[thetaPC]

Issue number: internal

---

What is the current behavior?

Dependabot reports high and critical alerts against the lock files in core and packages/*. None of them reach users: lock files are not published, and our declared ranges already resolve to the patched versions on a fresh install. The alerts are noise that can bury a real one.

What is the new behavior?

• Updated the vulnerable packages, and the parents that pin them, within the existing ranges.
• Added an override in core for compression under serve, since the latest serve pins the vulnerable version. Remove it once a serve release includes fix(compression): bump compression to 1.8.2 vercel/serve#868.
• Angular dev dependencies move from 22.0 to 22.2. Angular 22.2 dropped the private contexts field from the ChildrenOutletContexts typings, so ion-router-outlet now casts to a local type when it saves and restores tab state. The field still exists at runtime, so behavior is unchanged.
• @angular/cli 22.2 no longer bundles its MCP server, which accounts for most of the removals in the Angular lock file.

Does this introduce a breaking change?

• Yes
• No

Other information

Test app lock files are out of scope. The postcss 7 alerts in core remain: they come from stylelint 13 and need a stylelint upgrade, as noted in #31436.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ionic-framework	Ready	Preview	Oct 20, 2026 10:29pm UTC