[thetaPC]

Issue number: resolves internal

---

What is the current behavior?

Dependabot and npm audit report high and critical alerts against the lock files in core and packages/*. None of them reach users: lock files are not published, and our declared ranges already resolve to the patched versions on a fresh install. The alerts are noise that can bury a real one.

What is the new behavior?

• Updated the vulnerable packages, and the parents that pin them, within the existing ranges.
• Added an override in core for compression under serve, since the latest serve pins the vulnerable version. Remove it once a serve release includes fix(compression): bump compression to 1.8.2 vercel/serve#868.
• migrate moves to vite 7.3.7 rather than the latest 8.x, which would swap its test bundler for Rolldown.
• Angular dev dependencies move from 22.0 to 22.2. Angular 22.2 dropped the private contexts field from the ChildrenOutletContexts typings, so ion-router-outlet now casts to a local type when it saves and restores tab state. The field still exists at runtime, so behavior is unchanged.
• @angular/cli 22.2 no longer bundles its MCP server, which accounts for most of the removals in the Angular lock file.

Does this introduce a breaking change?

• Yes
• No

Other information

Test app and root lock files are updated in #31617. The postcss 7 alerts in core remain: they come from stylelint 13 and need a stylelint upgrade, as noted in #31436.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ionic-framework	Ready	Preview	Oct 30, 2026 6:52pm UTC

[brandyscarney]

Approved with comments!

[brandyscarney]

Could the comment say this field isn't in Angular’s public typings, so it gets checked on upgrades? Something like:

Suggested change

	/**
	* `ChildrenOutletContexts` keeps each outlet's context in a private `contexts`
	* map. Saving and restoring it preserves tab state.
	*/
	/**
	* `ChildrenOutletContexts` keeps each outlet's context in a private `contexts`
	* map that is not part of Angular's public typings. Saving and restoring it
	* preserves tab state, so confirm the field still exists when upgrading Angular.
	*/

[thetaPC]

Done in 3f9d356.

[brandyscarney]

npm audit --package-lock-only still shows high alerts for picomatch 2.3.1 (core, react, vue), semver 6.3.0/7.3.7/5.7.1 (core), micromatch (core, react) and vite 7.3.6 (migrate). These look fixable within the current ranges, and the angular lock file already has picomatch 2.3.2. Could you refresh these, or call them out under Other information if they're being left on purpose?

[thetaPC]

Refreshed in de930f4. The update was based on open Dependabot alerts, and Dependabot had auto-dismissed the picomatch and semver ones as dev-scoped, so they never showed up. The vite advisory in migrate was published the day the update ran. vite is pinned to 7.3.7 since a plain npm update jumps to vite 8. npm audit --package-lock-only now only reports the postcss 7 from stylelint 13, which is already called out under Other information.