[dependabot]

Bumps @angular/router from 22.1.6 to 22.2.1.

Release notes

Sourced from @​angular/router's releases.

22.2.1

common

Commit	Description
	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Description
	add explicit return types to generated functions
	avoid incorrectly stripping parentheses in template pipeline
	avoid stripping parentheses from some expressions

compiler-cli

Commit	Description
	support extendedConfigCache in readConfiguration

core

Commit	Description
	add debugName on afterRenderEffect
	block dangerous data: and vbscript: URLs in URL sanitizer
	extend data: URL allowlist for non-executable MIME types
	include signal and component name in NG0600 error message
	render error boundary fallbacks after HMR

http

Commit	Description
	forward reportProgress of httpResource as reportDownloadProgress

platform-server

Commit	Description
	reject protocol-relative paths in resolveUrl

router

Commit	Description
	do not copy URL-sized objects into every route snapshot
	fall back when serializing protocol-relative URLs
	limit absolute redirects from redirect functions
	reject duplicate outlets in production builds
	require outlets to match a route before processing child segments
	set initial blocking resource input synchronously on activation
	do not retain UrlTree instances in RouterLink

22.2.0

compiler

Commit	Description
	allow template to access private props
	do not encapsulate nested selectors if parent contains ::ng-deep
	scope nested CSS rules

compiler-cli

... (truncated)

Commits

• e9bf52a fix(router): require outlets to match a route before processing child segments
• 83abee3 Revert "fix(router): fall back when serializing protocol-relative URLs"
• 3b6796f fix(router): reject duplicate outlets in production builds
• a6e6097 fix(router): fall back when serializing protocol-relative URLs
• 2d68c17 refactor(core): use native Promise.withResolvers() in remaining test files
• 8b6dd5e fix(router): limit absolute redirects from redirect functions
• d23932f fix(router): set initial blocking resource input synchronously on activation
• 568d6a8 fix(router): do not copy URL-sized objects into every route snapshot
• 14793bf perf(router): do not retain UrlTree instances in RouterLink
• 83cb045 docs(router): fix UrlHandlingStrategy guide link
• Additional commits viewable in compare view

[numbers-official]

Automated Code Review (Heartbeat Deep Check)

Reviewed the diff: @angular/router bumped from ^22.1.6 → ^22.2.1 in root package.json + package-lock.json. No source code changes. This PR is the successor to the now-closed #3543 (which attempted 22.2.0).

Findings

• [Regression Risk] package.json / package-lock.json — Angular peer-dependency lockstep hazard. The new @angular/router@22.2.1 declares strict peer dependencies on @angular/common@22.2.1, @angular/core@22.2.1, and @angular/platform-browser@22.2.1. The repo keeps those three siblings at ^22.1.6, which resolves to 22.1.6 and will trip npm's strict peer-dep check. CI is already failing on lint, test, android, and Normalize npm lockfile; mergeStateStatus=BLOCKED.
• [Suggested fix] Group the router bump with matching bumps to @angular/common, @angular/core, @angular/platform-browser, and any other @angular/* package pinned at ^22.1.6, all moving to ^22.2.1 together — same remedy applied historically to #3543.

Summary

NOT safe to merge in its current form — the Angular router cannot ship ahead of its peer siblings. Needs the full @angular/* 22.2.1 cohort bumped together (or wait for Dependabot's patch-updates group to pick up the whole set). Human approver should close this PR until that happens, same handling as #3543. Still requires human approval before merge.