chore(deps): bump the patch-updates group across 1 directory with 17 updates

[dependabot]

Bumps the patch-updates group with 17 updates in the / directory:

Package	From	To
@angular/cdk	22.1.6	22.1.7
@angular/common	22.1.6	22.1.7
@angular/core	22.1.6	22.1.7
@angular/forms	22.1.6	22.1.7
@angular/material	22.1.6	22.1.7
@angular/platform-browser	22.1.6	22.1.7
@angular/router	22.1.6	22.1.7
@capacitor/android	8.5.1	8.5.2
@capacitor/core	8.5.1	8.5.2
@capacitor/ios	8.5.1	8.5.2
@capacitor/share	8.0.1	8.0.2
@capgo/capacitor-social-login	8.5.6	8.5.10
@capgo/capacitor-wifi	8.5.2	8.5.4
@ngrx/component	22.0.0	22.0.1
@angular/compiler	22.1.6	22.1.7
@angular/compiler-cli	22.1.6	22.1.7
@angular/language-service	22.1.6	22.1.7

Updates @angular/cdk from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/cdk's releases.

22.1.7

cdk

Commit	Description
	table: update rows when row definitions change (#33670)

Changelog

Sourced from @​angular/cdk's changelog.

22.1.7 "argon-aristocrat" (2026-09-16)

cdk

Commit	Type	Description
a9b6b74bb	fix	table: update rows when row definitions change (#33670)

Commits

• e950f29 release: cut the v22.1.7 release
• bbc7b49 build: update dev infra (#33816)
• 0cf603b build: update to pnpm 12 (#33802) (#33815)
• 510b393 build: lock file maintenance (#33807)
• 28e10ef docs: use correct version when redirecting externally (#33808)
• a9b6b74 fix(cdk/table): update rows when row definitions change (#33670)
• f03c3f1 build: update cross-repo angular dependencies (#33795)
• cbe4615 build: update pnpm to v11.27.0 (#33792)
• faaba71 build: update github/codeql-action action to v4.38.0 (#33791)
• 5fad20e build: update api goldens
• Additional commits viewable in compare view

Updates @angular/common from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/common's releases.

22.1.7

compiler

Commit	Description
	wrap @for collection expression before appending non-null assertion

core

Commit	Description
	return null when getDirectiveMetadata is called with null or undefined

forms

Commit	Description
	mark control as dirty before setting its value in FVC interop

Commits

• See full diff in compare view

Updates @angular/core from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/core's releases.

22.1.7

compiler

Commit	Description
	wrap @for collection expression before appending non-null assertion

core

Commit	Description
	return null when getDirectiveMetadata is called with null or undefined

forms

Commit	Description
	mark control as dirty before setting its value in FVC interop

Commits

• 5ffc381 docs: add the missing heading to the effects guide
• 16c8064 test(core): reduce fakeAsync usage in animation tests
• 8509045 build: update cross-repo angular dependencies
• fd8412c test(core): fix view injector integration spec
• 0e64124 test(core): remove redundant change detection configuration
• 023d172 test(core): reduce fakeAsync usage in tests
• ec48c83 fix(core): return null when getDirectiveMetadata is called with null or undef...
• See full diff in compare view

Updates @angular/forms from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/forms's releases.

22.1.7

compiler

Commit	Description
	wrap @for collection expression before appending non-null assertion

core

Commit	Description
	return null when getDirectiveMetadata is called with null or undefined

forms

Commit	Description
	mark control as dirty before setting its value in FVC interop

Commits

• f73f059 docs: fix API links that point at missing member anchors
• 6555c4e fix(forms): mark control as dirty before setting its value in FVC interop
• 376b71e docs(forms): document what required() considers empty
• 14d6999 docs(forms): close the unterminated code fences in the compatForm docs
• See full diff in compare view

Updates @angular/material from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/material's releases.

22.1.7

cdk

Commit	Description
	table: update rows when row definitions change (#33670)

Changelog

Sourced from @​angular/material's changelog.

22.1.7 "argon-aristocrat" (2026-09-16)

cdk

Commit	Type	Description
a9b6b74bb	fix	table: update rows when row definitions change (#33670)

Commits

• e950f29 release: cut the v22.1.7 release
• bbc7b49 build: update dev infra (#33816)
• 0cf603b build: update to pnpm 12 (#33802) (#33815)
• 510b393 build: lock file maintenance (#33807)
• 28e10ef docs: use correct version when redirecting externally (#33808)
• a9b6b74 fix(cdk/table): update rows when row definitions change (#33670)
• f03c3f1 build: update cross-repo angular dependencies (#33795)
• cbe4615 build: update pnpm to v11.27.0 (#33792)
• faaba71 build: update github/codeql-action action to v4.38.0 (#33791)
• 5fad20e build: update api goldens
• Additional commits viewable in compare view

Updates @angular/platform-browser from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/platform-browser's releases.

22.1.7

compiler

Commit	Description
	wrap @for collection expression before appending non-null assertion

core

Commit	Description
	return null when getDirectiveMetadata is called with null or undefined

forms

Commit	Description
	mark control as dirty before setting its value in FVC interop

Commits

• See full diff in compare view

Updates @angular/router from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/router's releases.

22.1.7

compiler

Commit	Description
	wrap @for collection expression before appending non-null assertion

core

Commit	Description
	return null when getDirectiveMetadata is called with null or undefined

forms

Commit	Description
	mark control as dirty before setting its value in FVC interop

Commits

• f73f059 docs: fix API links that point at missing member anchors
• e0e1f5f docs(router): update scroll restoration example
• a205de9 test(router): remove redundant change detection configuration
• See full diff in compare view

Updates @capacitor/android from 8.5.1 to 8.5.2

Release notes

Sourced from @​capacitor/android's releases.

8.5.2

8.5.2 (2026-09-11)

Bug Fixes

• android: add null checks for plugin annotation when retrieving permissions (#8400) (035b16a)
• ios: do not forward scene lifecycle events to the page before it has loaded (#8595) (c567328)
• resolve issues with safe area / systembars plugin (#8535) (e37d9c6)

Changelog

Sourced from @​capacitor/android's changelog.

8.5.2 (2026-09-11)

Bug Fixes

• android: add null checks for plugin annotation when retrieving permissions (#8400) (035b16a)
• ios: do not forward scene lifecycle events to the page before it has loaded (#8595) (c567328)
• resolve issues with safe area / systembars plugin (#8535) (e37d9c6)

Commits

• 5e0f678 Release 8.5.2
• e37d9c6 fix: resolve issues with safe area / systembars plugin (#8535)
• 035b16a fix(android): add null checks for plugin annotation when retrieving permissio...
• c567328 fix(ios): do not forward scene lifecycle events to the page before it has loa...
• See full diff in compare view

Updates @capacitor/core from 8.5.1 to 8.5.2

Release notes

Sourced from @​capacitor/core's releases.

8.5.2

8.5.2 (2026-09-11)

Bug Fixes

• android: add null checks for plugin annotation when retrieving permissions (#8400) (035b16a)
• ios: do not forward scene lifecycle events to the page before it has loaded (#8595) (c567328)
• resolve issues with safe area / systembars plugin (#8535) (e37d9c6)

Changelog

Sourced from @​capacitor/core's changelog.

8.5.2 (2026-09-11)

Bug Fixes

• android: add null checks for plugin annotation when retrieving permissions (#8400) (035b16a)
• ios: do not forward scene lifecycle events to the page before it has loaded (#8595) (c567328)
• resolve issues with safe area / systembars plugin (#8535) (e37d9c6)

Commits

• 5e0f678 Release 8.5.2
• e37d9c6 fix: resolve issues with safe area / systembars plugin (#8535)
• 035b16a fix(android): add null checks for plugin annotation when retrieving permissio...
• c567328 fix(ios): do not forward scene lifecycle events to the page before it has loa...
• See full diff in compare view

Updates @capacitor/ios from 8.5.1 to 8.5.2

Release notes

Sourced from @​capacitor/ios's releases.

8.5.2

8.5.2 (2026-09-11)

Bug Fixes

• android: add null checks for plugin annotation when retrieving permissions (#8400) (035b16a)
• ios: do not forward scene lifecycle events to the page before it has loaded (#8595) (c567328)
• resolve issues with safe area / systembars plugin (#8535) (e37d9c6)

Changelog

Sourced from @​capacitor/ios's changelog.

8.5.2 (2026-09-11)

Bug Fixes

• android: add null checks for plugin annotation when retrieving permissions (#8400) (035b16a)
• ios: do not forward scene lifecycle events to the page before it has loaded (#8595) (c567328)
• resolve issues with safe area / systembars plugin (#8535) (e37d9c6)

Commits

• 5e0f678 Release 8.5.2
• e37d9c6 fix: resolve issues with safe area / systembars plugin (#8535)
• 035b16a fix(android): add null checks for plugin annotation when retrieving permissio...
• c567328 fix(ios): do not forward scene lifecycle events to the page before it has loa...
• See full diff in compare view

Updates @capacitor/share from 8.0.1 to 8.0.2

Release notes

Sourced from @​capacitor/share's releases.

@​capacitor/share@​8.0.2

8.0.2 (2026-09-16)

Bug Fixes

• share: Add nonce validation to broadcast receiver on Android (#2592) (fa8ddfb)

Commits

• 467dafd chore(release): publish [skip ci]
• fa8ddfb fix(share): Add nonce validation to broadcast receiver on Android (#2592)
• 89070d4 chore: migrate local notifications to new repo (#2584)
• 8697a12 chore: remove commented cocoapods-deploy.yml (#2582)
• 47402f4 chore: one last? fixup
• 7aa810e chore: changed manifest for monorepo
• 7d6db06 chore: changed manifest for monorepo
• 7888ae6 chore: change release-please release type
• 816b70f chore: bootstrap releases with release-please (#2575)
• 0bfde98 chore(release): publish [skip ci]
• Additional commits viewable in compare view

Updates @capgo/capacitor-social-login from 8.5.6 to 8.5.10

Release notes

Sourced from @​capgo/capacitor-social-login's releases.

8.5.10

🆕 Changelog

Fixed

• Fixed an issue on Android where decodeIdToken incorrectly rejected valid JWTs due to an overly strict split regex. JWT token decoding now works reliably for valid Android authentication flows.

---

🔗 Full Changelog: Cap-go/capacitor-social-login@8.5.9...8.5.10

8.5.9

🆕 Changelog

Changed

• Added a CI check to detect and block use of Capacitor APIs that are deprecated in Capacitor 9, helping ensure forward compatibility with future Capacitor releases
• Updated the Hono framework dependency to v4.13.7 to incorporate the latest improvements and fixes

---

🔗 Full Changelog: Cap-go/capacitor-social-login@8.5.8...8.5.9

8.5.8

🆕 Changelog

Changed

• Updated Capacitor dependencies to v8.5.2, keeping the native integration current and aligned with the latest upstream fixes.

Security

• Updated Hono to v4.13.5 to address a security advisory, improving the safety of the HTTP routing layer.

---

🔗 Full Changelog: Cap-go/capacitor-social-login@8.5.7...8.5.8

8.5.7

🆕 Changelog

Fixed

• Resolved an iOS issue where the ID token was not preserved for use as id_token_hint during OAuth2 logout, improving compatibility with identity providers that require this parameter.

Changed

• Updated the @types/react-dom development dependency to v19.2.7.

---

... (truncated)

Commits

• 1467163 chore(release): 8.5.10
• 236e9ef fix(android): decodeIdToken Invalid JWT due to wrong split regex (#466)
• 38d9bda chore(release): 8.5.9
• c4ec332 ci: add Cap 9 deprecated-API guard (#465)
• b8664e5 chore(deps): update dependency hono to v4.13.7 (#462)
• d1ea793 chore(release): 8.5.8
• 6899298 chore(deps): update capacitor monorepo to v8.5.2 (#461)
• 4a6c0bc chore(deps): update dependency hono to v4.13.5 [security] (#460)
• f47c622 chore(release): 8.5.7
• c6bcb47 fix(ios): preserve id_token for OAuth2 logout id_token_hint (#459)
• Additional commits viewable in compare view

Updates @capgo/capacitor-wifi from 8.5.2 to 8.5.4

Release notes

Sourced from @​capgo/capacitor-wifi's releases.

8.5.4

🆕 Changelog

Changed

• Added automated CI guard to detect usage of APIs deprecated in Capacitor 9, helping maintain forward compatibility and smoother future upgrades.

---

🔗 Full Changelog: Cap-go/capacitor-wifi@8.5.3...8.5.4

8.5.3

🆕 Changelog

Fixed

• Replaced deprecated PluginCall.hasOption usage with typed accessors to resolve deprecation warnings and ensure forward compatibility with Capacitor 9.

---

🔗 Full Changelog: Cap-go/capacitor-wifi@8.5.2...8.5.3

Commits

• a0d3dc8 chore(release): 8.5.4
• 5351460 ci: add Cap 9 deprecated-API guard (#24)
• fe2cf1d chore(release): 8.5.3
• b8e54a8 Merge pull request #22 from Cap-go/cursor/cap9-hasoption-typed-accessors-29a9
• fbbefa2 fix: replace deprecated PluginCall.hasOption for Cap 9 prep
• See full diff in compare view

Updates @ngrx/component from 22.0.0 to 22.0.1

Changelog

Sourced from @​ngrx/component's changelog.

22.0.1 (2026-09-10)

Bug Fixes

• signals: preserve entity when id changes number to equivalent string (#5219) (a797e4b), closes #5218
• update ng-packagr to fix schematics output (#5217) (fb3dece)

Commits

• a499539 chore: release 22.0.1
• 64185ca build: prepare for TS 7 by enabling stableTypeOrdering compiler option (#5214)
• ee3d3e9 test: re-enable skipped tests (#5220)
• a797e4b fix(signals): preserve entity when id changes number to equivalent string (#5...
• fb3dece fix: update ng-packagr to fix schematics output (#5217)
• b2a03cc docs: add link to v21 docs and update current version to stable 22 (#5213)
• See full diff in compare view

Updates @angular/compiler from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/compiler's releases.

22.1.7

compiler

Commit	Description
	wrap @for collection expression before appending non-null assertion

core

Commit	Description
	return null when getDirectiveMetadata is called with null or undefined

forms

Commit	Description
	mark control as dirty before setting its value in FVC interop

Commits

• 7b7b203 refactor(compiler): remove write-only collections from template pipeline phases
• 8a837f6 Revert "fix(compiler): wrap @for collection expression before appending non...
• 5e632b6 fix(compiler): wrap @for collection expression before appending non-null as...
• See full diff in compare view

Updates @angular/compiler-cli from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/compiler-cli's releases.

22.1.7

compiler

Commit	Description
	wrap @for collection expression before appending non-null assertion

core

Commit	Description
	return null when getDirectiveMetadata is called with null or undefined

forms

Commit	Description
	mark control as dirty before setting its value in FVC interop

Commits

• 8a837f6 Revert "fix(compiler): wrap @for collection expression before appending non...
• 66de56b refactor(compiler-cli): relax nullish coalescing non nullable diagnostics on ...
• 5e632b6 fix(compiler): wrap @for collection expression before appending non-null as...
• See full diff in compare view

Updates @angular/language-service from 22.1.6 to 22.1.7

Release notes

Sourced from @​angular/language-service's releases.

22.1.7

compiler

Commit	Description
	wrap @for collection expression before appending non-null assertion

core

Commit	Description
	return null when getDirectiveMetadata is called with null or undefined

forms

Commit	Description
	mark control as dirty before setting its value in FVC interop

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[numbers-official]

Automated Code Review (Heartbeat Deep Check)

Reviewed the 17-package patch-updates group. This PR is not safe to merge as-is — CI is failing on all three primary checks (dependabot-lockfile-normalize, build/android, test/lint) with the same root cause.

Findings

• [Regression Risk / Build-blocker] package.json — Incomplete Angular lockstep bump. The group updates @angular/{cdk,common,core,forms,material,platform-browser,router,compiler,compiler-cli,language-service} from 22.1.6 to 22.1.7, but @angular/platform-browser-dynamic is not included and stays pinned at 22.1.6. Since platform-browser-dynamic@22.1.6 declares an exact peer of @angular/common@22.1.6, and the root project now installs @angular/common@^22.1.7 (resolved to 22.1.7), npm's ERESOLVE cannot satisfy the graph:

While resolving: @angular/platform-browser-dynamic@22.1.6
Found: @angular/common@22.1.7
Conflicting peer dependency: @angular/common@22.1.6

This causes npm install --package-lock-only --ignore-scripts (used by both the dependabot-lockfile-normalize workflow and the build/test runners' lockstep normalization step) to exit 1 before any real work runs.

Historical Context

This is the same failure mode as PR #3536 (Angular 22.1.4/22.1.5 lockstep gap), which was closed and superseded by PR #3538 carrying a complete, uniform 22.1.6 bump across every @angular/* package including platform-browser-dynamic, compiler, compiler-cli, and language-service. The Dependabot patch-updates grouping filter still appears to not consistently capture platform-browser-dynamic; a repeat manual/superseding PR is likely required (or the group config in .github/dependabot.yml should be widened so platform-browser-dynamic is included in the @angular grouping).

Summary

This is a blocking Dependabot grouping gap, not a code defect — the group must be complete before merge. Recommended action: extend this PR (or a superseding PR) to also bump @angular/platform-browser-dynamic from 22.1.6 → 22.1.7 alongside the other 10 @angular/* packages, then re-run npm install --package-lock-only --ignore-scripts and re-push. Still requires human approval before merge.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.