chore(git): sync with main by ShaneK · Pull Request #31289 · ionic-team/ionic-framework

ShaneK · 2026-07-23T12:49:28Z

Sync next with main.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@capacitor/core](https://capacitorjs.com) ([source](https://redirect.github.com/ionic-team/capacitor)) | [`8.4.0` → `8.4.1`](https://renovatebot.com/diffs/npm/@capacitor%2fcore/8.4.0/8.4.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@capacitor%2fcore/8.4.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@capacitor%2fcore/8.4.0/8.4.1?slim=true) | --- ### Release Notes <details> <summary>ionic-team/capacitor (@capacitor/core)</summary> ### [`v8.4.1`](https://redirect.github.com/ionic-team/capacitor/blob/HEAD/CHANGELOG.md#841-2026-06-19) [Compare Source](https://redirect.github.com/ionic-team/capacitor/compare/8.4.0...8.4.1) ##### Bug Fixes - **cli:** make SPM dependency patch work on prereleases ([#8508](https://redirect.github.com/ionic-team/capacitor/issues/8508)) ([6048e90](https://redirect.github.com/ionic-team/capacitor/commit/6048e90171afa0229a3c25b52a23c377c6bb804c)) - **cli:** patch Capacitor SPM dependency version in plugins ([#8492](https://redirect.github.com/ionic-team/capacitor/issues/8492)) ([28bb2c6](https://redirect.github.com/ionic-team/capacitor/commit/28bb2c687069dfdd6aa7abc866004a1c6388d103)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekday before 11am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ionic-team/ionic-framework).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Issue number: resolves #30145 --------- ## What is the current behavior? `ionic-react`'s `IonTabBar` tries to reference `this.props.onIonTabsWillChange` and `this.props.onIonTabsDidChange`, which do not exist, causing the `onIonTabsWillChange` and `onIonTabsDidChange` events to never fire. ## What is the new behavior?  - Update usage of `this.props.onIonTabsWillChange` to `this.props.tabsContext.tabBarProps.onIonTabsWillChange` - Update usage of `this.props.onIonTabsDidChange` to `this.props.tabsContext.tabBarProps.onIonTabsDidChange` - Add check to make sure `this.props.tabsContext` is truthy before using it - `onIonTabsWillChange` and `onIonTabsDidChange` fire as expected ## Does this introduce a breaking change? - [ ] Yes - [x] No

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | minor | `v6.4.0` → `v6.5.0` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v6.5.0`](https://redirect.github.com/actions/setup-node/compare/v6.4.0...v6.5.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.4.0...v6.5.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekday before 11am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ionic-team/ionic-framework).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@capacitor/core](https://capacitorjs.com) ([source](https://redirect.github.com/ionic-team/capacitor)) | [`8.4.1` → `8.4.2`](https://renovatebot.com/diffs/npm/@capacitor%2fcore/8.4.1/8.4.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@capacitor%2fcore/8.4.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@capacitor%2fcore/8.4.1/8.4.2?slim=true) | --- ### Release Notes <details> <summary>ionic-team/capacitor (@capacitor/core)</summary> ### [`v8.4.2`](https://redirect.github.com/ionic-team/capacitor/blob/HEAD/CHANGELOG.md#842-2026-07-14) [Compare Source](https://redirect.github.com/ionic-team/capacitor/compare/8.4.1...8.4.2) ##### Bug Fixes - **android:** explicitly grant URI permissions for image capture intent ([#8526](https://redirect.github.com/ionic-team/capacitor/issues/8526)) ([6f2d328](https://redirect.github.com/ionic-team/capacitor/commit/6f2d3283897a375d09ca9ec8784a9f0d65f0a530)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekday before 11am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ionic-team/ionic-framework).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | major | `v6.5.0` → `v7.0.0` | | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v7.0.0...v7.0.0) ### [`v7`](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekday before 11am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ionic-team/ionic-framework).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

v8.8.14

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@capacitor/status-bar](https://redirect.github.com/ionic-team/capacitor-plugins) | [`8.0.2` → `8.0.3`](https://renovatebot.com/diffs/npm/@capacitor%2fstatus-bar/8.0.2/8.0.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@capacitor%2fstatus-bar/8.0.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@capacitor%2fstatus-bar/8.0.2/8.0.3?slim=true) | --- ### Release Notes <details> <summary>ionic-team/capacitor-plugins (@capacitor/status-bar)</summary> ### [`v8.0.3`](https://redirect.github.com/ionic-team/capacitor-plugins/releases/tag/%40capacitor/status-bar%408.0.3) [Compare Source](https://redirect.github.com/ionic-team/capacitor-plugins/compare/@capacitor/status-bar@8.0.2...@capacitor/status-bar@8.0.3) **Note:** Version bump only for package [@capacitor/status-bar](https://redirect.github.com/capacitor/status-bar) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekday before 11am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ionic-team/ionic-framework).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

… enter the modal (#31260) Issue number: internal --------- ## What is the current behavior? When a modal is opened with Android TalkBack enabled, the screen reader cannot enter or navigate the modal's content. On present, focus is moved to the modal host, but the host is role-less. The `role="dialog"`, `aria-modal`, and the label live on the inner `.ion-overlay-wrapper` so assistive technologies have no dialog to land on. ## What is the new behavior? - `present()` now focuses the overlay's `[role="dialog"]` element (the wrapper) instead of the role-less host, falling back to the host when the role is on the host (action-sheet, loading). - The modal wrapper gets `tabIndex="-1"` so it can receive that programmatic focus (an element with only `role="dialog"` is not focusable). Its focus ring is suppressed since the focus is programmatic, not keyboard-driven. - Clears text selection when gestures start to prevent Firefox from interrupting swipe-to-close and sheet gestures. - Adds an e2e test to `modal/test/a11y/modal.e2e.ts` to verify no visible outline added to the wrapper. - Adds e2e tests to `utils/test/overlays/overlays.e2e.ts` to verify the focus is on the wrapper instead of the host for all modals. - Fixes Playwright test helper to clear text selection immediately after `mouse.down()` to prevent the selection from blocking gesture detection in the test environment. --------- Co-authored-by: Brandy Smith <brandyscarney@users.noreply.github.com> Co-authored-by: Brandy Smith <6577830+brandyscarney@users.noreply.github.com>

…s attachShadow (#30967) Issue number: related to #29751 ## What is the current behavior? In Angular SSR environments using a server DOM that does not implement native `attachShadow` (for example Domino), Ionic server hydration can fail with: `TypeError: this.attachShadow is not a function` This occurs in the server hydrate path used by `@ionic/angular-server` when calling `hydrateDocument(...)` with the current default behavior. ## What is the new behavior? This PR adds a capability check in `packages/angular-server/src/ionic-server-module.ts` and applies a conditional fallback only when `attachShadow` is unavailable: - if `attachShadow` is supported: - keep existing behavior (`clientHydrateAnnotations: false`) - if `attachShadow` is not supported: - use `serializeShadowRoot: 'scoped'` - use `clientHydrateAnnotations: true` This keeps the current behavior for environments with native `attachShadow`, while providing a compatible SSR path for Domino-like environments. ## Does this introduce a breaking change? - [ ] Yes - [x] No ## Other information The change is intentionally scoped to `@ionic/angular-server` integration logic and does not modify component behavior or the existing `excludeComponents` list. I could not run the full Ionic test/lint suite locally in my current Windows environment setup, so this PR relies on CI for full validation. Note: this PR addresses the `attachShadow` SSR crash path in `@ionic/angular-server` by applying a conditional fallback. From upstream investigation, there is also a Stencil runtime fix in `>= 4.40.0` related to non-shadow component patching (`children`/`childNodes`) that may affect Angular client hydration behavior. So full end-to-end resolution of all symptoms may also depend on the Stencil bump tracked separately. Co-authored-by: ShaneK <shane@shanessite.net>

Issue number: FW-6928 ---------  ## What is the current behavior? Several third-party GitHub Actions in our workflows and composite actions were still referenced by mutable tags (`@v6`/`@v7`/`@v8`/`@v4`). A mutable tag can be repointed by the action author — or an attacker who gains write access to the action repo — to arbitrary code, which then runs with the workflow's permissions and secrets (notably in the release pipeline). ## What is the new behavior? All remaining unpinned third-party actions are now pinned to a full-length commit SHA with a `# vX.Y.Z` comment, matching the convention already used across the repo (e.g. `actions/checkout@9c091bb… # v7.0.0`). Each action keeps its current major, pinned to the latest patch of that major. Every SHA was independently verified against its upstream tag. File | Action | Pinned to -- | -- | -- actions/build-angular/action.yml | actions/setup-node | 820762786… # v7.0.0 actions/upload-archive/action.yml | actions/upload-artifact | 043fb46d1… # v7.0.1 actions/test-core-screenshot/action.yml | actions/upload-artifact | 043fb46d1… # v7.0.1 actions/download-archive/action.yml | actions/download-artifact | 3e5f45b2c… # v8.0.1 actions/update-reference-screenshots/action.yml | actions/download-artifact | 3e5f45b2c… # v8.0.1 codeql-analysis.yml (init + analyze) | github/codeql-action | 7188fc363… # v4.37.1 conventional-commit.yml | amannn/action-semantic-pull-request | 48f256284… # v6.1.1 label.yml | actions/labeler | b8dd2d9be… # v6.2.0 Local `uses: ./…` composite/reusable refs are intentionally left unchanged (same-repo, no external supply-chain risk). ## Does this introduce a breaking change? - [ ] Yes - [x] No No behavioural change — this only pins which upstream commit CI executes. ## Other information - No major-version upgrades; that's deferred as a separate maintenance concern. - Follow-ups considered but out of scope: a CI guard to block reintroducing unpinned actions, and a `github-actions` Dependabot entry to keep the pins bumped.

v8.8.15

# Conflicts: # core/package-lock.json

vercel · 2026-07-23T12:49:29Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ionic-framework	Ready	Preview, Comment	Jul 23, 2026 12:57pm

renovate Bot and others added 16 commits July 9, 2026 16:09

v8.8.14

2ddda27

chore(): update package lock files

d0618e1

merge release-8.8.14

424ee79

v8.8.14

v8.8.15

f8a46f9

chore(): update package lock files

82f0dc8

merge release-8.8.15

b716c1c

v8.8.15

Merge remote-tracking branch 'origin/main' into sync-next-with-main

c5e26fd

# Conflicts: # core/package-lock.json

ShaneK requested a review from a team as a code owner July 23, 2026 12:49

ShaneK requested a review from gnbm July 23, 2026 12:49

github-actions Bot added package: core @ionic/core package package: angular @ionic/angular package package: vue @ionic/vue package package: react @ionic/react package labels Jul 23, 2026

vercel Bot deployed to Preview July 23, 2026 12:57 View deployment

ShaneK merged commit 6ddf1f9 into next Jul 23, 2026
113 of 116 checks passed

ShaneK deleted the sync-next-with-main branch July 23, 2026 13:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(git): sync with main#31289

chore(git): sync with main#31289
ShaneK merged 16 commits into
nextfrom
sync-next-with-main

ShaneK commented Jul 23, 2026

Uh oh!

vercel Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

ShaneK commented Jul 23, 2026

Uh oh!

vercel Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

vercel Bot commented Jul 23, 2026 •

edited

Loading