[thetaPC]

Issue number: internal

---

What is the current behavior?

Most of the Dependabot alerts on the repo come from the test app and root lock files. None of them reach users, but they bury real alerts.

What is the new behavior?

• Updated the vulnerable packages, and the parents that pin them, within the existing ranges in every test app and the root.
• ng20: npm skips deprecated versions when a non-deprecated one satisfies the range, so @angular/animations and @angular/platform-browser-dynamic held Angular at an early 20.x. Removed @angular/animations, which nothing imports, and raised @angular/platform-browser-dynamic to ^20.1.0. The app now resolves to the latest Angular 20.
• code-split: moved the exact Angular pins from 22.0.1 to 22.2.3. Angular 22.2 renamed the --stats-json output to browser-stats.json, so the test script reads the new file.
• Angular test apps: the shared require-true validator now imports its @angular/forms types with import type. On Angular 22.2, the webpack dev server rejects value imports of type-only names, which broke the ng22 apps.
• React and Vue test apps: moved wait-on to v9, which drops its old axios, and added the same compression override as core for serve.

Does this introduce a breaking change?

• Yes
• No

Other information

Remaining alerts need a tooling upgrade or have no patch: ng18 and ng19 (Angular versions out of support), lerna 5 in the root, cypress 13, and the older vite and vitest in the React apps.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ionic-framework	Ready	Preview	Oct 20, 2026 11:35pm UTC