You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@texera.apache.org by "renovate-bot (via GitHub)" <gi...@apache.org> on 2026/08/03 19:00:28 UTC
[PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
renovate-bot opened a new pull request, #7288:
URL: https://github.com/apache/texera/pull/7288
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@angular/core](https://redirect.github.com/angular/angular) ([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/core)) | [`21.2.18` → `21.2.19`](https://renovatebot.com/diffs/npm/@angular%2fcore/21.2.18/21.2.19) |  |  |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/6912) for more information.
---
### Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
[CVE-2026-69151](https://nvd.nist.gov/vuln/detail/CVE-2026-69151) / [GHSA-jj27-h5hq-8x99](https://redirect.github.com/advisories/GHSA-jj27-h5hq-8x99)
<details>
<summary>More information</summary>
#### Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as `onclick` and `onerror` through standard attribute validation (`validateAttribute()` / `validateProperty()`), the i18n metadata collection path allowed these same attribute names to be marked for translation using `i18n-on*` attributes (e.g., `i18n-onerror`).
When exploited, a lower-trust translation file could replace a benign static handler such as `onerror="void 0"` with arbitrary executable JavaScript in the localized build.
The following example illustrates a vulnerable pattern:
```html
<img src="foo.jpg" onerror="void 0" i18n-onerror />
```
##### Impact
When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to:
- **Session Hijacking**: Accessing session cookies, tokens, or sensitive user data.
- **Unauthorized Actions**: Performing actions on behalf of the authenticated user.
##### Patched Versions
- 22.0.1
- 21.2.19
- 20.3.27
##### Workarounds
Ensure that static event-handler attributes (e.g., `onerror`, `onclick`) are never marked for internationalization (`i18n-on*`) in application templates, and ensure translation files are sourced from trusted origins.
#### Severity
- CVSS Score: 7.6 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
#### References
- [https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99](https://redirect.github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99)
- [https://github.com/angular/angular/pull/68821](https://redirect.github.com/angular/angular/pull/68821)
- [https://github.com/angular/angular/pull/69306](https://redirect.github.com/angular/angular/pull/69306)
- [https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e](https://redirect.github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e)
- [https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865](https://redirect.github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865)
- [https://github.com/angular/angular](https://redirect.github.com/angular/angular)
This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jj27-h5hq-8x99) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>angular/angular (@​angular/core)</summary>
### [`v21.2.19`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21219-2026-07-29)
[Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.18...v21.2.19)
##### compiler
| Commit | Type | Description |
| ------------------------------------------------------------------------------------------------ | ---- | -------------------------------------------------------------------------------- |
| [e2660c3dee](https://redirect.github.com/angular/angular/commit/e2660c3deeccb86471f9c11b7e65ebcc89d84e9e) | fix | disallow i18n event attributes |
| [7b884f585a](https://redirect.github.com/angular/angular/commit/7b884f585abf50480c271d234c892c141eb61e2c) | fix | restrict possible event handler check to property names longer than 2 characters |
##### http
| Commit | Type | Description |
| ------------------------------------------------------------------------------------------------ | ---- | ------------------------------------------ |
| [948a8d6831](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35) | fix | distinguish repeated transfer cache params |
| [9949dccce1](https://redirect.github.com/angular/angular/commit/9949dccce164638597496a6b3881043117dfd1df) | fix | enable xsrf for root-provided HttpClient |
##### platform-server
| Commit | Type | Description |
| ------------------------------------------------------------------------------------------------ | ---- | ------------------------------- |
| [f34a93c946](https://redirect.github.com/angular/angular/commit/f34a93c946c017eff526cfb0c8d17f51e97f01e4) | fix | update domino to latest version |
<!-- CHANGELOG SPLIT MARKER -->
</details>
---
### Configuration
📅 **Schedule**: (in timezone Etc/UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsInJlbGVhc2UvdjEuMiIsInNlY3VyaXR5Il19-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
Posted by "aglinxinyuan (via GitHub)" <gi...@apache.org>.
aglinxinyuan commented on code in PR #7288:
URL: https://github.com/apache/texera/pull/7288#discussion_r3709882984
##########
frontend/LICENSE-binary:
##########
@@ -247,7 +247,7 @@ Angular / npm packages:
- @angular/animations@21.2.18
- @angular/cdk@21.2.14
- @angular/common@21.2.18
- - @angular/core@21.2.18
+ - @angular/core@21.2.19
- @angular/forms@21.2.18
Review Comment:
will address in seperate PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #7288:
URL: https://github.com/apache/texera/pull/7288#issuecomment-5170883328
<!-- backport-auto-label-report -->
### Backport auto-label report
This `fix:` PR was checked against each actively-supported release branch. `release/*` labels drive the post-merge backport, so add or remove one to change where this fix lands.
| Release branch | Analysis |
| --- | --- |
| ✅ `release/v1.2` | Already labeled — this fix is queued to backport here. |
_[Auto-label run](https://github.com/apache/texera/actions/runs/30843829928)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #7288:
URL: https://github.com/apache/texera/pull/7288#issuecomment-5171171272
### :warning: JUnit XML file not found
The CLI was unable to find any JUnit XML files to upload.
For more help, visit our [troubleshooting guide](https://docs.codecov.com/docs/test-analytics#troubleshooting).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
Posted by "forking-renovate[bot] (via GitHub)" <gi...@apache.org>.
forking-renovate[bot] commented on PR #7288:
URL: https://github.com/apache/texera/pull/7288#issuecomment-5171326514
### Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️ **Warning**: custom changes will be lost.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #7288:
URL: https://github.com/apache/texera/pull/7288#discussion_r3709723086
##########
frontend/package.json:
##########
@@ -26,7 +26,7 @@
"@angular/cdk": "21.2.14",
"@angular/common": "21.2.18",
"@angular/compiler": "21.2.19",
- "@angular/core": "21.2.18",
+ "@angular/core": "21.2.19",
Review Comment:
Angular framework packages are expected to be kept on the same patch version. With `@angular/core` now at 21.2.19 while @angular/common/@angular/forms/@angular/localize/etc remain at 21.2.18, the lockfile shows exact peer deps (e.g., @angular/common@21.2.18 peers on `@angular/core` 21.2.18), which will produce unmet peer dependency warnings and can lead to hard-to-debug runtime/compiler issues. Please bump the rest of the @angular/* framework packages to 21.2.19 in this block (keeping `@angular/cdk` as-is if intentional).
##########
frontend/LICENSE-binary:
##########
@@ -247,7 +247,7 @@ Angular / npm packages:
- @angular/animations@21.2.18
- @angular/cdk@21.2.14
- @angular/common@21.2.18
- - @angular/core@21.2.18
+ - @angular/core@21.2.19
- @angular/forms@21.2.18
Review Comment:
LICENSE-binary is now out of sync with the Angular patch-level updates that are required to keep Angular packages aligned. If the dependency set is updated to @angular/* 21.2.19 (recommended to satisfy exact peer deps), please update the corresponding Angular entries here as well (animations/common/forms/platform-browser/router).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #7288:
URL: https://github.com/apache/texera/pull/7288#issuecomment-5175351583
Backport PR opened: draft #7307 (https://github.com/apache/texera/pull/7307) to `release/v1.2`, assigned to @renovate-bot — needs manual work because the cherry-pick conflicts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
Posted by "aglinxinyuan (via GitHub)" <gi...@apache.org>.
aglinxinyuan merged PR #7288:
URL: https://github.com/apache/texera/pull/7288
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
Posted by "aglinxinyuan (via GitHub)" <gi...@apache.org>.
aglinxinyuan commented on code in PR #7288:
URL: https://github.com/apache/texera/pull/7288#discussion_r3709881827
##########
frontend/package.json:
##########
@@ -26,7 +26,7 @@
"@angular/cdk": "21.2.14",
"@angular/common": "21.2.18",
"@angular/compiler": "21.2.19",
- "@angular/core": "21.2.18",
+ "@angular/core": "21.2.19",
Review Comment:
will address in seperate PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/core to v21.2.19 [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #7288:
URL: https://github.com/apache/texera/pull/7288#issuecomment-5170880433
<!-- texera-reviewer-suggestion -->
### Automated Reviewer Suggestions
Based on the `git blame` history of the changed files, we recommend the following reviewers:
- **Contributors with relevant context:** `@gupta-sahil01`
You can notify them by mentioning `@gupta-sahil01` in a comment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org