Repository navigation
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
package: core
brandyscarney
approved these changes
Oct 22, 2026
brandyscarney
left a comment
brandyscarney
left a comment
Member
There was a problem hiding this comment.
Approved with comments!
Comment on lines
+62
to
+65
| /** | ||
| * `ChildrenOutletContexts` keeps each outlet's context in a private `contexts` | ||
| * map. Saving and restoring it preserves tab state. | ||
| */ |
Member
There was a problem hiding this comment.
Could the comment say this field isn't in Angular’s public typings, so it gets checked on upgrades? Something like:
Suggested change
| /** | |
| * `ChildrenOutletContexts` keeps each outlet's context in a private `contexts` | |
| * map. Saving and restoring it preserves tab state. | |
| */ | |
| /** | |
| * `ChildrenOutletContexts` keeps each outlet's context in a private `contexts` | |
| * map that is not part of Angular's public typings. Saving and restoring it | |
| * preserves tab state, so confirm the field still exists when upgrading Angular. | |
| */ |
Member
There was a problem hiding this comment.
npm audit --package-lock-only still shows high alerts for picomatch 2.3.1 (core, react, vue), semver 6.3.0/7.3.7/5.7.1 (core), micromatch (core, react) and vite 7.3.6 (migrate). These look fixable within the current ranges, and the angular lock file already has picomatch 2.3.2. Could you refresh these, or call them out under Other information if they're being left on purpose?
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue number: internal
What is the current behavior?
Dependabot reports high and critical alerts against the lock files in
coreandpackages/*. None of them reach users: lock files are not published, and our declared ranges already resolve to the patched versions on a fresh install. The alerts are noise that can bury a real one.What is the new behavior?
coreforcompressionunderserve, since the latestservepins the vulnerable version. Remove it once aserverelease includes fix(compression): bump compression to 1.8.2 vercel/serve#868.contextsfield from theChildrenOutletContextstypings, soion-router-outletnow casts to a local type when it saves and restores tab state. The field still exists at runtime, so behavior is unchanged.@angular/cli22.2 no longer bundles its MCP server, which accounts for most of the removals in the Angular lock file.Does this introduce a breaking change?
Other information
Test app lock files are out of scope. The
postcss7 alerts incoreremain: they come fromstylelint13 and need astylelintupgrade, as noted in #31436.