2fangular-output-target/1.5.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@stencil%2fangular-output-target/1.5.2/1.5.3?slim=true)
|

---

### Release Notes

<details>
<summary>stenciljs/output-targets
(@&#8203;stencil/angular-output-target)</summary>

###
[`v1.5.3`](https://redirect.github.com/stenciljs/output-targets/compare/@stencil/angular-output-target@1.5.2...@stencil/angular-output-target@1.5.3)

[Compare
Source](https://redirect.github.com/stenciljs/output-targets/compare/@stencil/angular-output-target@1.5.2...@stencil/angular-output-target@1.5.3)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "every weekday before 11am"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/ionic-team/ionic-framework).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODguMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE4OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Issue number: resolves internal

---------

## What is the current behavior?

Dependabot and `npm audit` report high and critical alerts against the
lock files in `core` and `packages/*`. None of them reach users: lock
files are not published, and our declared ranges already resolve to the
patched versions on a fresh install. The alerts are noise that can bury
a real one.

## What is the new behavior?

- Updated the vulnerable packages, and the parents that pin them, within
the existing ranges.
- Added an override in `core` for `compression` under `serve`, since the
latest `serve` pins the vulnerable version. Remove it once a `serve`
release includes vercel/serve#868.
- `migrate` moves to `vite` 7.3.7 rather than the latest 8.x, which
would swap its test bundler for Rolldown.
- Angular dev dependencies move from 22.0 to 22.2. Angular 22.2 dropped
the private `contexts` field from the `ChildrenOutletContexts` typings,
so `ion-router-outlet` now casts to a local type when it saves and
restores tab state. The field still exists at runtime, so behavior is
unchanged.
- `@angular/cli` 22.2 no longer bundles its MCP server, which accounts
for most of the removals in the Angular lock file.

## Does this introduce a breaking change?

- [ ] Yes
- [x] No

## Other information

Test app and root lock files are updated in #31617. The `postcss` 7
alerts in `core` remain: they come from `stylelint` 13 and need a
`stylelint` upgrade, as noted in #31436.

---------

Co-authored-by: Brandy Smith <6577830+brandyscarney@users.noreply.github.com>
# Conflicts:
#	core/package-lock.json
#	core/src/components/col/col.tsx
#	core/src/components/datetime/datetime.tsx
#	core/src/components/datetime/test/basic/datetime.e2e.ts
#	core/src/components/item-options/item-options.tsx
@ShaneK
ShaneK requested a review from a team as a code owner November 2, 2026 14:38
@ShaneK
ShaneK requested a review from thetaPC November 2, 2026 14:38
@vercel

vercel Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
ionic-framework Ready Ready Preview Nov 2, 2026 2:44pm UTC

Request Review

@github-actions github-actions Bot added package: core @ionic/core package package: angular @ionic/angular package package: vue @ionic/vue package package: react @ionic/react package labels Nov 2, 2026
@ShaneK
ShaneK merged commit 2d4d18e into next Nov 2, 2026
54 checks passed
@ShaneK
ShaneK deleted the sync-next-with-main branch November 2, 2026 14:58

This branch was successfully deployed

1 active deployment
Preview — 3d435194 Deployed Nov 2, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

package: angular @ionic/angular package package: core @ionic/core package package: react @ionic/react package package: vue @ionic/vue package

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants