From 125f8c5857d59d0c957a943bc439d2ebb5aec7c2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 06:42:06 +0000
Subject: [PATCH 01/24] Bump @angular/cdk from 21.2.14 to 22.0.0 in
/web_embedding/ng-flutter (#2848)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/cdk](https://github.com/angular/components) from 21.2.14 to 22.0.0.
Release notes
Sourced from @angular/cdk's releases.
22.0.0
aria
| Commit |
Description |
 |
accordion: introduce accordion harness (#33046) |
 |
combobox: add test harnesses (#33194) |
 |
combobox: migrate simple-combobox directly into primary entrypoints (#33206) |
 |
grid: add test harnesses (#33081) |
 |
listbox: introduce listbox harness (#33064) |
 |
menu: introduce menu harness (#33067) |
 |
tabs: add test harnesses (#33079) |
 |
toolbar: add test harnesses (#33068) |
 |
tree: add test harnesses (#33066) |
 |
combobox: increases autocomplete demo's placeholder text c… (#33084) |
 |
combobox: separates placeholder prefixes (#33163) |
 |
menu: allow menu item role override (#33264) |
 |
menu: defer menu item focus in case menus in cdk overlay (#33258) |
 |
menu: unable to set softDisabled (#33265) |
cdk
| Commit |
Description |
 |
dialog: add the ability to pass bindings |
 |
portal: add directives support to ComponentPortal (#33142) |
 |
a11y: breaking changes for v22 |
 |
drag-drop: breaking changes for v22 |
 |
menu: breaking changes for v22 |
 |
scrolling: make it easier to provide custom scrollable (#33269) |
 |
table: expose rendered rows (#33304) |
material
| Commit |
Description |
 |
bottom-sheet: add the ability to pass bindings |
 |
button: Add support for showing a progress indicator inside the button (#32698) |
 |
core: add mixins for Material Design typography (#32959) |
 |
dialog: add the ability to pass bindings |
 |
tabs: add support for separate tab animation durations (#32869) |
 |
autocomplete: remove modal workaround |
 |
badge: allow badge defaults to be configured (#33312) |
 |
core: address sass compiler warnings (#33040) |
 |
list: breaking changes for v22 |
 |
menu: close menu when cleared from trigger (#33306) |
 |
menu: missing panelClass getter (#33191) |
 |
select: remove modal workaround |
 |
sidenav: handle mixed sidenav and drawer (#33274) |
 |
sidenav: mark content as inert while open |
 |
sidenav: more robust reset logic for inert attribute (#33257) |
 |
sidenav: query not resolving |
 |
sort: breaking changes for v22 |
 |
tabs: incorrect animation variable name (#32941) |
google-maps
... (truncated)
Changelog
Sourced from @angular/cdk's changelog.
22.0.0 "aurostibite-ambulance" (2026-06-03)
Breaking Changes
aria
-
The legacy combobox and autocomplete implementations have been removed. Use the new standalone combobox instead.
- feat(aria/combobox): promote simple-combobox to stable un-prefixed combobox
- Relocates public, private, and example directories to clean
combobox entry points.
- Renames internal layout symbols, selectors, and uppercase tokens (
SIMPLE_COMBOBOX_POPUP -> COMBOBOX_POPUP).
- Establishes full documentation extraction parity with the
json_api Bazel rule target.
- Standardizes the accompanying toolbar component showcase into the clean
aria-toolbar path.
- Re-routes dev-app navigation links and migrates public API golden records.
-
SimpleCombobox has been promoted to Combobox. All simple-combobox prefixed symbols, selectors, and tokens have been renamed to use the combobox prefix.
- refactor(aria/combobox): relocate and restructure autocomplete and toolbar examples
Relocate the autocomplete examples to
src/components-examples/aria/autocomplete and toolbar examples to src/components-examples/aria/toolbar.
- Restore naming continuity with the historical codebase by stripping redundant prefixes from example filenames and component selectors.
- Sync dev-app preview routing layout paths and strict Bazel target dependency links.
cdk
-
CDK_DESCRIBEDBY_HOST_ATTRIBUTE has been removed.CDK_DESCRIBEDBY_ID_PREFIX has been removed.- The
injector parameter of the ConfigurableFocusTrap and FocusTrap constructors is now required.
- The boolean parameter of
ConfigurableFocusTrapFactory.create has been replaced with a config object.
MESSAGES_CONTAINER_ID has been removed.
-
- The
event parameter of DropListRef.drop is now required.
-
ContextMenuTracker has been renamed to MenuTracker.
material
-
MatListOption.checkboxPosition has been removed. use togglePosition instead.MatListOptionCheckboxPosition has been renamed to MatListOptionTogglePosition.
-
ArrowViewState has been removed.ArrowViewStateTransition has been removed.
multiple
-
- A bunch of constructors that with rest arguments have been removed. If you were extending Material/CDK components, you may have to update your
super calls accordingly.
-
Renames the values input/model to value in Combobox, Listbox, Tree, Menu, Toolbar, and Select. Users must update their templates to use the value property instead of values.
- refactor(multiple): update api goldens
google-maps
material
| Commit |
Type |
Description |
| 867ba993b |
feat |
bottom-sheet: add the ability to pass bindings |
| b4a89d599 |
feat |
button: Add support for showing a progress indicator inside the button (#32698) |
| a46b0a1d4 |
feat |
core: add mixins for Material Design typography (#32959) |
| bf3596b53 |
feat |
dialog: add the ability to pass bindings |
| 85c16fe4b |
feat |
tabs: add support for separate tab animation durations (#32869) |
| 440cb1606 |
fix |
autocomplete: remove modal workaround |
... (truncated)
Commits
85e1545 release: cut the v22.0.0 releaseda5c575 build: attempt to address flaky test (#33332)daa6d8d release: cut the v22.0.0-rc.3 release47c0525 build: prevent docs site from rendering Aria examples under Material (#33324)21f8bbb fix(material/badge): allow badge defaults to be configured (#33312)8c8d1a1 docs(material/bottom-sheet): update panelClass comment (#33321)8339e2f build: update dev-infra actions to 649c3afeaa46674507b9625537e49de54a695e2b (...10935f0 refactor(multiple): migrate tests to use whenStable (#33317)9750685 build: update bazel dependencies (#33256)5ba22b6 build: update cross-repo angular dependencies (#33270)- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index ae9112762..f4f7bb025 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -12,7 +12,7 @@
"private": true,
"dependencies": {
"@angular/animations": "^21.1.1",
- "@angular/cdk": "^21.1.2",
+ "@angular/cdk": "^22.0.0",
"@angular/common": "^21.1.1",
"@angular/compiler": "^21.1.0",
"@angular/core": "^21.2.0",
From 5766971b6e4765abba99653321c95130010dcecc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 06:43:58 +0000
Subject: [PATCH 02/24] Bump @angular/forms from 21.2.16 to 22.0.0 in
/web_embedding/ng-flutter (#2847)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) from 21.2.16 to 22.0.0.
Release notes
Sourced from @angular/forms's releases.
VSCode Extension: 22.0.0
Breaking Changes
The extension now bundles TypeScript version 6.0, which itself includes breaking
changes, including new defaults such as strict being true. You will need to explicitly set
"strict": false in your tsconfig.json. Alternatively, the extension supports configuring the tsdk in the same way as the built in TS/JS extension.
Fixes and features
- fix(language-service): Add support for
@Input with transforms (dc9c72da9b)
- feat(language-service): add Document Symbols support for Angular templates (cfd0f9950c)
- feat(language-service): add angular template inlay hints support (5a6d88626b)
- feat(language-service): Add support for idle timeout in defer blocks (c6f98c723c)
22.0.0
compiler
| Commit |
Description |
 |
allow safe navigation to correctly narrow down nullables |
 |
Angular expressions with optional chaining returns undefined |
 |
Support comments in html element. |
 |
abstract emitter producing incorrect code for dynamic imports |
 |
Don't bind inputs/outputs for data- attributes |
 |
don't escape dollar sign in literal expression |
 |
enforce parentheses containing arguments for :host-context |
 |
invalid type checking code if field name needs to be quoted |
 |
normalize tag names with custom namespaces in DomElementSchemaRegistry (#68868) |
 |
preserve leading commas in animation definitions |
 |
remove dedicated support for legacy shadow DOM selectors |
 |
remove deprecated shadow CSS encapsulation polyfills |
 |
sanitize dynamic href and xlink:href bindings on SVG a elements (#68868) |
 |
simplify handling of colon host with a selector list |
 |
stop generating unused field |
 |
throw on duplicate input/outputs |
 |
throw on invalid in expressions |
 |
type check invalid for loops |
compiler-cli
| Commit |
Description |
 |
add support for Node.js 26.0.0 |
 |
Adds warning for prefetch without main defer trigger |
 |
support external TCBs with copied content in specific mode |
 |
animation events not type checked properly when bound through HostListener decorator |
 |
resolve TCB mapping failure for safe property reads with as any |
 |
transform dropping exclamationToken from properties |
 |
introduce NG8023 compile-time diagnostic for duplicate selectors |
core
| Commit |
Description |
 |
add IdleRequestOptions support to IdleService |
 |
add provideWebMcpTools |
... (truncated)
Changelog
Sourced from @angular/forms's changelog.
22.0.0 (2026-06-03)
Blog post "Announcing Angular v22".
Breaking Changes
compiler
- This change will trigger the
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
- data prefixed attribute no-longer bind inputs nor outputs.
- The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
in variables will throw in template expressions.
compiler-cli
- Elements with multiple matching selectors will now throw at compile time.
core
- The second arguement of appRef.bootstrap does not accept
any anymore. Make sure the element you pass is not nullable.
-
- TypeScript versions older than 6.0 are no longer supported.
- Leave animations are no longer limited to the element being removed.
- Component with undefined
changeDetection property are now OnPush by default. Specify changeDetection: ChangeDetectionStrategy.Eager to keep the previous behavior.
- change AnimationCallbackEvent.animationComplete signature
ChangeDetectorRef.checkNoChanges was removed. In tests use fixture.detectChanges() instead.createNgModuleRef was removed, use createNgModule insteadComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.
forms
min and max validation rules no longer support
string values. Bound values must be numbers or null.
http
- Use the
HttpXhrBackend with provideHttpClient(withXhr) if you want to keep supporting upload progress reports.
platform-browser
- This removes styles when they appear to no longer be used by an associated
host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.
- Hammer.js integration has been removed. Use your own implementation.
router
-
The return type for TitleStrategy.getResolvedTitleForRoute
was previously 'any' while the actual return type could only be either string
or undefined. The return type now reflects the possible values correctly.
Code that reads the value may need to be adjusted.
(cherry picked from commit ad37f52c1212164c51ffcc533067af05c2c33c89)
-
The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.
-
paramsInheritanceStrategy now defaults to 'always'
The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.
-
provideRoutes() has been removed. Use provideRouter() or ROUTES as multi token if necessary.
upgrade
- Deprecated
getAngularLib/setAngularLib have been removed use getAngularJSGlobal/setAngularJSGlobal instead.
Deprecations
http
withFetch is now deprecated, it can be safely removed.- The
reportProgress option is deprecated please use reportUploadProgress & reportDownloadProgress instead.
compiler
... (truncated)
Commits
e81c7e8 refactor(forms): type built-in getError resultseb600aa refactor(forms): mark date and limit signal forms APIs publica97d5ec build: update minimum supported Node.js versions3b4ef1e perf(forms): avoid redundant invalidations in parser errors signal16cf84d docs: document FormBuilder.group() controlsConfig value shapes07a9358 perf(forms): avoid spurious recomputation in FormField.parseErrorsda82f24 refactor(forms): add provideExperimentalWebMcpFormsad717df refactor(core): use the @Service decorator where possible.043055f refactor(forms): support when consistently for maxDate and minDate validators0806b2f refactor(forms): use overloads and JSDoc for deprecations- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index f4f7bb025..a77219fb5 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -16,7 +16,7 @@
"@angular/common": "^21.1.1",
"@angular/compiler": "^21.1.0",
"@angular/core": "^21.2.0",
- "@angular/forms": "^21.1.0",
+ "@angular/forms": "^22.0.0",
"@angular/material": "^21.1.1",
"@angular/platform-browser": "^21.2.0",
"@angular/platform-browser-dynamic": "^21.1.2",
From 8df115f2a75ee3e2e1cb60e13201b52a66a6bcfe Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 06:44:01 +0000
Subject: [PATCH 03/24] Bump @angular/platform-browser-dynamic from 21.2.16 to
22.0.0 in /web_embedding/ng-flutter (#2849)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) from 21.2.16 to 22.0.0.
Release notes
Sourced from @angular/platform-browser-dynamic's releases.
VSCode Extension: 22.0.0
Breaking Changes
The extension now bundles TypeScript version 6.0, which itself includes breaking
changes, including new defaults such as strict being true. You will need to explicitly set
"strict": false in your tsconfig.json. Alternatively, the extension supports configuring the tsdk in the same way as the built in TS/JS extension.
Fixes and features
- fix(language-service): Add support for
@Input with transforms (dc9c72da9b)
- feat(language-service): add Document Symbols support for Angular templates (cfd0f9950c)
- feat(language-service): add angular template inlay hints support (5a6d88626b)
- feat(language-service): Add support for idle timeout in defer blocks (c6f98c723c)
22.0.0
compiler
| Commit |
Description |
|
allow safe navigation to correctly narrow down nullables |
|
Angular expressions with optional chaining returns undefined |
|
Support comments in html element. |
|
abstract emitter producing incorrect code for dynamic imports |
|
Don't bind inputs/outputs for data- attributes |
|
don't escape dollar sign in literal expression |
|
enforce parentheses containing arguments for :host-context |
|
invalid type checking code if field name needs to be quoted |
|
normalize tag names with custom namespaces in DomElementSchemaRegistry (#68868) |
|
preserve leading commas in animation definitions |
|
remove dedicated support for legacy shadow DOM selectors |
|
remove deprecated shadow CSS encapsulation polyfills |
|
sanitize dynamic href and xlink:href bindings on SVG a elements (#68868) |
|
simplify handling of colon host with a selector list |
|
stop generating unused field |
|
throw on duplicate input/outputs |
|
throw on invalid in expressions |
|
type check invalid for loops |
compiler-cli
| Commit |
Description |
|
add support for Node.js 26.0.0 |
|
Adds warning for prefetch without main defer trigger |
|
support external TCBs with copied content in specific mode |
|
animation events not type checked properly when bound through HostListener decorator |
|
resolve TCB mapping failure for safe property reads with as any |
|
transform dropping exclamationToken from properties |
|
introduce NG8023 compile-time diagnostic for duplicate selectors |
core
| Commit |
Description |
|
add IdleRequestOptions support to IdleService |
|
add provideWebMcpTools |
... (truncated)
Changelog
Sourced from @angular/platform-browser-dynamic's changelog.
22.0.0 (2026-06-03)
Blog post "Announcing Angular v22".
Breaking Changes
compiler
- This change will trigger the
nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
- data prefixed attribute no-longer bind inputs nor outputs.
- The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
in variables will throw in template expressions.
compiler-cli
- Elements with multiple matching selectors will now throw at compile time.
core
- The second arguement of appRef.bootstrap does not accept
any anymore. Make sure the element you pass is not nullable.
-
- TypeScript versions older than 6.0 are no longer supported.
- Leave animations are no longer limited to the element being removed.
- Component with undefined
changeDetection property are now OnPush by default. Specify changeDetection: ChangeDetectionStrategy.Eager to keep the previous behavior.
- change AnimationCallbackEvent.animationComplete signature
ChangeDetectorRef.checkNoChanges was removed. In tests use fixture.detectChanges() instead.createNgModuleRef was removed, use createNgModule insteadComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.
forms
min and max validation rules no longer support
string values. Bound values must be numbers or null.
http
- Use the
HttpXhrBackend with provideHttpClient(withXhr) if you want to keep supporting upload progress reports.
platform-browser
- This removes styles when they appear to no longer be used by an associated
host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.
- Hammer.js integration has been removed. Use your own implementation.
router
-
The return type for TitleStrategy.getResolvedTitleForRoute
was previously 'any' while the actual return type could only be either string
or undefined. The return type now reflects the possible values correctly.
Code that reads the value may need to be adjusted.
(cherry picked from commit ad37f52c1212164c51ffcc533067af05c2c33c89)
-
The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.
-
paramsInheritanceStrategy now defaults to 'always'
The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.
-
provideRoutes() has been removed. Use provideRouter() or ROUTES as multi token if necessary.
upgrade
- Deprecated
getAngularLib/setAngularLib have been removed use getAngularJSGlobal/setAngularJSGlobal instead.
Deprecations
http
withFetch is now deprecated, it can be safely removed.- The
reportProgress option is deprecated please use reportUploadProgress & reportDownloadProgress instead.
compiler
... (truncated)
Commits
a97d5ec build: update minimum supported Node.js versionsb8d3f36 feat(compiler-cli): add support for Node.js 26.0.04ad3a1f refactor(core): Don't throw when there are not async metadata7f3f3d7 ci: remove remainings of saucelabs testsd550bf7 build: update minimum supported Node.js versions- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index a77219fb5..8e3e16888 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -19,7 +19,7 @@
"@angular/forms": "^22.0.0",
"@angular/material": "^21.1.1",
"@angular/platform-browser": "^21.2.0",
- "@angular/platform-browser-dynamic": "^21.1.2",
+ "@angular/platform-browser-dynamic": "^22.0.0",
"@angular/router": "^21.1.0",
"rxjs": "~7.8.1",
"tslib": "^2.6.2",
From b40c2efa4f1f44d85e9b54b5d4de3dcb530b319b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 11 Jun 2026 06:42:38 +0000
Subject: [PATCH 04/24] Bump @angular/platform-browser from 21.2.17 to 22.0.1
in /web_embedding/ng-flutter (#2857)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) from 21.2.17 to 22.0.1.
Release notes
Sourced from @angular/platform-browser's releases.
22.0.1
common
| Commit |
Description |
 |
escape CSS string-terminating characters in escapeCssUrl |
 |
Limits date format string length |
 |
prevent prototype pollution in formatDateTime |
 |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
 |
disallow i18n event attributes |
 |
more robust logic to check if regex can be optimized |
 |
sanitize href/xlink:href attributes of any element of the MathML namespace |
 |
sanitize two-way properties |
compiler-cli
| Commit |
Description |
 |
bind switch exhaustive check expressions |
core
| Commit |
Description |
 |
disable WebMCP during SSR |
 |
Handle synchronous errors in PendingTasks.run function |
 |
harden TransferState restoration against DOM clobbering |
 |
prevent dangling prevConsumer reference from leaking destroyed views (#68681) |
 |
require WebMCP tool descriptions |
 |
update comment for Default change detection |
 |
use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray |
 |
validate lowercase SVG animation attribute names |
forms
| Commit |
Description |
 |
delay mcp reading the form model by a tick |
 |
harden FormGroup control lookups against prototype shadowing |
 |
remove animationstart listener on component destroy to prevent memory leak |
 |
set additionalProperties: false on generated WebMCP form |
http
| Commit |
Description |
 |
ensure query parameters are inserted before URL fragments |
 |
pass down the reportUploadProgress and reportDownloadProgress on post/patch requests |
 |
preserve empty referrer option in HttpRequest |
 |
Rejects non-HTTP(S) URLs in JSONP requests |
language-service
| Commit |
Description |
 |
prevent external template inlay hints from appearing in TS files |
platform-server
| Commit | Description |
... (truncated)
Changelog
Sourced from @angular/platform-browser's changelog.
22.0.1 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
(cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)
common
| Commit |
Type |
Description |
| c4b5fa3c92 |
fix |
escape CSS string-terminating characters in escapeCssUrl |
| dfff57ede9 |
fix |
Limits date format string length |
| 3c2892c8df |
fix |
prevent prototype pollution in formatDateTime |
| 1d87c49f6e |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| 1ee224ca30 |
fix |
disallow i18n event attributes |
| a56f1cdf8f |
fix |
more robust logic to check if regex can be optimized |
| 5946c18275 |
fix |
sanitize href/xlink:href attributes of any element of the MathML namespace |
| 393b84caf8 |
fix |
sanitize two-way properties |
compiler-cli
| Commit |
Type |
Description |
| 3d9ca2f173 |
fix |
bind switch exhaustive check expressions |
core
| Commit |
Type |
Description |
| 669146b0e7 |
fix |
disable WebMCP during SSR |
| 562a566ead |
fix |
Handle synchronous errors in PendingTasks.run function |
| fa546f382d |
fix |
harden TransferState restoration against DOM clobbering |
| 29fdb98684 |
fix |
prevent dangling prevConsumer reference from leaking destroyed views (#68681) |
| cdcea80327 |
fix |
require WebMCP tool descriptions |
| 4289c4c840 |
fix |
update comment for Default change detection |
| 3dd433b39a |
fix |
use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray |
| 045bb736b3 |
fix |
validate lowercase SVG animation attribute names |
forms
| Commit |
Type |
Description |
| 11836a670a |
fix |
delay mcp reading the form model by a tick |
| 85d2d100e3 |
fix |
harden FormGroup control lookups against prototype shadowing |
| e51ad374ea |
fix |
remove animationstart listener on component destroy to prevent memory leak |
| 55b7b5a6b6 |
fix |
set additionalProperties: false on generated WebMCP form |
http
| Commit |
Type |
Description |
| ffb06c0514 |
fix |
ensure query parameters are inserted before URL fragments |
| 2dd65d21e6 |
fix |
pass down the reportUploadProgress and reportDownloadProgress on post/patch requests |
| 4254eb416c |
fix |
preserve empty referrer option in HttpRequest |
| 167bd4c162 |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
language-service
| Commit | Type | Description |
... (truncated)
Commits
d9c38e5 docs: fix typos in source code commentsa97d5ec build: update minimum supported Node.js versions0d9a245 fix(core): sanitize meta selectorsad717df refactor(core): use the @Service decorator where possible.5a7c1e6 feat(core): add ability to cache resources for SSRb8d3f36 feat(compiler-cli): add support for Node.js 26.0.04ad3a1f refactor(core): Don't throw when there are not async metadata7f3f3d7 ci: remove remainings of saucelabs tests9f479ae feat(core): Update Testability to use PendingTasks for stability indicator0454d4c refactor(core): deprecate withIncrementalHydration- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index 8e3e16888..7356aeed4 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -18,7 +18,7 @@
"@angular/core": "^21.2.0",
"@angular/forms": "^22.0.0",
"@angular/material": "^21.1.1",
- "@angular/platform-browser": "^21.2.0",
+ "@angular/platform-browser": "^22.0.1",
"@angular/platform-browser-dynamic": "^22.0.0",
"@angular/router": "^21.1.0",
"rxjs": "~7.8.1",
From a177301972cd962063073952481764f02c36d008 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 11 Jun 2026 06:43:49 +0000
Subject: [PATCH 05/24] Bump @angular/router from 21.2.17 to 22.0.1 in
/web_embedding/ng-flutter (#2854)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) from 21.2.17 to 22.0.1.
Release notes
Sourced from @angular/router's releases.
22.0.1
common
| Commit |
Description |
|
escape CSS string-terminating characters in escapeCssUrl |
|
Limits date format string length |
|
prevent prototype pollution in formatDateTime |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
disallow i18n event attributes |
|
more robust logic to check if regex can be optimized |
|
sanitize href/xlink:href attributes of any element of the MathML namespace |
|
sanitize two-way properties |
compiler-cli
| Commit |
Description |
|
bind switch exhaustive check expressions |
core
| Commit |
Description |
|
disable WebMCP during SSR |
|
Handle synchronous errors in PendingTasks.run function |
|
harden TransferState restoration against DOM clobbering |
|
prevent dangling prevConsumer reference from leaking destroyed views (#68681) |
|
require WebMCP tool descriptions |
|
update comment for Default change detection |
|
use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray |
|
validate lowercase SVG animation attribute names |
forms
| Commit |
Description |
|
delay mcp reading the form model by a tick |
|
harden FormGroup control lookups against prototype shadowing |
|
remove animationstart listener on component destroy to prevent memory leak |
|
set additionalProperties: false on generated WebMCP form |
http
| Commit |
Description |
|
ensure query parameters are inserted before URL fragments |
|
pass down the reportUploadProgress and reportDownloadProgress on post/patch requests |
|
preserve empty referrer option in HttpRequest |
|
Rejects non-HTTP(S) URLs in JSONP requests |
language-service
| Commit |
Description |
|
prevent external template inlay hints from appearing in TS files |
platform-server
| Commit | Description |
... (truncated)
Changelog
Sourced from @angular/router's changelog.
22.0.1 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
(cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)
common
| Commit |
Type |
Description |
| c4b5fa3c92 |
fix |
escape CSS string-terminating characters in escapeCssUrl |
| dfff57ede9 |
fix |
Limits date format string length |
| 3c2892c8df |
fix |
prevent prototype pollution in formatDateTime |
| 1d87c49f6e |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| 1ee224ca30 |
fix |
disallow i18n event attributes |
| a56f1cdf8f |
fix |
more robust logic to check if regex can be optimized |
| 5946c18275 |
fix |
sanitize href/xlink:href attributes of any element of the MathML namespace |
| 393b84caf8 |
fix |
sanitize two-way properties |
compiler-cli
| Commit |
Type |
Description |
| 3d9ca2f173 |
fix |
bind switch exhaustive check expressions |
core
| Commit |
Type |
Description |
| 669146b0e7 |
fix |
disable WebMCP during SSR |
| 562a566ead |
fix |
Handle synchronous errors in PendingTasks.run function |
| fa546f382d |
fix |
harden TransferState restoration against DOM clobbering |
| 29fdb98684 |
fix |
prevent dangling prevConsumer reference from leaking destroyed views (#68681) |
| cdcea80327 |
fix |
require WebMCP tool descriptions |
| 4289c4c840 |
fix |
update comment for Default change detection |
| 3dd433b39a |
fix |
use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray |
| 045bb736b3 |
fix |
validate lowercase SVG animation attribute names |
forms
| Commit |
Type |
Description |
| 11836a670a |
fix |
delay mcp reading the form model by a tick |
| 85d2d100e3 |
fix |
harden FormGroup control lookups against prototype shadowing |
| e51ad374ea |
fix |
remove animationstart listener on component destroy to prevent memory leak |
| 55b7b5a6b6 |
fix |
set additionalProperties: false on generated WebMCP form |
http
| Commit |
Type |
Description |
| ffb06c0514 |
fix |
ensure query parameters are inserted before URL fragments |
| 2dd65d21e6 |
fix |
pass down the reportUploadProgress and reportDownloadProgress on post/patch requests |
| 4254eb416c |
fix |
preserve empty referrer option in HttpRequest |
| 167bd4c162 |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
language-service
| Commit | Type | Description |
... (truncated)
Commits
43edc84 fix(router): use native URL object for navigation boundary and comparison76a8c87 refactor(core): Split the ng global into internal and external objectsa97d5ec build: update minimum supported Node.js versions3e5ab7b fix(router): skip scroll-to-top on initial navigation when hydrating3e7117d fix(router): Add strict typing on 'getResolvedTitleForRoute'e9d1c7e refactor(router): Move target RouterState creation before 'blocking' stagead717df refactor(core): use the @Service decorator where possible.b8d3f36 feat(compiler-cli): add support for Node.js 26.0.08a7f955 docs: correct "Angular JS" to "AngularJS"c84642a feat(router): add unmatchedInputBehavior option to componentInputBinding- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index 7356aeed4..ec730362b 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -20,7 +20,7 @@
"@angular/material": "^21.1.1",
"@angular/platform-browser": "^22.0.1",
"@angular/platform-browser-dynamic": "^22.0.0",
- "@angular/router": "^21.1.0",
+ "@angular/router": "^22.0.1",
"rxjs": "~7.8.1",
"tslib": "^2.6.2",
"zone.js": "~0.15.0"
From 8cea3171eb20f80bb3f16636ff1c803763cd773c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 11 Jun 2026 06:43:51 +0000
Subject: [PATCH 06/24] Bump @angular/compiler-cli from 21.2.17 to 22.0.1 in
/web_embedding/ng-flutter (#2855)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) from 21.2.17 to 22.0.1.
Release notes
Sourced from @angular/compiler-cli's releases.
22.0.1
common
| Commit |
Description |
|
escape CSS string-terminating characters in escapeCssUrl |
|
Limits date format string length |
|
prevent prototype pollution in formatDateTime |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
disallow i18n event attributes |
|
more robust logic to check if regex can be optimized |
|
sanitize href/xlink:href attributes of any element of the MathML namespace |
|
sanitize two-way properties |
compiler-cli
| Commit |
Description |
|
bind switch exhaustive check expressions |
core
| Commit |
Description |
|
disable WebMCP during SSR |
|
Handle synchronous errors in PendingTasks.run function |
|
harden TransferState restoration against DOM clobbering |
|
prevent dangling prevConsumer reference from leaking destroyed views (#68681) |
|
require WebMCP tool descriptions |
|
update comment for Default change detection |
|
use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray |
|
validate lowercase SVG animation attribute names |
forms
| Commit |
Description |
|
delay mcp reading the form model by a tick |
|
harden FormGroup control lookups against prototype shadowing |
|
remove animationstart listener on component destroy to prevent memory leak |
|
set additionalProperties: false on generated WebMCP form |
http
| Commit |
Description |
|
ensure query parameters are inserted before URL fragments |
|
pass down the reportUploadProgress and reportDownloadProgress on post/patch requests |
|
preserve empty referrer option in HttpRequest |
|
Rejects non-HTTP(S) URLs in JSONP requests |
language-service
| Commit |
Description |
|
prevent external template inlay hints from appearing in TS files |
platform-server
| Commit | Description |
... (truncated)
Changelog
Sourced from @angular/compiler-cli's changelog.
22.0.1 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
(cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)
common
| Commit |
Type |
Description |
| c4b5fa3c92 |
fix |
escape CSS string-terminating characters in escapeCssUrl |
| dfff57ede9 |
fix |
Limits date format string length |
| 3c2892c8df |
fix |
prevent prototype pollution in formatDateTime |
| 1d87c49f6e |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| 1ee224ca30 |
fix |
disallow i18n event attributes |
| a56f1cdf8f |
fix |
more robust logic to check if regex can be optimized |
| 5946c18275 |
fix |
sanitize href/xlink:href attributes of any element of the MathML namespace |
| 393b84caf8 |
fix |
sanitize two-way properties |
compiler-cli
| Commit |
Type |
Description |
| 3d9ca2f173 |
fix |
bind switch exhaustive check expressions |
core
| Commit |
Type |
Description |
| 669146b0e7 |
fix |
disable WebMCP during SSR |
| 562a566ead |
fix |
Handle synchronous errors in PendingTasks.run function |
| fa546f382d |
fix |
harden TransferState restoration against DOM clobbering |
| 29fdb98684 |
fix |
prevent dangling prevConsumer reference from leaking destroyed views (#68681) |
| cdcea80327 |
fix |
require WebMCP tool descriptions |
| 4289c4c840 |
fix |
update comment for Default change detection |
| 3dd433b39a |
fix |
use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray |
| 045bb736b3 |
fix |
validate lowercase SVG animation attribute names |
forms
| Commit |
Type |
Description |
| 11836a670a |
fix |
delay mcp reading the form model by a tick |
| 85d2d100e3 |
fix |
harden FormGroup control lookups against prototype shadowing |
| e51ad374ea |
fix |
remove animationstart listener on component destroy to prevent memory leak |
| 55b7b5a6b6 |
fix |
set additionalProperties: false on generated WebMCP form |
http
| Commit |
Type |
Description |
| ffb06c0514 |
fix |
ensure query parameters are inserted before URL fragments |
| 2dd65d21e6 |
fix |
pass down the reportUploadProgress and reportDownloadProgress on post/patch requests |
| 4254eb416c |
fix |
preserve empty referrer option in HttpRequest |
| 167bd4c162 |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
language-service
| Commit | Type | Description |
... (truncated)
Commits
4b0c3b8 refactor(core): Update registerNgModuleType to support codegen typechecking01ea640 refactor(core): Fix DirectiveDefinition interface to allow abstract classes393b84c fix(compiler): sanitize two-way properties3d9ca2f fix(compiler-cli): bind switch exhaustive check expressionsa56f1cd fix(compiler): more robust logic to check if regex can be optimized2891f7e fix(compiler): move projection attributes into constantsd9c38e5 docs: fix typos in source code commentsa97d5ec build: update minimum supported Node.js versions2200b4a refactor(compiler): add support for compiling NgModules under isolatedDeclara...b2b8dea fix(compiler): strip namespaced SVG script elements during template compilation- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index ec730362b..15dd296ed 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -28,7 +28,7 @@
"devDependencies": {
"@angular-devkit/build-angular": "^21.1.2",
"@angular/cli": "~21.1.1",
- "@angular/compiler-cli": "^21.2.0",
+ "@angular/compiler-cli": "^22.0.1",
"@types/jasmine": "~6.0.0",
"jasmine-core": "~6.0.0",
"karma": "~6.4.2",
From 80069cd27276d718f2be6e26d3b6b2bb627f5873 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 11 Jun 2026 06:44:45 +0000
Subject: [PATCH 07/24] Bump @angular-devkit/build-angular from 21.2.14 to
22.0.1 in /web_embedding/ng-flutter (#2853)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
---
Bumps [@angular-devkit/build-angular](https://github.com/angular/angular-cli) from 21.2.14 to 22.0.1.
Release notes
Sourced from @angular-devkit/build-angular's releases.
22.0.1
@schematics/angular
| Commit |
Description |
 |
fix browserMode option mapping in refactor-jasmine-vitest |
 |
safely comment out multiline statements in refactor-jasmine-vitest |
 |
use null objects and callbacks in karma-to-vitest migration |
@angular/cli
| Commit |
Description |
 |
do not sort migrations of the same version alphabetically |
 |
fallback to local package.json for schematic detection on first run |
 |
isolate temporary package installation from parent pnpm workspace |
 |
remove forceAuth and unscoped credential parsing |
 |
validate registry option is a valid URL in ng add |
 |
optimize update schematic registry query counts by fetching package metadata lazily |
@angular/build
| Commit |
Description |
 |
allow disabling Vitest isolation from builder |
 |
exclude JSON imports from Vite dependency optimization |
 |
prevent concurrent stylesheet bundling esbuild context leaks |
 |
restrict application builder output paths to output directory |
22.0.0
@schematics/angular
| Commit |
Description |
 |
add migrate-karma-to-vitest update migration |
 |
add migration to add istanbul-lib-instrument |
 |
conditionally install istanbul coverage provider for Vitest migration |
 |
migrate fake async to Vitest fake timers |
 |
migrate fakeAsync's flush behavior when used in beforeEach |
 |
rely on strict template default in generated workspaces |
 |
set up fake timers in beforeEach instead of beforeAll |
 |
stabilize refactor-jasmine-vitest schematic |
 |
update TSConfig globals during karma to vitest migration |
 |
add istanbul-lib-instrument to application/library generator dependencies |
 |
add trusted-proxy-headers migration |
 |
default components to OnPush change detection |
 |
defer karma config deletion in Karma to Vitest migration |
 |
preserve Jasmine stub-by-default semantics for bare spies |
 |
replace deprecated ChangeDetectionStrategy.Default with Eager |
 |
support spy call arguments migration in refactor-jasmine-vitest |
 |
use service decorator in ng generate |
@angular/cli
| Commit |
Description |
 |
add support for Node.js 26.0.0 |
 |
reflect new minimum supported Node version in ng.js |
... (truncated)
Changelog
Sourced from @angular-devkit/build-angular's changelog.
22.0.1 (2026-06-10)
@angular/cli
| Commit |
Type |
Description |
| b54e9a549 |
fix |
do not sort migrations of the same version alphabetically |
| d33311612 |
fix |
fallback to local package.json for schematic detection on first run |
| 918102a93 |
fix |
isolate temporary package installation from parent pnpm workspace |
| b048b5f4a |
fix |
remove forceAuth and unscoped credential parsing |
| 277934035 |
fix |
validate registry option is a valid URL in ng add |
| 4510dae02 |
perf |
optimize update schematic registry query counts by fetching package metadata lazily |
@schematics/angular
| Commit |
Type |
Description |
| c80012294 |
fix |
fix browserMode option mapping in refactor-jasmine-vitest |
| a9b6bd904 |
fix |
safely comment out multiline statements in refactor-jasmine-vitest |
| 12199df00 |
fix |
use null objects and callbacks in karma-to-vitest migration |
@angular/build
| Commit |
Type |
Description |
| 89d1be979 |
fix |
allow disabling Vitest isolation from builder |
| d45b84be9 |
fix |
exclude JSON imports from Vite dependency optimization |
| e3cab4ddd |
fix |
prevent concurrent stylesheet bundling esbuild context leaks |
| bd413b0eb |
fix |
restrict application builder output paths to output directory |
22.0.0 (2026-06-03)
Breaking Changes
- Node.js v20 is no longer supported. The minimum supported Node.js versions are now v22.22.0 and v24.13.1.
- The
@angular-devkit/architect-cli package is no longer available. The architect CLI tool has been moved to the @angular-devkit/architect package.
- The experimental
@angular-devkit/build-angular:jest and @angular-devkit/build-angular:web-test-runner builders have been removed.
@angular/build
- The
@angular/build:dev-server (ng serve) now assigns the highest priority to the PORT environment variable. This value will override any port configurations specified in angular.json or via the --port command-line flag. This includes the default port 4200.
istanbul-lib-instrument is now an optional peer dependency.
Projects using karma with code coverage enabled will need to ensure that istanbul-lib-instrument is installed. Note: ng update will automatically add this dependency during the update process.
... (truncated)
Commits
5a64af9 release: cut the v22.0.1 releaseb54e9a5 fix(@angular/cli): do not sort migrations of the same version alphabeticallyb048b5f fix(@angular/cli): remove forceAuth and unscoped credential parsing3275b45 test(@angular/cli): remove unscoped authentication test cases from registry t...da81e55 build: update cross-repo angular dependencies56ac348 build: lock file maintenance12199df fix(@schematics/angular): use null objects and callbacks in karma-to-vitest m...918102a fix(@angular/cli): isolate temporary package installation from parent pnpm wo...e9b106e build: update cross-repo angular dependenciese3cab4d fix(@angular/build): prevent concurrent stylesheet bundling esbuild context l...- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index 15dd296ed..163d67ddf 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -26,7 +26,7 @@
"zone.js": "~0.15.0"
},
"devDependencies": {
- "@angular-devkit/build-angular": "^21.1.2",
+ "@angular-devkit/build-angular": "^22.0.1",
"@angular/cli": "~21.1.1",
"@angular/compiler-cli": "^22.0.1",
"@types/jasmine": "~6.0.0",
From 35833ec756aaebfc9c230c97cecf9dd93bf7812e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 11 Jun 2026 06:47:04 +0000
Subject: [PATCH 08/24] Bump @angular/common from 21.2.17 to 22.0.1 in
/web_embedding/ng-flutter (#2856)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) from 21.2.17 to 22.0.1.
Release notes
Sourced from @angular/common's releases.
22.0.1
common
| Commit |
Description |
|
escape CSS string-terminating characters in escapeCssUrl |
|
Limits date format string length |
|
prevent prototype pollution in formatDateTime |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
disallow i18n event attributes |
|
more robust logic to check if regex can be optimized |
|
sanitize href/xlink:href attributes of any element of the MathML namespace |
|
sanitize two-way properties |
compiler-cli
| Commit |
Description |
|
bind switch exhaustive check expressions |
core
| Commit |
Description |
|
disable WebMCP during SSR |
|
Handle synchronous errors in PendingTasks.run function |
|
harden TransferState restoration against DOM clobbering |
|
prevent dangling prevConsumer reference from leaking destroyed views (#68681) |
|
require WebMCP tool descriptions |
|
update comment for Default change detection |
|
use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray |
|
validate lowercase SVG animation attribute names |
forms
| Commit |
Description |
|
delay mcp reading the form model by a tick |
|
harden FormGroup control lookups against prototype shadowing |
|
remove animationstart listener on component destroy to prevent memory leak |
|
set additionalProperties: false on generated WebMCP form |
http
| Commit |
Description |
|
ensure query parameters are inserted before URL fragments |
|
pass down the reportUploadProgress and reportDownloadProgress on post/patch requests |
|
preserve empty referrer option in HttpRequest |
|
Rejects non-HTTP(S) URLs in JSONP requests |
language-service
| Commit |
Description |
|
prevent external template inlay hints from appearing in TS files |
platform-server
| Commit | Description |
... (truncated)
Changelog
Sourced from @angular/common's changelog.
22.0.1 (2026-06-10)
Deprecations
platform-server
- XHR support in
@angular/platform-server is deprecated. Use standard fetch APIs instead.
(cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)
common
| Commit |
Type |
Description |
| c4b5fa3c92 |
fix |
escape CSS string-terminating characters in escapeCssUrl |
| dfff57ede9 |
fix |
Limits date format string length |
| 3c2892c8df |
fix |
prevent prototype pollution in formatDateTime |
| 1d87c49f6e |
fix |
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Type |
Description |
| 1ee224ca30 |
fix |
disallow i18n event attributes |
| a56f1cdf8f |
fix |
more robust logic to check if regex can be optimized |
| 5946c18275 |
fix |
sanitize href/xlink:href attributes of any element of the MathML namespace |
| 393b84caf8 |
fix |
sanitize two-way properties |
compiler-cli
| Commit |
Type |
Description |
| 3d9ca2f173 |
fix |
bind switch exhaustive check expressions |
core
| Commit |
Type |
Description |
| 669146b0e7 |
fix |
disable WebMCP during SSR |
| 562a566ead |
fix |
Handle synchronous errors in PendingTasks.run function |
| fa546f382d |
fix |
harden TransferState restoration against DOM clobbering |
| 29fdb98684 |
fix |
prevent dangling prevConsumer reference from leaking destroyed views (#68681) |
| cdcea80327 |
fix |
require WebMCP tool descriptions |
| 4289c4c840 |
fix |
update comment for Default change detection |
| 3dd433b39a |
fix |
use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray |
| 045bb736b3 |
fix |
validate lowercase SVG animation attribute names |
forms
| Commit |
Type |
Description |
| 11836a670a |
fix |
delay mcp reading the form model by a tick |
| 85d2d100e3 |
fix |
harden FormGroup control lookups against prototype shadowing |
| e51ad374ea |
fix |
remove animationstart listener on component destroy to prevent memory leak |
| 55b7b5a6b6 |
fix |
set additionalProperties: false on generated WebMCP form |
http
| Commit |
Type |
Description |
| ffb06c0514 |
fix |
ensure query parameters are inserted before URL fragments |
| 2dd65d21e6 |
fix |
pass down the reportUploadProgress and reportDownloadProgress on post/patch requests |
| 4254eb416c |
fix |
preserve empty referrer option in HttpRequest |
| 167bd4c162 |
fix |
Rejects non-HTTP(S) URLs in JSONP requests |
language-service
| Commit | Type | Description |
... (truncated)
Commits
2dd65d2 fix(http): pass down the reportUploadProgress and reportDownloadProgress ...1bd5a56 docs: deprecate XHR support for server-side rendering in HTTP docs and recomm...3c2892c fix(common): prevent prototype pollution in formatDateTimec4b5fa3 fix(common): escape CSS string-terminating characters in escapeCssUrl4254eb4 fix(http): preserve empty referrer option in HttpRequest167bd4c fix(http): Rejects non-HTTP(S) URLs in JSONP requestsdfff57e fix(common): Limits date format string length1d87c49 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...ffb06c0 fix(http): ensure query parameters are inserted before URL fragments4795b35 fix(common): only strip a literal /index.html suffix from URLs- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index 163d67ddf..288dae4b6 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -13,7 +13,7 @@
"dependencies": {
"@angular/animations": "^21.1.1",
"@angular/cdk": "^22.0.0",
- "@angular/common": "^21.1.1",
+ "@angular/common": "^22.0.1",
"@angular/compiler": "^21.1.0",
"@angular/core": "^21.2.0",
"@angular/forms": "^22.0.0",
From 86a98461b611ebd2d30ade868c588d70d6404a16 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 17 Jun 2026 16:04:32 +0200
Subject: [PATCH 09/24] Bump actions/setup-java from 5.2.0 to 5.3.0 (#2858)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [actions/setup-java](https://github.com/actions/setup-java) from
5.2.0 to 5.3.0.
Release notes
Sourced from actions/setup-java's
releases.
v5.3.0
What's Changed
New Contributors
Full Changelog: https://github.com/actions/setup-java/compare/v5...v5.3.0
Commits
ad2b381
Bump @vercel/ncc from 0.38.1 to 0.44.0 (#1018)b24df5b
Make the Adoptopenjdk package type look at the Temurin repo first for
latest ...43120bc
Implement pagination with link headers for Adoptium based apis (#1014)ad9d6a6
Bump @types/node from 24.1.0 to 25.9.3 (#950)039af37
Bump picomatch, @types/jest, jest, jest-circus and ts-jest
(#1016)1756ab6
Bump eslint-config-prettier from 8.10.0 to 10.1.8 (#881)662bb59
Bump @typescript-eslint/eslint-plugin from 8.35.1 to
8.46.2 (#952)1071fc1
fix: resolve npm audit vulnerabilities in fast-xml-builder and
fast-xml-parse...576b821
Merge pull request #674
from gdams/alpine307d3a2
update readme for ubuntu sudo java_home behavior (#1013)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/build-android.yml | 2 +-
.github/workflows/build-ios.yml | 2 +-
.github/workflows/main.yml | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index e88b2a3fd..045b5e036 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -20,7 +20,7 @@ jobs:
if: github.repository == 'flutter/samples'
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+ - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287
with:
distribution: 'zulu'
java-version: '17'
diff --git a/.github/workflows/build-ios.yml b/.github/workflows/build-ios.yml
index 91e222a7b..2468423a5 100644
--- a/.github/workflows/build-ios.yml
+++ b/.github/workflows/build-ios.yml
@@ -23,7 +23,7 @@ jobs:
fail-fast: false
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+ - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287
with:
distribution: 'zulu'
java-version: '17'
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 689aa71fa..a10d3cfcf 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -28,7 +28,7 @@ jobs:
os: [ubuntu-latest, macos-latest]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+ - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287
with:
distribution: 'zulu'
java-version: '17'
From b12d3d565ddb22a670185a06cd77d7514a93c2f8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 17 Jun 2026 16:17:02 +0200
Subject: [PATCH 10/24] Bump actions/checkout from 6.0.2 to 6.0.3 (#2846)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2
to 6.0.3.
Release notes
Sourced from actions/checkout's
releases.
v6.0.3
What's Changed
New Contributors
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3
Changelog
Sourced from actions/checkout's
changelog.
Changelog
v7.0.0
v6.0.3
v6.0.2
v6.0.1
v6.0.0
v5.0.1
v5.0.0
v4.3.1
v4.3.0
v4.2.2
v4.2.1
... (truncated)
Commits
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/build-android.yml | 2 +-
.github/workflows/build-ios.yml | 2 +-
.github/workflows/gemini-cli.yml | 4 ++--
.github/workflows/gemini-issue-automated-triage.yml | 2 +-
.github/workflows/gemini-issue-scheduled-triage.yml | 2 +-
.github/workflows/gemini-pr-review.yml | 2 +-
.github/workflows/main.yml | 2 +-
7 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index 045b5e036..5eec9f6ab 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -19,7 +19,7 @@ jobs:
runs-on: ubuntu-latest
if: github.repository == 'flutter/samples'
steps:
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
- uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287
with:
distribution: 'zulu'
diff --git a/.github/workflows/build-ios.yml b/.github/workflows/build-ios.yml
index 2468423a5..ce59d6f27 100644
--- a/.github/workflows/build-ios.yml
+++ b/.github/workflows/build-ios.yml
@@ -22,7 +22,7 @@ jobs:
strategy:
fail-fast: false
steps:
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
- uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287
with:
distribution: 'zulu'
diff --git a/.github/workflows/gemini-cli.yml b/.github/workflows/gemini-cli.yml
index b4feae184..8f8b1c23a 100644
--- a/.github/workflows/gemini-cli.yml
+++ b/.github/workflows/gemini-cli.yml
@@ -144,7 +144,7 @@ jobs:
- name: 'Checkout PR branch'
if: |-
${{ steps.get_context.outputs.is_pr == 'true' }}
- uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v4
+ uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # ratchet:actions/checkout@v4
with:
token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
repository: '${{ github.repository }}'
@@ -154,7 +154,7 @@ jobs:
- name: 'Checkout main branch'
if: |-
${{ steps.get_context.outputs.is_pr == 'false' }}
- uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v4
+ uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # ratchet:actions/checkout@v4
with:
token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
repository: '${{ github.repository }}'
diff --git a/.github/workflows/gemini-issue-automated-triage.yml b/.github/workflows/gemini-issue-automated-triage.yml
index 9bc4ec054..c122f78b5 100644
--- a/.github/workflows/gemini-issue-automated-triage.yml
+++ b/.github/workflows/gemini-issue-automated-triage.yml
@@ -44,7 +44,7 @@ jobs:
steps:
- name: 'Checkout repository'
- uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v4
+ uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # ratchet:actions/checkout@v4
- name: 'Generate GitHub App Token'
id: 'generate_token'
diff --git a/.github/workflows/gemini-issue-scheduled-triage.yml b/.github/workflows/gemini-issue-scheduled-triage.yml
index 2856ce4d2..bda1b89e6 100644
--- a/.github/workflows/gemini-issue-scheduled-triage.yml
+++ b/.github/workflows/gemini-issue-scheduled-triage.yml
@@ -26,7 +26,7 @@ jobs:
steps:
- name: 'Checkout repository'
- uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v4
+ uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # ratchet:actions/checkout@v4
- name: 'Generate GitHub App Token'
id: 'generate_token'
diff --git a/.github/workflows/gemini-pr-review.yml b/.github/workflows/gemini-pr-review.yml
index e9ae2a48d..d8412354c 100644
--- a/.github/workflows/gemini-pr-review.yml
+++ b/.github/workflows/gemini-pr-review.yml
@@ -66,7 +66,7 @@ jobs:
steps:
- name: 'Checkout PR code'
- uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v4
+ uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # ratchet:actions/checkout@v4
- name: 'Generate GitHub App Token'
id: 'generate_token'
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a10d3cfcf..80c849059 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -27,7 +27,7 @@ jobs:
flutter_version: [stable]
os: [ubuntu-latest, macos-latest]
steps:
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
- uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287
with:
distribution: 'zulu'
From cd36ddc330abb635893ab2266037a0bea6c65795 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 18 Jun 2026 06:40:46 +0000
Subject: [PATCH 11/24] Bump @angular/cli from 21.1.5 to 22.0.2 in
/web_embedding/ng-flutter (#2862)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/cli](https://github.com/angular/angular-cli) from 21.1.5 to 22.0.2.
Release notes
Sourced from @angular/cli's releases.
22.0.2
@angular/cli
| Commit |
Description |
 |
support registry metadata fetching under bun package manager |
 |
implement semaphore backpressure throttling in PackageManager |
@angular/build
| Commit |
Description |
 |
implement semaphore backpressure throttling in JavaScriptTransformer |
@angular/ssr
| Commit |
Description |
 |
avoid caching non-SSG page lookups |
 |
correct grammar in console warning for redirected location headers |
 |
prioritize options over environment variables in AngularNodeAppEngine |
22.0.1
@schematics/angular
| Commit |
Description |
|
fix browserMode option mapping in refactor-jasmine-vitest |
|
safely comment out multiline statements in refactor-jasmine-vitest |
|
use null objects and callbacks in karma-to-vitest migration |
@angular/cli
| Commit |
Description |
|
do not sort migrations of the same version alphabetically |
|
fallback to local package.json for schematic detection on first run |
|
isolate temporary package installation from parent pnpm workspace |
|
remove forceAuth and unscoped credential parsing |
|
validate registry option is a valid URL in ng add |
|
optimize update schematic registry query counts by fetching package metadata lazily |
@angular/build
| Commit |
Description |
|
allow disabling Vitest isolation from builder |
|
exclude JSON imports from Vite dependency optimization |
|
prevent concurrent stylesheet bundling esbuild context leaks |
|
restrict application builder output paths to output directory |
22.0.0
@schematics/angular
| Commit |
Description |
|
add migrate-karma-to-vitest update migration |
|
add migration to add istanbul-lib-instrument |
|
conditionally install istanbul coverage provider for Vitest migration |
|
migrate fake async to Vitest fake timers |
|
migrate fakeAsync's flush behavior when used in beforeEach |
... (truncated)
Changelog
Sourced from @angular/cli's changelog.
22.0.2 (2026-06-17)
@angular/cli
| Commit |
Type |
Description |
| 136fc2714 |
fix |
support registry metadata fetching under bun package manager |
| 2653dd5c7 |
perf |
implement semaphore backpressure throttling in PackageManager |
@angular/build
| Commit |
Type |
Description |
| 0b4a48add |
perf |
implement semaphore backpressure throttling in JavaScriptTransformer |
@angular/ssr
| Commit |
Type |
Description |
| d996a27e9 |
fix |
avoid caching non-SSG page lookups |
| 285a34e42 |
fix |
correct grammar in console warning for redirected location headers |
| c8088a536 |
fix |
prioritize options over environment variables in AngularNodeAppEngine |
22.1.0-next.0 (2026-06-11)
Deprecations
@angular-devkit/core
-
stringToFileBuffer and fileBufferToString are deprecated. Use standard Web APIs (TextEncoder and TextDecoder) instead.
Internal usages within the repository have been removed and replaced with standard Web APIs. The public API golden file for @angular-devkit/core has been updated to reflect the deprecations.
@schematics/angular
| Commit |
Type |
Description |
| 89d7f59cd |
feat |
update ai-config to include Angular MCP server config |
@angular/cli
| Commit |
Type |
Description |
| 7932caaf9 |
fix |
robustly parse npm manifest from array |
@angular-devkit/core
... (truncated)
Commits
aab6c10 release: cut the v22.0.2 release376e4dc build: update cross-repo angular dependenciesd996a27 fix(@angular/ssr): avoid caching non-SSG page lookups5714bfc build: update pnpm to v10.34.3f26011a build: lock file maintenance2879ed9 build: update bazel dependencies092bb2e build: update dependency pacote to v21.5.1d3e8951 build: update dependency esbuild-wasm to v0.28.10f777a8 build: update dependency esbuild to v0.28.1385909c refactor: move eslint disable comment to top of file- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index 288dae4b6..34d7f764b 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -27,7 +27,7 @@
},
"devDependencies": {
"@angular-devkit/build-angular": "^22.0.1",
- "@angular/cli": "~21.1.1",
+ "@angular/cli": "~22.0.2",
"@angular/compiler-cli": "^22.0.1",
"@types/jasmine": "~6.0.0",
"jasmine-core": "~6.0.0",
From d890bebfca96944d2ba41373b021a27b4afde422 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 18 Jun 2026 06:42:02 +0000
Subject: [PATCH 12/24] Bump @angular/compiler from 21.2.17 to 22.0.2 in
/web_embedding/ng-flutter (#2861)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) from 21.2.17 to 22.0.2.
Release notes
Sourced from @angular/compiler's releases.
22.0.2
common
| Commit |
Description |
 |
escape anchor fragment in shadow DOM name selector |
 |
skip transfer cache for uncacheable HTTP traffic (#69316) |
compiler
| Commit |
Description |
 |
restrict possible event handler check to property names longer than 2 characters |
core
| Commit |
Description |
 |
avoid caching missing locale data |
 |
escape overlapping comment delimiters in escapeCommentText |
 |
guard against DOM clobbering in declareExperimentalWebMcpTool |
 |
preserve leave animation for sibling instances sharing a TNode |
 |
prevent unsubscribe during emit from throwing off other listeners |
 |
treat iframe credentialless as security-sensitive |
 |
detect existing signal dependency without checking all producer links |
http
| Commit |
Description |
 |
distinguish repeated transfer cache params |
 |
skip transfer cache for fetch credentialed requests (#69316) |
migrations
| Commit |
Description |
 |
migration skip any target are not build or test |
22.0.1
common
| Commit |
Description |
|
escape CSS string-terminating characters in escapeCssUrl |
|
Limits date format string length |
|
prevent prototype pollution in formatDateTime |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
disallow i18n event attributes |
|
more robust logic to check if regex can be optimized |
|
sanitize href/xlink:href attributes of any element of the MathML namespace |
|
sanitize two-way properties |
compiler-cli
| Commit |
Description |
|
bind switch exhaustive check expressions |
core
... (truncated)
Changelog
Sourced from @angular/compiler's changelog.
22.0.2 (2026-06-17)
common
| Commit |
Type |
Description |
| 94ea403563 |
fix |
escape anchor fragment in shadow DOM name selector |
| 6c1f3e9d49 |
fix |
skip transfer cache for uncacheable HTTP traffic (#69316) |
compiler
| Commit |
Type |
Description |
| 6f1171991a |
fix |
restrict possible event handler check to property names longer than 2 characters |
core
| Commit |
Type |
Description |
| 528a34f766 |
fix |
avoid caching missing locale data |
| e17e8d5422 |
fix |
escape overlapping comment delimiters in escapeCommentText |
| 59dea13f80 |
fix |
guard against DOM clobbering in declareExperimentalWebMcpTool |
| 3a48abc15c |
fix |
preserve leave animation for sibling instances sharing a TNode |
| 93d0a5f95c |
fix |
prevent unsubscribe during emit from throwing off other listeners |
| b32ee7ceb3 |
fix |
treat iframe credentialless as security-sensitive |
| f902d1d35e |
perf |
detect existing signal dependency without checking all producer links |
http
| Commit |
Type |
Description |
| 6867f77ec7 |
fix |
distinguish repeated transfer cache params |
| 7ef1399068 |
fix |
skip transfer cache for fetch credentialed requests (#69316) |
migrations
| Commit |
Type |
Description |
| 15314c1736 |
fix |
migration skip any target are not build or test |
22.1.0-next.0 (2026-06-10)
Deprecations
http
HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.
common
| Commit |
Type |
Description |
| 1ad6824d0d |
fix |
skip transfer cache for uncacheable HTTP traffic (#69017) |
compiler
| Commit |
Type |
Description |
| 25c744c4d0 |
fix |
support foreign components defined outside top-level scope |
compiler-cli
| Commit |
Type |
Description |
| aeb55c8bc1 |
fix |
allow passing uninvoked signals as foreign component props |
| 7c60a98b3c |
fix |
support import aliases in foreignImports (#68674) |
... (truncated)
Commits
74f2b91 refactor(compiler): correct TcbInvalidReferenceOp initializerb32ee7c fix(core): treat iframe credentialless as security-sensitivef309727 refactor(compiler): Collect in-element comments6f11719 fix(compiler): restrict possible event handler check to property names longer...8bb3947 refactor: optimize dom security schema lookups4645850 refactor(compiler): Remove 80 char limit on AbstractEmitterVisitor1ee224c fix(compiler): disallow i18n event attributes5946c18 fix(compiler): sanitize href/xlink:href attributes of any element of the ...393b84c fix(compiler): sanitize two-way properties3d9ca2f fix(compiler-cli): bind switch exhaustive check expressions- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index 34d7f764b..71889a024 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -14,7 +14,7 @@
"@angular/animations": "^21.1.1",
"@angular/cdk": "^22.0.0",
"@angular/common": "^22.0.1",
- "@angular/compiler": "^21.1.0",
+ "@angular/compiler": "^22.0.2",
"@angular/core": "^21.2.0",
"@angular/forms": "^22.0.0",
"@angular/material": "^21.1.1",
From 0f4c6632f01220712fe9d7c2c0c110d30e76c952 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 18 Jun 2026 06:42:04 +0000
Subject: [PATCH 13/24] Bump @angular/animations from 21.2.17 to 22.0.2 in
/web_embedding/ng-flutter (#2860)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/animations](https://github.com/angular/angular/tree/HEAD/packages/animations) from 21.2.17 to 22.0.2.
Release notes
Sourced from @angular/animations's releases.
22.0.2
common
| Commit |
Description |
|
escape anchor fragment in shadow DOM name selector |
|
skip transfer cache for uncacheable HTTP traffic (#69316) |
compiler
| Commit |
Description |
|
restrict possible event handler check to property names longer than 2 characters |
core
| Commit |
Description |
|
avoid caching missing locale data |
|
escape overlapping comment delimiters in escapeCommentText |
|
guard against DOM clobbering in declareExperimentalWebMcpTool |
|
preserve leave animation for sibling instances sharing a TNode |
|
prevent unsubscribe during emit from throwing off other listeners |
|
treat iframe credentialless as security-sensitive |
|
detect existing signal dependency without checking all producer links |
http
| Commit |
Description |
|
distinguish repeated transfer cache params |
|
skip transfer cache for fetch credentialed requests (#69316) |
migrations
| Commit |
Description |
|
migration skip any target are not build or test |
22.0.1
common
| Commit |
Description |
|
escape CSS string-terminating characters in escapeCssUrl |
|
Limits date format string length |
|
prevent prototype pollution in formatDateTime |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
disallow i18n event attributes |
|
more robust logic to check if regex can be optimized |
|
sanitize href/xlink:href attributes of any element of the MathML namespace |
|
sanitize two-way properties |
compiler-cli
| Commit |
Description |
|
bind switch exhaustive check expressions |
core
... (truncated)
Changelog
Sourced from @angular/animations's changelog.
22.0.2 (2026-06-17)
common
| Commit |
Type |
Description |
| 94ea403563 |
fix |
escape anchor fragment in shadow DOM name selector |
| 6c1f3e9d49 |
fix |
skip transfer cache for uncacheable HTTP traffic (#69316) |
compiler
| Commit |
Type |
Description |
| 6f1171991a |
fix |
restrict possible event handler check to property names longer than 2 characters |
core
| Commit |
Type |
Description |
| 528a34f766 |
fix |
avoid caching missing locale data |
| e17e8d5422 |
fix |
escape overlapping comment delimiters in escapeCommentText |
| 59dea13f80 |
fix |
guard against DOM clobbering in declareExperimentalWebMcpTool |
| 3a48abc15c |
fix |
preserve leave animation for sibling instances sharing a TNode |
| 93d0a5f95c |
fix |
prevent unsubscribe during emit from throwing off other listeners |
| b32ee7ceb3 |
fix |
treat iframe credentialless as security-sensitive |
| f902d1d35e |
perf |
detect existing signal dependency without checking all producer links |
http
| Commit |
Type |
Description |
| 6867f77ec7 |
fix |
distinguish repeated transfer cache params |
| 7ef1399068 |
fix |
skip transfer cache for fetch credentialed requests (#69316) |
migrations
| Commit |
Type |
Description |
| 15314c1736 |
fix |
migration skip any target are not build or test |
22.1.0-next.0 (2026-06-10)
Deprecations
http
HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.
common
| Commit |
Type |
Description |
| 1ad6824d0d |
fix |
skip transfer cache for uncacheable HTTP traffic (#69017) |
compiler
| Commit |
Type |
Description |
| 25c744c4d0 |
fix |
support foreign components defined outside top-level scope |
compiler-cli
| Commit |
Type |
Description |
| aeb55c8bc1 |
fix |
allow passing uninvoked signals as foreign component props |
| 7c60a98b3c |
fix |
support import aliases in foreignImports (#68674) |
... (truncated)
Commits
a97d5ec build: update minimum supported Node.js versionsad717df refactor(core): use the @Service decorator where possible.b8d3f36 feat(compiler-cli): add support for Node.js 26.0.06672192 test: remove duplicate tests (#67518)d550bf7 build: update minimum supported Node.js versions- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index 71889a024..0ac633480 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -11,7 +11,7 @@
},
"private": true,
"dependencies": {
- "@angular/animations": "^21.1.1",
+ "@angular/animations": "^22.0.2",
"@angular/cdk": "^22.0.0",
"@angular/common": "^22.0.1",
"@angular/compiler": "^22.0.2",
From ecc4df1bdc2a8311aac3d61351a8e528b6f0ee41 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 18 Jun 2026 06:53:23 +0000
Subject: [PATCH 14/24] Bump @angular/material from 21.2.14 to 22.0.2 in
/web_embedding/ng-flutter (#2863)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/material](https://github.com/angular/components) from 21.2.14 to 22.0.2.
Release notes
Sourced from @angular/material's releases.
22.0.2
material
| Commit |
Description |
 |
bottom-sheet: ensure animation event comes from container |
 |
chips: correct focus management on chip destruction (#33329) |
 |
chips: wrong padding when chip only has edit icon (#33407) |
 |
grid-list: always validate colspan |
 |
stepper: validate animation durations |
cdk
| Commit |
Description |
 |
layout: avoid CSS injection attacks in media matcher |
 |
platform: account for composedPath error during event replay (#33409) |
multiple
| Commit |
Description |
 |
improve dark theme visibility in menu, overlay, and portal examples (#33367) |
22.0.1
youtube-player
| Commit |
Description |
 |
avoid errors with clobbered variables |
 |
validate ID before attaching them to placeholder |
material
| Commit |
Description |
 |
dialog: ignore clicks on aria-disabled close buttons (#33373) |
 |
timepicker: do not allow intervals less than a second (#33354) |
cdk
| Commit |
Description |
 |
a11y: avoid prototype conflicts in id generator (#33356) |
 |
clipboard: avoid infinite attempt loop (#33366) |
aria
| Commit |
Description |
 |
combobox: avoid error for synthetic events (#33360) |
 |
combobox: prevent re-dispatching keyboard event on control target change (#33362) |
 |
tree: recursive textDirection getter (#33337) |
22.0.0
aria
| Commit |
Description |
|
accordion: introduce accordion harness (#33046) |
|
combobox: add test harnesses (#33194) |
|
combobox: migrate simple-combobox directly into primary entrypoints (#33206) |
|
grid: add test harnesses (#33081) |
... (truncated)
Changelog
Sourced from @angular/material's changelog.
22.0.2 "plastic lion" (2026-06-17)
cdk
| Commit |
Type |
Description |
| e8f3419060 |
fix |
layout: avoid CSS injection attacks in media matcher |
| 9dc2b2b2ed |
fix |
platform: account for composedPath error during event replay (#33409) |
material
| Commit |
Type |
Description |
| fb4478bff3 |
fix |
bottom-sheet: ensure animation event comes from container |
| e4f7f3498b |
fix |
chips: correct focus management on chip destruction (#33329) |
| 766b7aceee |
fix |
chips: wrong padding when chip only has edit icon (#33407) |
| ebca801ee5 |
fix |
grid-list: always validate colspan |
| 30942bcd36 |
fix |
stepper: validate animation durations |
multiple
| Commit |
Type |
Description |
| 2995797ded |
fix |
improve dark theme visibility in menu, overlay, and portal examples (#33367) |
22.1.0-next.0 "argon-pineapple" (2026-06-10)
No user facing changes in this release
22.0.1 "argon-apple" (2026-06-10)
aria
| Commit |
Type |
Description |
| 7581b0592 |
fix |
combobox: avoid error for synthetic events (#33360) |
| 1c4706155 |
fix |
combobox: prevent re-dispatching keyboard event on control target change (#33362) |
| 96e9ce10c |
fix |
tree: recursive textDirection getter (#33337) |
cdk
| Commit |
Type |
Description |
| 629aea403 |
fix |
a11y: avoid prototype conflicts in id generator (#33356) |
| 49aeb676c |
fix |
clipboard: avoid infinite attempt loop (#33366) |
material
| Commit |
Type |
Description |
| d7a8cb963 |
fix |
dialog: ignore clicks on aria-disabled close buttons (#33373) |
| bde3c7621 |
fix |
timepicker: do not allow intervals less than a second (#33354) |
youtube-player
| Commit |
Type |
Description |
| d75a22d69 |
fix |
avoid errors with clobbered variables |
| fe0a96ce6 |
fix |
validate ID before attaching them to placeholder |
... (truncated)
Commits
9b9d0ea release: cut the v22.0.2 release7b54e95 build: update cross-repo angular dependencies (#33398)b77a829 docs(google-maps): Document the behavior of using the clusterClick output in ...605f200 build: update pnpm to v10.34.3 (#33392)0309150 build: lock file maintenance (#33406)9dc2b2b fix(cdk/platform): account for composedPath error during event replay (#33409)766b7ac fix(material/chips): wrong padding when chip only has edit icon (#33407)f7170b9 build: fix build failure (#33408)e4f7f34 fix(material/chips): correct focus management on chip destruction (#33329)9ad7964 build: update review config (#33394)- Additional commits viewable in compare view
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index 0ac633480..852bbb0bf 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -17,7 +17,7 @@
"@angular/compiler": "^22.0.2",
"@angular/core": "^21.2.0",
"@angular/forms": "^22.0.0",
- "@angular/material": "^21.1.1",
+ "@angular/material": "^22.0.2",
"@angular/platform-browser": "^22.0.1",
"@angular/platform-browser-dynamic": "^22.0.0",
"@angular/router": "^22.0.1",
From 07909dd07e28bc79a6d14ad38ff117bc8e7f04bf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 18 Jun 2026 06:53:26 +0000
Subject: [PATCH 15/24] Bump @angular/core from 21.2.17 to 22.0.2 in
/web_embedding/ng-flutter (#2859)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 21.2.17 to 22.0.2.
Release notes
Sourced from @angular/core's releases.
22.0.2
common
| Commit |
Description |
|
escape anchor fragment in shadow DOM name selector |
|
skip transfer cache for uncacheable HTTP traffic (#69316) |
compiler
| Commit |
Description |
|
restrict possible event handler check to property names longer than 2 characters |
core
| Commit |
Description |
|
avoid caching missing locale data |
|
escape overlapping comment delimiters in escapeCommentText |
|
guard against DOM clobbering in declareExperimentalWebMcpTool |
|
preserve leave animation for sibling instances sharing a TNode |
|
prevent unsubscribe during emit from throwing off other listeners |
|
treat iframe credentialless as security-sensitive |
|
detect existing signal dependency without checking all producer links |
http
| Commit |
Description |
|
distinguish repeated transfer cache params |
|
skip transfer cache for fetch credentialed requests (#69316) |
migrations
| Commit |
Description |
|
migration skip any target are not build or test |
22.0.1
common
| Commit |
Description |
|
escape CSS string-terminating characters in escapeCssUrl |
|
Limits date format string length |
|
prevent prototype pollution in formatDateTime |
|
use cryptographically secure SHA-256 for transfer cache key generation |
compiler
| Commit |
Description |
|
disallow i18n event attributes |
|
more robust logic to check if regex can be optimized |
|
sanitize href/xlink:href attributes of any element of the MathML namespace |
|
sanitize two-way properties |
compiler-cli
| Commit |
Description |
|
bind switch exhaustive check expressions |
core
... (truncated)
Changelog
Sourced from @angular/core's changelog.
22.0.2 (2026-06-17)
common
| Commit |
Type |
Description |
| 94ea403563 |
fix |
escape anchor fragment in shadow DOM name selector |
| 6c1f3e9d49 |
fix |
skip transfer cache for uncacheable HTTP traffic (#69316) |
compiler
| Commit |
Type |
Description |
| 6f1171991a |
fix |
restrict possible event handler check to property names longer than 2 characters |
core
| Commit |
Type |
Description |
| 528a34f766 |
fix |
avoid caching missing locale data |
| e17e8d5422 |
fix |
escape overlapping comment delimiters in escapeCommentText |
| 59dea13f80 |
fix |
guard against DOM clobbering in declareExperimentalWebMcpTool |
| 3a48abc15c |
fix |
preserve leave animation for sibling instances sharing a TNode |
| 93d0a5f95c |
fix |
prevent unsubscribe during emit from throwing off other listeners |
| b32ee7ceb3 |
fix |
treat iframe credentialless as security-sensitive |
| f902d1d35e |
perf |
detect existing signal dependency without checking all producer links |
http
| Commit |
Type |
Description |
| 6867f77ec7 |
fix |
distinguish repeated transfer cache params |
| 7ef1399068 |
fix |
skip transfer cache for fetch credentialed requests (#69316) |
migrations
| Commit |
Type |
Description |
| 15314c1736 |
fix |
migration skip any target are not build or test |
22.1.0-next.0 (2026-06-10)
Deprecations
http
HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.
common
| Commit |
Type |
Description |
| 1ad6824d0d |
fix |
skip transfer cache for uncacheable HTTP traffic (#69017) |
compiler
| Commit |
Type |
Description |
| 25c744c4d0 |
fix |
support foreign components defined outside top-level scope |
compiler-cli
| Commit |
Type |
Description |
| aeb55c8bc1 |
fix |
allow passing uninvoked signals as foreign component props |
| 7c60a98b3c |
fix |
support import aliases in foreignImports (#68674) |
... (truncated)
Commits
152601e refactor(core): add childSignalProp to ReactiveNodeKind59dea13 fix(core): guard against DOM clobbering in declareExperimentalWebMcpTool81cb457 refactor(router): Add handling for ActivatedRoute-scoped injectorf902d1d perf(core): detect existing signal dependency without checking all producer l...e17e8d5 fix(core): escape overlapping comment delimiters in escapeCommentText0f1cfe3 build: update cross-repo angular dependencies to v22.0.2b32ee7c fix(core): treat iframe credentialless as security-sensitive93d0a5f fix(core): prevent unsubscribe during emit from throwing off other listeners528a34f fix(core): avoid caching missing locale data6f11719 fix(compiler): restrict possible event handler check to property names longer...- Additional commits viewable in compare view
---
web_embedding/ng-flutter/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web_embedding/ng-flutter/package.json b/web_embedding/ng-flutter/package.json
index 852bbb0bf..f42e6436b 100644
--- a/web_embedding/ng-flutter/package.json
+++ b/web_embedding/ng-flutter/package.json
@@ -15,7 +15,7 @@
"@angular/cdk": "^22.0.0",
"@angular/common": "^22.0.1",
"@angular/compiler": "^22.0.2",
- "@angular/core": "^21.2.0",
+ "@angular/core": "^22.0.2",
"@angular/forms": "^22.0.0",
"@angular/material": "^22.0.2",
"@angular/platform-browser": "^22.0.1",
From 5f4c7956953f5ac79399a9bb598cb88c789b86e4 Mon Sep 17 00:00:00 2001
From: Mozammal Hossain <152433210+mozammal-hossain@users.noreply.github.com>
Date: Sat, 20 Jun 2026 03:11:27 +0600
Subject: [PATCH 16/24] =?UTF-8?q?[compass=5Fapp]=20Scope=20LogoutViewModel?=
=?UTF-8?q?=20to=20route=20builder=20=E2=80=94=20fix=20#2604=20(#2819)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
## Description
**Problem:** `LogoutViewModel` was built inside `HomeHeader.build()`, so
each rebuild could create a new instance and a new `logout` command.
That does not match how other Compass view models are scoped (created in
the GoRouter route `builder` and passed in), and it can affect an
in-flight logout when the home screen rebuilds.
**Change:** Create `LogoutViewModel` once in the `/home` route next to
`HomeViewModel`, pass it through `HomeScreen` → `HomeHeader` →
`LogoutButton`, and remove inline construction in `home_title.dart`.
Update `home_screen_test.dart` to build `LogoutViewModel` with fakes and
remove `Provider` wrappers that only supported `context.read()` in the
header.
**Result:** Logout view model lifetime aligns with the home route; no
visual or copy changes (screenshots not needed).
Fixes https://github.com/flutter/samples/issues/2604
---
## Pre-launch Checklist
- [x] I read the [Flutter Style Guide] _recently_, and have followed its
advice.
- [x] I signed the [CLA].
- [x] I read the [Contributors Guide].
- [x] I have added sample code updates to the [changelog].
- [x] I updated/added relevant documentation (doc comments with `///`).
If you need help, consider asking for advice on the #hackers-devrel
channel on [Discord].
[Flutter Style Guide]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Style-guide-for-Flutter-repo.md
[CLA]: https://cla.developers.google.com/
[Discord]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Chat.md
[Contributors Guide]:
https://github.com/flutter/samples/blob/main/CONTRIBUTING.md
[changelog]: ../CHANGELOG.md
---------
Co-authored-by: Eric Windmill
---
CHANGELOG.md | 10 ++++++
compass_app/app/lib/routing/router.dart | 10 +++++-
.../app/lib/ui/home/widgets/home_screen.dart | 13 ++++++--
.../app/lib/ui/home/widgets/home_title.dart | 15 ++++-----
.../ui/home/widgets/home_screen_test.dart | 20 +++++------
cupertino_gallery/lib/widgets/sheet_page.dart | 33 ++++++++-----------
6 files changed, 61 insertions(+), 40 deletions(-)
create mode 100644 CHANGELOG.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 000000000..3bb4049a4
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,10 @@
+# Changelog
+
+Notable changes to the samples in this repository are listed here.
+
+## [Unreleased]
+
+### compass_app
+
+* Scope `LogoutViewModel` to the home route so it is not recreated on every
+ `HomeHeader` rebuild ([#2604](https://github.com/flutter/samples/issues/2604)).
diff --git a/compass_app/app/lib/routing/router.dart b/compass_app/app/lib/routing/router.dart
index 1ed94ed02..284706850 100644
--- a/compass_app/app/lib/routing/router.dart
+++ b/compass_app/app/lib/routing/router.dart
@@ -11,6 +11,7 @@ import '../ui/activities/view_models/activities_viewmodel.dart';
import '../ui/activities/widgets/activities_screen.dart';
import '../ui/auth/login/view_models/login_viewmodel.dart';
import '../ui/auth/login/widgets/login_screen.dart';
+import '../ui/auth/logout/view_models/logout_viewmodel.dart';
import '../ui/booking/view_models/booking_viewmodel.dart';
import '../ui/booking/widgets/booking_screen.dart';
import '../ui/home/view_models/home_viewmodel.dart';
@@ -46,7 +47,14 @@ GoRouter router(AuthRepository authRepository) => GoRouter(
bookingRepository: context.read(),
userRepository: context.read(),
);
- return HomeScreen(viewModel: viewModel);
+ final logoutViewModel = LogoutViewModel(
+ authRepository: context.read(),
+ itineraryConfigRepository: context.read(),
+ );
+ return HomeScreen(
+ viewModel: viewModel,
+ logoutViewModel: logoutViewModel,
+ );
},
routes: [
GoRoute(
diff --git a/compass_app/app/lib/ui/home/widgets/home_screen.dart b/compass_app/app/lib/ui/home/widgets/home_screen.dart
index fefe78003..09d1e49ba 100644
--- a/compass_app/app/lib/ui/home/widgets/home_screen.dart
+++ b/compass_app/app/lib/ui/home/widgets/home_screen.dart
@@ -7,6 +7,7 @@ import 'package:go_router/go_router.dart';
import '../../../domain/models/booking/booking_summary.dart';
import '../../../routing/routes.dart';
+import '../../auth/logout/view_models/logout_viewmodel.dart';
import '../../core/localization/applocalization.dart';
import '../../core/themes/colors.dart';
import '../../core/themes/dimens.dart';
@@ -18,9 +19,14 @@ import 'home_title.dart';
const String bookingButtonKey = 'booking-button';
class HomeScreen extends StatefulWidget {
- const HomeScreen({super.key, required this.viewModel});
+ const HomeScreen({
+ super.key,
+ required this.viewModel,
+ required this.logoutViewModel,
+ });
final HomeViewModel viewModel;
+ final LogoutViewModel logoutViewModel;
@override
State createState() => _HomeScreenState();
@@ -88,7 +94,10 @@ class _HomeScreenState extends State {
vertical: Dimens.of(context).paddingScreenVertical,
horizontal: Dimens.of(context).paddingScreenHorizontal,
),
- child: HomeHeader(viewModel: widget.viewModel),
+ child: HomeHeader(
+ viewModel: widget.viewModel,
+ logoutViewModel: widget.logoutViewModel,
+ ),
),
),
SliverList.builder(
diff --git a/compass_app/app/lib/ui/home/widgets/home_title.dart b/compass_app/app/lib/ui/home/widgets/home_title.dart
index 165e7ffe5..16755793a 100644
--- a/compass_app/app/lib/ui/home/widgets/home_title.dart
+++ b/compass_app/app/lib/ui/home/widgets/home_title.dart
@@ -4,7 +4,6 @@
import 'package:flutter/material.dart';
import 'package:google_fonts/google_fonts.dart';
-import 'package:provider/provider.dart';
import '../../auth/logout/view_models/logout_viewmodel.dart';
import '../../auth/logout/widgets/logout_button.dart';
@@ -13,9 +12,14 @@ import '../../core/themes/dimens.dart';
import '../view_models/home_viewmodel.dart';
class HomeHeader extends StatelessWidget {
- const HomeHeader({super.key, required this.viewModel});
+ const HomeHeader({
+ super.key,
+ required this.viewModel,
+ required this.logoutViewModel,
+ });
final HomeViewModel viewModel;
+ final LogoutViewModel logoutViewModel;
@override
Widget build(BuildContext context) {
@@ -37,12 +41,7 @@ class HomeHeader extends StatelessWidget {
height: Dimens.of(context).profilePictureSize,
),
),
- LogoutButton(
- viewModel: LogoutViewModel(
- authRepository: context.read(),
- itineraryConfigRepository: context.read(),
- ),
- ),
+ LogoutButton(viewModel: logoutViewModel),
],
),
const SizedBox(height: Dimens.paddingVertical),
diff --git a/compass_app/app/test/ui/home/widgets/home_screen_test.dart b/compass_app/app/test/ui/home/widgets/home_screen_test.dart
index 24890be41..a99981100 100644
--- a/compass_app/app/test/ui/home/widgets/home_screen_test.dart
+++ b/compass_app/app/test/ui/home/widgets/home_screen_test.dart
@@ -2,16 +2,14 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-import 'package:compass_app/data/repositories/auth/auth_repository.dart';
-import 'package:compass_app/data/repositories/itinerary_config/itinerary_config_repository.dart';
import 'package:compass_app/routing/routes.dart';
+import 'package:compass_app/ui/auth/logout/view_models/logout_viewmodel.dart';
import 'package:compass_app/ui/home/view_models/home_viewmodel.dart';
import 'package:compass_app/ui/home/widgets/home_screen.dart';
import 'package:compass_app/utils/result.dart';
-import 'package:flutter/foundation.dart';
+import 'package:flutter/widgets.dart';
import 'package:flutter_test/flutter_test.dart';
import 'package:mocktail/mocktail.dart';
-import 'package:provider/provider.dart';
import '../../../../testing/app.dart';
import '../../../../testing/fakes/repositories/fake_auth_repository.dart';
@@ -24,6 +22,7 @@ import '../../../../testing/models/booking.dart';
void main() {
group('HomeScreen tests', () {
late HomeViewModel viewModel;
+ late LogoutViewModel logoutViewModel;
late MockGoRouter goRouter;
late FakeBookingRepository bookingRepository;
@@ -33,6 +32,10 @@ void main() {
bookingRepository: bookingRepository,
userRepository: FakeUserRepository(),
);
+ logoutViewModel = LogoutViewModel(
+ authRepository: FakeAuthRepository(),
+ itineraryConfigRepository: FakeItineraryConfigRepository(),
+ );
goRouter = MockGoRouter();
when(() => goRouter.push(any())).thenAnswer((_) => Future.value(null));
});
@@ -40,12 +43,9 @@ void main() {
Future loadWidget(WidgetTester tester) async {
await testApp(
tester,
- ChangeNotifierProvider.value(
- value: FakeAuthRepository() as AuthRepository,
- child: Provider.value(
- value: FakeItineraryConfigRepository() as ItineraryConfigRepository,
- child: HomeScreen(viewModel: viewModel),
- ),
+ HomeScreen(
+ viewModel: viewModel,
+ logoutViewModel: logoutViewModel,
),
goRouter: goRouter,
);
diff --git a/cupertino_gallery/lib/widgets/sheet_page.dart b/cupertino_gallery/lib/widgets/sheet_page.dart
index 9d27c0bd2..103d1bdcc 100644
--- a/cupertino_gallery/lib/widgets/sheet_page.dart
+++ b/cupertino_gallery/lib/widgets/sheet_page.dart
@@ -13,25 +13,20 @@ class SheetPage extends StatelessWidget {
onPressed: () {
Navigator.of(context).push(
CupertinoSheetRoute(
- scrollableBuilder:
- (BuildContext context, ScrollController controller) {
- Widget widgetBuilder(BuildContext context) {
- return CupertinoPageScaffold(
- navigationBar: CupertinoNavigationBar(
- middle: const Text('Sheet'),
- trailing: GestureDetector(
- child: const Icon(CupertinoIcons.xmark),
- onTap: () {
- Navigator.of(context).pop();
- },
- ),
- ),
- child: const Center(child: Text('This is a sheet')),
- );
- }
-
- return widgetBuilder(context);
- },
+ builder: (BuildContext context) {
+ return CupertinoPageScaffold(
+ navigationBar: CupertinoNavigationBar(
+ middle: const Text('Sheet'),
+ trailing: GestureDetector(
+ child: const Icon(CupertinoIcons.xmark),
+ onTap: () {
+ Navigator.of(context).pop();
+ },
+ ),
+ ),
+ child: const Center(child: Text('This is a sheet')),
+ );
+ },
),
);
},
From 8da6d98439a0459ab26c3bf49ebcd3fbecbc5495 Mon Sep 17 00:00:00 2001
From: Niaz Sagor <50655067+NiazSagor@users.noreply.github.com>
Date: Sat, 20 Jun 2026 03:13:45 +0600
Subject: [PATCH 17/24] Show placeholder for broken activity images (#2769)
Hello, I noticed that there are several image URLs that fail to load on
the Activities screen of the compass_app. The image shows the default
error widget right now.
This PR proposes to display a placeholder with a "broken image" icon
instead of the default error widget. This provides better visual
feedback to the user.
Current:
After fix:
@ericwindmill, please take a look and see if it is appropriate.
## Pre-launch Checklist
- [x] I read the [Flutter Style Guide] _recently_, and have followed its
advice.
- [x] I signed the [CLA].
- [x] I read the [Contributors Guide].
- [x] I have added sample code updates to the [changelog].
- [x] I updated/added relevant documentation (doc comments with `///`).
[Flutter Style Guide]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Style-guide-for-Flutter-repo.md
[CLA]: https://cla.developers.google.com/
[Discord]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Chat.md
[Contributors Guide]:
https://github.com/flutter/samples/blob/main/CONTRIBUTING.md
[changelog]: ../CHANGELOG.md
Co-authored-by: Eric Windmill
---
.../ui/activities/widgets/activity_entry.dart | 21 +++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/compass_app/app/lib/ui/activities/widgets/activity_entry.dart b/compass_app/app/lib/ui/activities/widgets/activity_entry.dart
index 300e560a7..f75643f18 100644
--- a/compass_app/app/lib/ui/activities/widgets/activity_entry.dart
+++ b/compass_app/app/lib/ui/activities/widgets/activity_entry.dart
@@ -30,6 +30,7 @@ class ActivityEntry extends StatelessWidget {
ClipRRect(
borderRadius: BorderRadius.circular(8),
child: CachedNetworkImage(
+ errorWidget: (context, url, error) => _ActivityErrorPlaceholder(),
imageUrl: activity.imageUrl,
height: 80,
width: 80,
@@ -66,3 +67,23 @@ class ActivityEntry extends StatelessWidget {
);
}
}
+
+class _ActivityErrorPlaceholder extends StatelessWidget {
+ const _ActivityErrorPlaceholder({super.key});
+
+ @override
+ Widget build(BuildContext context) {
+ return Container(
+ width: 80,
+ height: 80,
+ decoration: BoxDecoration(
+ color: Colors.grey[200],
+ borderRadius: BorderRadius.circular(8),
+ ),
+ child: Icon(
+ Icons.broken_image_outlined,
+ color: Theme.of(context).colorScheme.onSurfaceVariant,
+ ),
+ );
+ }
+}
From f755c81579172def489e38d5d2c6c4778b330e05 Mon Sep 17 00:00:00 2001
From: Eric Windmill
Date: Fri, 19 Jun 2026 14:14:31 -0700
Subject: [PATCH 18/24] Fix image loading error (#2865)
*Replace this paragraph with a description of what this PR is changing
or adding, and why. Consider including before/after screenshots.*
*List which issues are fixed by this PR. For larger changes, raising an
issue first helps
reduce redundant work.*
## Pre-launch Checklist
- [ ] I read the [Flutter Style Guide] _recently_, and have followed its
advice.
- [ ] I signed the [CLA].
- [ ] I read the [Contributors Guide].
- [ ] I have added sample code updates to the [changelog].
- [ ] I updated/added relevant documentation (doc comments with `///`).
If you need help, consider asking for advice on the #hackers-devrel
channel on [Discord].
[Flutter Style Guide]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Style-guide-for-Flutter-repo.md
[CLA]: https://cla.developers.google.com/
[Discord]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Chat.md
[Contributors Guide]:
https://github.com/flutter/samples/blob/main/CONTRIBUTING.md
[changelog]: ../CHANGELOG.md
---------
Co-authored-by: NiazSagor
Co-authored-by: Niaz Sagor <50655067+NiazSagor@users.noreply.github.com>
---
compass_app/app/lib/ui/activities/widgets/activity_entry.dart | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/compass_app/app/lib/ui/activities/widgets/activity_entry.dart b/compass_app/app/lib/ui/activities/widgets/activity_entry.dart
index f75643f18..b561844f9 100644
--- a/compass_app/app/lib/ui/activities/widgets/activity_entry.dart
+++ b/compass_app/app/lib/ui/activities/widgets/activity_entry.dart
@@ -69,7 +69,7 @@ class ActivityEntry extends StatelessWidget {
}
class _ActivityErrorPlaceholder extends StatelessWidget {
- const _ActivityErrorPlaceholder({super.key});
+ const _ActivityErrorPlaceholder();
@override
Widget build(BuildContext context) {
From 8bfffd4a84d83260eaa9fea12f806f206bafa9df Mon Sep 17 00:00:00 2001
From: Harsh Yadav
Date: Sat, 20 Jun 2026 02:46:31 +0530
Subject: [PATCH 19/24] docs: clarify HomeViewModel lifecycle in Compass sample
(#2838)
Adds a comment explaining why `HomeViewModel` is not disposed in the
Compass sample.
This clarifies that the current implementation is safe because the
ViewModel does not manage disposable resources. It also highlights that
in real applications, proper lifecycle management is required when
working with streams, controllers, or subscriptions.
Fixes https://github.com/flutter/samples/issues/2788
## Pre-launch Checklist
* [x] I read the [[Flutter Style
Guide](https://github.com/flutter/flutter/blob/master/docs/contributing/Style-guide-for-Flutter-repo.md)]
recently, and have followed its advice.
* [x] I signed the [[CLA](https://cla.developers.google.com/)].
* [ ] I have added sample code updates to the
[[changelog](https://chatgpt.com/c/CHANGELOG.md)].
* [x] I updated/added relevant documentation (doc comments with `///`).
[Flutter Style Guide]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Style-guide-for-Flutter-repo.md
[CLA]: https://cla.developers.google.com/
[changelog]: ./CHANGELOG.md
---------
Co-authored-by: Eric Windmill
---
compass_app/app/lib/routing/router.dart | 3 +-
.../home/widgets/home_screen_container.dart | 39 +++++++++++++++++++
2 files changed, 40 insertions(+), 2 deletions(-)
create mode 100644 compass_app/app/lib/ui/home/widgets/home_screen_container.dart
diff --git a/compass_app/app/lib/routing/router.dart b/compass_app/app/lib/routing/router.dart
index 284706850..05cad62b0 100644
--- a/compass_app/app/lib/routing/router.dart
+++ b/compass_app/app/lib/routing/router.dart
@@ -14,8 +14,7 @@ import '../ui/auth/login/widgets/login_screen.dart';
import '../ui/auth/logout/view_models/logout_viewmodel.dart';
import '../ui/booking/view_models/booking_viewmodel.dart';
import '../ui/booking/widgets/booking_screen.dart';
-import '../ui/home/view_models/home_viewmodel.dart';
-import '../ui/home/widgets/home_screen.dart';
+import '../ui/home/widgets/home_screen_container.dart';
import '../ui/results/view_models/results_viewmodel.dart';
import '../ui/results/widgets/results_screen.dart';
import '../ui/search_form/view_models/search_form_viewmodel.dart';
diff --git a/compass_app/app/lib/ui/home/widgets/home_screen_container.dart b/compass_app/app/lib/ui/home/widgets/home_screen_container.dart
new file mode 100644
index 000000000..c62fbc3c1
--- /dev/null
+++ b/compass_app/app/lib/ui/home/widgets/home_screen_container.dart
@@ -0,0 +1,39 @@
+import 'package:flutter/widgets.dart';
+import 'package:provider/provider.dart';
+
+import '../../../data/repositories/booking/booking_repository.dart';
+import '../../../data/repositories/user/user_repository.dart';
+import '../view_models/home_viewmodel.dart';
+import 'home_screen.dart';
+
+class HomeScreenContainer extends StatefulWidget {
+ const HomeScreenContainer({super.key});
+
+ @override
+ State createState() => _HomeScreenContainerState();
+}
+
+class _HomeScreenContainerState extends State {
+ late final HomeViewModel _viewModel;
+
+ @override
+ void initState() {
+ super.initState();
+
+ _viewModel = HomeViewModel(
+ bookingRepository: context.read(),
+ userRepository: context.read(),
+ );
+ }
+
+ @override
+ Widget build(BuildContext context) {
+ return HomeScreen(viewModel: _viewModel);
+ }
+
+ @override
+ void dispose() {
+ _viewModel.dispose();
+ super.dispose();
+ }
+}
From effe13307c41368d53cdda0c01d789f423d5ff18 Mon Sep 17 00:00:00 2001
From: Abdulrahman Bashir <52699770+abdul-alaa@users.noreply.github.com>
Date: Sat, 20 Jun 2026 01:35:48 +0400
Subject: [PATCH 21/24] Migrate testing_app to UIScene lifecycle (#2836)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
## Summary
[](https://www.talabat.com)
[](https://github.com/search?q=org%3Aflutter+talabat&type=pullrequests)
- Migrate `testing_app` iOS project to the UIScene lifecycle as per the
[migration
guide](https://docs.flutter.dev/release/breaking-changes/uiscenedelegate)
- Update `AppDelegate.swift` to use `@main`,
`FlutterImplicitEngineDelegate`, and move plugin registration to
`didInitializeImplicitFlutterEngine`
- Add `UIApplicationSceneManifest` to `Info.plist`
Part of flutter/flutter#176957
## Test plan
- [x] Ran `testing_app` on iOS simulator — app launches and works
correctly
---------
Co-authored-by: Eric Windmill
---
compass_app/app/lib/routing/router.dart | 3 +-
.../lib/pedometer_bindings_generated.dart | 4 +--
pubspec.yaml | 4 +--
testing_app/ios/Runner/AppDelegate.swift | 11 ++++---
testing_app/ios/Runner/Info.plist | 29 ++++++++++++++++---
5 files changed, 37 insertions(+), 14 deletions(-)
diff --git a/compass_app/app/lib/routing/router.dart b/compass_app/app/lib/routing/router.dart
index 05cad62b0..284706850 100644
--- a/compass_app/app/lib/routing/router.dart
+++ b/compass_app/app/lib/routing/router.dart
@@ -14,7 +14,8 @@ import '../ui/auth/login/widgets/login_screen.dart';
import '../ui/auth/logout/view_models/logout_viewmodel.dart';
import '../ui/booking/view_models/booking_viewmodel.dart';
import '../ui/booking/widgets/booking_screen.dart';
-import '../ui/home/widgets/home_screen_container.dart';
+import '../ui/home/view_models/home_viewmodel.dart';
+import '../ui/home/widgets/home_screen.dart';
import '../ui/results/view_models/results_viewmodel.dart';
import '../ui/results/widgets/results_screen.dart';
import '../ui/search_form/view_models/search_form_viewmodel.dart';
diff --git a/pedometer/lib/pedometer_bindings_generated.dart b/pedometer/lib/pedometer_bindings_generated.dart
index eb567657b..91c38f28a 100644
--- a/pedometer/lib/pedometer_bindings_generated.dart
+++ b/pedometer/lib/pedometer_bindings_generated.dart
@@ -45993,9 +45993,7 @@ class ObjCBlock_ffiVoid_ObjCObject_ffiUnsignedLong_bool extends _ObjCBlockBase {
ffi.UnsignedLong,
ffi.Pointer,
)
- >(
- _ObjCBlock_ffiVoid_ObjCObject_ffiUnsignedLong_bool_closureTrampoline,
- )
+ >(_ObjCBlock_ffiVoid_ObjCObject_ffiUnsignedLong_bool_closureTrampoline)
.cast(),
_ObjCBlock_ffiVoid_ObjCObject_ffiUnsignedLong_bool_registerClosure(
(
diff --git a/pubspec.yaml b/pubspec.yaml
index a4a3adbf4..813d5cac6 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -50,8 +50,8 @@ skip_ci:
- add_to_app/multiple_flutters/multiple_flutters_module
- add_to_app/plugin/flutter_module_using_plugin
- add_to_app/prebuilt_module/flutter_module
- # remove after 3.44 release
- cupertino_gallery
skip_ci_beta:
- - material_3_demo
+ # - sample_name_to_skip
+
diff --git a/testing_app/ios/Runner/AppDelegate.swift b/testing_app/ios/Runner/AppDelegate.swift
index 70693e4a8..c30b367ec 100644
--- a/testing_app/ios/Runner/AppDelegate.swift
+++ b/testing_app/ios/Runner/AppDelegate.swift
@@ -1,13 +1,16 @@
-import UIKit
import Flutter
+import UIKit
-@UIApplicationMain
-@objc class AppDelegate: FlutterAppDelegate {
+@main
+@objc class AppDelegate: FlutterAppDelegate, FlutterImplicitEngineDelegate {
override func application(
_ application: UIApplication,
didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?
) -> Bool {
- GeneratedPluginRegistrant.register(with: self)
return super.application(application, didFinishLaunchingWithOptions: launchOptions)
}
+
+ func didInitializeImplicitFlutterEngine(_ engineBridge: FlutterImplicitEngineBridge) {
+ GeneratedPluginRegistrant.register(with: engineBridge.pluginRegistry)
+ }
}
diff --git a/testing_app/ios/Runner/Info.plist b/testing_app/ios/Runner/Info.plist
index 0f22db4b2..434734531 100644
--- a/testing_app/ios/Runner/Info.plist
+++ b/testing_app/ios/Runner/Info.plist
@@ -2,6 +2,8 @@
+ CADisableMinimumFrameDurationOnPhone
+
CFBundleDevelopmentRegion
$(DEVELOPMENT_LANGUAGE)
CFBundleDisplayName
@@ -24,6 +26,29 @@
$(FLUTTER_BUILD_NUMBER)
LSRequiresIPhoneOS
+ UIApplicationSceneManifest
+
+ UIApplicationSupportsMultipleScenes
+
+ UISceneConfigurations
+
+ UIWindowSceneSessionRoleApplication
+
+
+ UISceneClassName
+ UIWindowScene
+ UISceneConfigurationName
+ flutter
+ UISceneDelegateClassName
+ FlutterSceneDelegate
+ UISceneStoryboardFile
+ Main
+
+
+
+
+ UIApplicationSupportsIndirectInputEvents
+
UILaunchStoryboardName
LaunchScreen
UIMainStoryboardFile
@@ -43,9 +68,5 @@
UIViewControllerBasedStatusBarAppearance
- CADisableMinimumFrameDurationOnPhone
-
- UIApplicationSupportsIndirectInputEvents
-
From 659acd06908b386b56eb6576c43d23298e26328c Mon Sep 17 00:00:00 2001
From: Harsh Yadav
Date: Sat, 20 Jun 2026 03:13:13 +0530
Subject: [PATCH 22/24] refactor: remove redundant notifyListeners in
HomeViewModel deleteBooking (#2839)
Removes redundant notifyListeners() call from _deleteBooking().
The method is executed through Command, which already manages its own
notifyListeners lifecycle. This change ensures that HomeViewModel
only notifies listeners when its internal state (_bookings) changes,
avoiding unnecessary updates.
Fixes https://github.com/flutter/samples/issues/2746
## Pre-launch Checklist
- [x] I read the [Flutter Style Guide] recently, and have followed its
advice.
- [x] I signed the [CLA].
- [ ] I have added sample code updates to the [changelog].
- [ ] I updated/added relevant documentation (doc comments with `///`).
[Flutter Style Guide]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Style-guide-for-Flutter-repo.md
[CLA]: https://cla.developers.google.com/
[changelog]: ./CHANGELOG.md
Co-authored-by: Eric Windmill
---
.../ui/home/view_models/home_viewmodel.dart | 44 +++++++++----------
1 file changed, 20 insertions(+), 24 deletions(-)
diff --git a/compass_app/app/lib/ui/home/view_models/home_viewmodel.dart b/compass_app/app/lib/ui/home/view_models/home_viewmodel.dart
index df4a2e479..fba990528 100644
--- a/compass_app/app/lib/ui/home/view_models/home_viewmodel.dart
+++ b/compass_app/app/lib/ui/home/view_models/home_viewmodel.dart
@@ -65,31 +65,27 @@ class HomeViewModel extends ChangeNotifier {
}
Future> _deleteBooking(int id) async {
- try {
- final resultDelete = await _bookingRepository.delete(id);
- switch (resultDelete) {
- case Ok():
- _log.fine('Deleted booking $id');
- case Error():
- _log.warning('Failed to delete booking $id', resultDelete.error);
- return resultDelete;
- }
-
- // After deleting the booking, we need to reload the bookings list.
- // BookingRepository is the source of truth for bookings.
- final resultLoadBookings = await _bookingRepository.getBookingsList();
- switch (resultLoadBookings) {
- case Ok>():
- _bookings = resultLoadBookings.value;
- _log.fine('Loaded bookings');
- case Error>():
- _log.warning('Failed to load bookings', resultLoadBookings.error);
- return resultLoadBookings;
- }
+ final resultDelete = await _bookingRepository.delete(id);
+ switch (resultDelete) {
+ case Ok():
+ _log.fine('Deleted booking $id');
+ case Error():
+ _log.warning('Failed to delete booking $id', resultDelete.error);
+ return resultDelete;
+ }
- return resultLoadBookings;
- } finally {
- notifyListeners();
+ // After deleting the booking, reload the bookings list.
+ final resultLoadBookings = await _bookingRepository.getBookingsList();
+ switch (resultLoadBookings) {
+ case Ok>():
+ _bookings = resultLoadBookings.value;
+ _log.fine('Loaded bookings');
+ notifyListeners(); // notify only when data changes
+ case Error>():
+ _log.warning('Failed to load bookings', resultLoadBookings.error);
+ return resultLoadBookings;
}
+
+ return resultLoadBookings;
}
}
From d9a2b781a2af69df726a63a02382b237df194d08 Mon Sep 17 00:00:00 2001
From: Eric Windmill
Date: Fri, 19 Jun 2026 14:54:02 -0700
Subject: [PATCH 23/24] Various simple fixes (#2866)
*Replace this paragraph with a description of what this PR is changing
or adding, and why. Consider including before/after screenshots.*
*List which issues are fixed by this PR. For larger changes, raising an
issue first helps
reduce redundant work.*
## Pre-launch Checklist
- [ ] I read the [Flutter Style Guide] _recently_, and have followed its
advice.
- [ ] I signed the [CLA].
- [ ] I read the [Contributors Guide].
- [ ] I have added sample code updates to the [changelog].
- [ ] I updated/added relevant documentation (doc comments with `///`).
If you need help, consider asking for advice on the #hackers-devrel
channel on [Discord].
[Flutter Style Guide]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Style-guide-for-Flutter-repo.md
[CLA]: https://cla.developers.google.com/
[Discord]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Chat.md
[Contributors Guide]:
https://github.com/flutter/samples/blob/main/CONTRIBUTING.md
[changelog]: ../CHANGELOG.md
---
compass_app/app/lib/routing/router.dart | 10 ++--------
.../lib/ui/home/widgets/home_screen_container.dart | 13 +++++++++++--
2 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/compass_app/app/lib/routing/router.dart b/compass_app/app/lib/routing/router.dart
index 284706850..2d3030085 100644
--- a/compass_app/app/lib/routing/router.dart
+++ b/compass_app/app/lib/routing/router.dart
@@ -14,8 +14,7 @@ import '../ui/auth/login/widgets/login_screen.dart';
import '../ui/auth/logout/view_models/logout_viewmodel.dart';
import '../ui/booking/view_models/booking_viewmodel.dart';
import '../ui/booking/widgets/booking_screen.dart';
-import '../ui/home/view_models/home_viewmodel.dart';
-import '../ui/home/widgets/home_screen.dart';
+import '../ui/home/widgets/home_screen_container.dart';
import '../ui/results/view_models/results_viewmodel.dart';
import '../ui/results/widgets/results_screen.dart';
import '../ui/search_form/view_models/search_form_viewmodel.dart';
@@ -43,16 +42,11 @@ GoRouter router(AuthRepository authRepository) => GoRouter(
GoRoute(
path: Routes.home,
builder: (context, state) {
- final viewModel = HomeViewModel(
- bookingRepository: context.read(),
- userRepository: context.read(),
- );
final logoutViewModel = LogoutViewModel(
authRepository: context.read(),
itineraryConfigRepository: context.read(),
);
- return HomeScreen(
- viewModel: viewModel,
+ return HomeScreenContainer(
logoutViewModel: logoutViewModel,
);
},
diff --git a/compass_app/app/lib/ui/home/widgets/home_screen_container.dart b/compass_app/app/lib/ui/home/widgets/home_screen_container.dart
index c62fbc3c1..31608b1a5 100644
--- a/compass_app/app/lib/ui/home/widgets/home_screen_container.dart
+++ b/compass_app/app/lib/ui/home/widgets/home_screen_container.dart
@@ -3,11 +3,17 @@ import 'package:provider/provider.dart';
import '../../../data/repositories/booking/booking_repository.dart';
import '../../../data/repositories/user/user_repository.dart';
+import '../../auth/logout/view_models/logout_viewmodel.dart';
import '../view_models/home_viewmodel.dart';
import 'home_screen.dart';
class HomeScreenContainer extends StatefulWidget {
- const HomeScreenContainer({super.key});
+ const HomeScreenContainer({
+ super.key,
+ required this.logoutViewModel,
+ });
+
+ final LogoutViewModel logoutViewModel;
@override
State createState() => _HomeScreenContainerState();
@@ -28,7 +34,10 @@ class _HomeScreenContainerState extends State {
@override
Widget build(BuildContext context) {
- return HomeScreen(viewModel: _viewModel);
+ return HomeScreen(
+ viewModel: _viewModel,
+ logoutViewModel: widget.logoutViewModel,
+ );
}
@override
From 7e12f75defd8c295517acf35abd3365cd1a3ad3d Mon Sep 17 00:00:00 2001
From: Harsh Yadav
Date: Sat, 20 Jun 2026 03:32:33 +0530
Subject: [PATCH 24/24] Migrate compass_app to SharedPreferencesAsync (#2841)
## Description
Migrated `SharedPreferences` usage in `compass_app` to
`SharedPreferencesAsync` to align with the latest `shared_preferences`
recommendations.
### Changes made
* Replaced `SharedPreferences.getInstance()` usages
* Updated async preference reads with awaited getters
* Migrated token persistence logic
* Updated test setup preference clearing logic
Fixes #2720
## Pre-launch Checklist
* [x] I read the [[Flutter Style
Guide](https://github.com/flutter/flutter/blob/master/docs/contributing/Style-guide-for-Flutter-repo.md)]
*recently*, and have followed its advice.
* [x] I signed the [[CLA](https://cla.developers.google.com/)].
* [x] I read the [[Contributors
Guide](https://github.com/flutter/samples/blob/main/CONTRIBUTING.md)].
* [ ] I have added sample code updates to the
[[changelog](https://chatgpt.com/CHANGELOG.md)].
* [ ] I updated/added relevant documentation (doc comments with `///`).
[Flutter Style Guide]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Style-guide-for-Flutter-repo.md
[CLA]: https://cla.developers.google.com/
[Discord]:
https://github.com/flutter/flutter/blob/master/docs/contributing/Chat.md
[Contributors Guide]:
https://github.com/flutter/samples/blob/main/CONTRIBUTING.md
[changelog]: ../CHANGELOG.md
Co-authored-by: Eric Windmill
---
background_isolate_channels/lib/main.dart | 10 ++++++----
.../app/integration_test/app_server_data_test.dart | 2 +-
.../data/services/shared_preferences_service.dart | 12 +++++++++---
3 files changed, 16 insertions(+), 8 deletions(-)
diff --git a/background_isolate_channels/lib/main.dart b/background_isolate_channels/lib/main.dart
index a0c874e34..c929ee0b1 100644
--- a/background_isolate_channels/lib/main.dart
+++ b/background_isolate_channels/lib/main.dart
@@ -65,10 +65,12 @@ class _MyHomePageState extends State {
// Write the value to [SharedPreferences] which will get read on the
// [SimpleDatabase]'s isolate. For this example the value is always true
// just for demonstration purposes.
- final Future sharedPreferencesSet = SharedPreferences.getInstance()
- .then(
- (sharedPreferences) => sharedPreferences.setBool('isDebug', true),
- );
+ final SharedPreferencesAsync sharedPreferences = SharedPreferencesAsync();
+
+ final Future sharedPreferencesSet = sharedPreferences.setBool(
+ 'isDebug',
+ true,
+ );
final Future tempDirFuture = path_provider
.getTemporaryDirectory();
diff --git a/compass_app/app/integration_test/app_server_data_test.dart b/compass_app/app/integration_test/app_server_data_test.dart
index cb4bb28b7..c406c72ea 100644
--- a/compass_app/app/integration_test/app_server_data_test.dart
+++ b/compass_app/app/integration_test/app_server_data_test.dart
@@ -30,7 +30,7 @@ void main() {
setUpAll(() async {
// Clear any stored shared preferences
- final sharedPreferences = await SharedPreferences.getInstance();
+ final sharedPreferences = SharedPreferencesAsync();
await sharedPreferences.clear();
// Start the dart server
diff --git a/compass_app/app/lib/data/services/shared_preferences_service.dart b/compass_app/app/lib/data/services/shared_preferences_service.dart
index 24a67a9b5..09c34391f 100644
--- a/compass_app/app/lib/data/services/shared_preferences_service.dart
+++ b/compass_app/app/lib/data/services/shared_preferences_service.dart
@@ -13,9 +13,11 @@ class SharedPreferencesService {
Future> fetchToken() async {
try {
- final sharedPreferences = await SharedPreferences.getInstance();
+ final sharedPreferences = SharedPreferencesAsync();
+
_log.finer('Got token from SharedPreferences');
- return Result.ok(sharedPreferences.getString(_tokenKey));
+
+ return Result.ok(await sharedPreferences.getString(_tokenKey));
} on Exception catch (e) {
_log.warning('Failed to get token', e);
return Result.error(e);
@@ -24,14 +26,18 @@ class SharedPreferencesService {
Future> saveToken(String? token) async {
try {
- final sharedPreferences = await SharedPreferences.getInstance();
+ final sharedPreferences = SharedPreferencesAsync();
+
if (token == null) {
_log.finer('Removed token');
+
await sharedPreferences.remove(_tokenKey);
} else {
_log.finer('Replaced token');
+
await sharedPreferences.setString(_tokenKey, token);
}
+
return const Result.ok(null);
} on Exception catch (e) {
_log.warning('Failed to set token', e);