This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-7287-7f3bba502a5b71ce129924d86784841ac56b170f in repository https://gitbox.apache.org/repos/asf/texera.git
commit 7f6402d01209ed50fa62ea169c45516bb39f2136 Author: Mend Renovate <[email protected]> AuthorDate: Mon Aug 3 21:39:30 2026 +0100 fix(deps, frontend): update dependency @angular/compiler to v21.2.19 (#7287) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@angular/compiler](https://redirect.github.com/angular/angular) ([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/compiler)) | [`21.2.18` → `21.2.19`](https://renovatebot.com/diffs/npm/@angular%2fcompiler/21.2.18/21.2.19) |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/6912) for more information. --- ### Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes [CVE-2026-69151](https://nvd.nist.gov/vuln/detail/CVE-2026-69151) / [GHSA-jj27-h5hq-8x99](https://redirect.github.com/advisories/GHSA-jj27-h5hq-8x99) <details> <summary>More information</summary> #### Details A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as `onclick` and `onerror` through standard attribute validation (`validateAttribute()` / `validateProperty()`), the i18n metadata collection path allowed these same attribute names to be marked for translation using `i18n-on*` attributes (e.g., `i18n-onerror`). When exploited, a lower-trust translation file could replace a benign static handler such as `onerror="void 0"` with arbitrary executable JavaScript in the localized build. The following example illustrates a vulnerable pattern: ```html <img src="foo.jpg" onerror="void 0" i18n-onerror /> ``` ##### Impact When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to: - **Session Hijacking**: Accessing session cookies, tokens, or sensitive user data. - **Unauthorized Actions**: Performing actions on behalf of the authenticated user. ##### Patched Versions - 22.0.1 - 21.2.19 - 20.3.27 ##### Workarounds Ensure that static event-handler attributes (e.g., `onerror`, `onclick`) are never marked for internationalization (`i18n-on*`) in application templates, and ensure translation files are sourced from trusted origins. #### Severity - CVSS Score: 7.6 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99](https://redirect.github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99) - [https://github.com/angular/angular/pull/68821](https://redirect.github.com/angular/angular/pull/68821) - [https://github.com/angular/angular/pull/69306](https://redirect.github.com/angular/angular/pull/69306) - [https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e](https://redirect.github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e) - [https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865](https://redirect.github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865) - [https://github.com/angular/angular](https://redirect.github.com/angular/angular) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jj27-h5hq-8x99) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>angular/angular (@​angular/compiler)</summary> ### [`v21.2.19`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21219-2026-07-29) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.18...v21.2.19) ##### compiler | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | -------------------------------------------------------------------------------- | | [e2660c3dee](https://redirect.github.com/angular/angular/commit/e2660c3deeccb86471f9c11b7e65ebcc89d84e9e) | fix | disallow i18n event attributes | | [7b884f585a](https://redirect.github.com/angular/angular/commit/7b884f585abf50480c271d234c892c141eb61e2c) | fix | restrict possible event handler check to property names longer than 2 characters | ##### http | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ------------------------------------------ | | [948a8d6831](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35) | fix | distinguish repeated transfer cache params | | [9949dccce1](https://redirect.github.com/angular/angular/commit/9949dccce164638597496a6b3881043117dfd1df) | fix | enable xsrf for root-provided HttpClient | ##### platform-server | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ------------------------------- | | [f34a93c946](https://redirect.github.com/angular/angular/commit/f34a93c946c017eff526cfb0c8d17f51e97f01e4) | fix | update domino to latest version | <!-- CHANGELOG SPLIT MARKER --> </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsInJlbGVhc2UvdjEuMiIsInNlY3VyaXR5Il19--> Co-authored-by: Xinyuan Lin <[email protected]> --- frontend/package.json | 2 +- frontend/yarn.lock | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/frontend/package.json b/frontend/package.json index 833d9499d5..cac1dba84c 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -25,7 +25,7 @@ "@angular/animations": "21.2.18", "@angular/cdk": "21.2.14", "@angular/common": "21.2.18", - "@angular/compiler": "21.2.18", + "@angular/compiler": "21.2.19", "@angular/core": "21.2.18", "@angular/forms": "21.2.18", "@angular/localize": "21.2.18", diff --git a/frontend/yarn.lock b/frontend/yarn.lock index fb872e498e..ab507fe6c9 100644 --- a/frontend/yarn.lock +++ b/frontend/yarn.lock @@ -981,12 +981,12 @@ __metadata: languageName: node linkType: hard -"@angular/compiler@npm:21.2.18": - version: 21.2.18 - resolution: "@angular/compiler@npm:21.2.18" +"@angular/compiler@npm:21.2.19": + version: 21.2.19 + resolution: "@angular/compiler@npm:21.2.19" dependencies: tslib: "npm:^2.3.0" - checksum: 10c0/1ab4b39e8eeac97544574e6987733a486ed7ee0a78d44ffed3ca6bdf23505300204315f8dd13e7150a104224f6f3b85869351b83d67df9ef7fcd96f5a82fef2b + checksum: 10c0/ae3993ed73a4731e1ccd84518fc20520273e6afd38cc040af0ef423c0b60d57fd4a72dbfb955009e6bb67a4119cd118d2fc82486e0b17924ce7f35ce0037da2f languageName: node linkType: hard @@ -10956,7 +10956,7 @@ __metadata: "@angular/cdk": "npm:21.2.14" "@angular/cli": "npm:21.2.19" "@angular/common": "npm:21.2.18" - "@angular/compiler": "npm:21.2.18" + "@angular/compiler": "npm:21.2.19" "@angular/compiler-cli": "npm:21.2.18" "@angular/core": "npm:21.2.18" "@angular/forms": "npm:21.2.18"
