This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/texera.git
The following commit(s) were added to refs/heads/main by this push:
new f51a8a91b1 fix(deps, frontend): update dependency @angular/core to
v21.2.19 (#7288)
f51a8a91b1 is described below
commit f51a8a91b1b25bf2bb2bdab3e69d27d0bae7bd45
Author: Mend Renovate <[email protected]>
AuthorDate: Tue Aug 4 07:08:36 2026 +0100
fix(deps, frontend): update dependency @angular/core to v21.2.19 (#7288)
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@angular/core](https://redirect.github.com/angular/angular)
([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/core))
| [`21.2.18` →
`21.2.19`](https://renovatebot.com/diffs/npm/@angular%2fcore/21.2.18/21.2.19)
|
|
|
---
> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/6912) for more information.
---
### Angular i18n: Cross-Site Scripting (XSS) via event-handler
attributes
[CVE-2026-69151](https://nvd.nist.gov/vuln/detail/CVE-2026-69151) /
[GHSA-jj27-h5hq-8x99](https://redirect.github.com/advisories/GHSA-jj27-h5hq-8x99)
<details>
<summary>More information</summary>
#### Details
A Cross-Site Scripting (XSS) vulnerability has been identified in the
Angular compiler's internationalization (i18n) pipeline. Although
Angular disallows binding to event-handler attributes such as `onclick`
and `onerror` through standard attribute validation
(`validateAttribute()` / `validateProperty()`), the i18n metadata
collection path allowed these same attribute names to be marked for
translation using `i18n-on*` attributes (e.g., `i18n-onerror`).
When exploited, a lower-trust translation file could replace a benign
static handler such as `onerror="void 0"` with arbitrary executable
JavaScript in the localized build.
The following example illustrates a vulnerable pattern:
```html
<img src="foo.jpg" onerror="void 0" i18n-onerror />
```
##### Impact
When exploited, this vulnerability allows arbitrary JavaScript execution
within the context of the vulnerable application's domain if an attacker
can control or influence the translation files used during localization.
This can lead to:
- **Session Hijacking**: Accessing session cookies, tokens, or sensitive
user data.
- **Unauthorized Actions**: Performing actions on behalf of the
authenticated user.
##### Patched Versions
- 22.0.1
- 21.2.19
- 20.3.27
##### Workarounds
Ensure that static event-handler attributes (e.g., `onerror`, `onclick`)
are never marked for internationalization (`i18n-on*`) in application
templates, and ensure translation files are sourced from trusted
origins.
#### Severity
- CVSS Score: 7.6 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
#### References
-
[https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99](https://redirect.github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99)
-
[https://github.com/angular/angular/pull/68821](https://redirect.github.com/angular/angular/pull/68821)
-
[https://github.com/angular/angular/pull/69306](https://redirect.github.com/angular/angular/pull/69306)
-
[https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e](https://redirect.github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e)
-
[https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865](https://redirect.github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865)
-
[https://github.com/angular/angular](https://redirect.github.com/angular/angular)
This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-jj27-h5hq-8x99) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>angular/angular (@​angular/core)</summary>
###
[`v21.2.19`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21219-2026-07-29)
[Compare
Source](https://redirect.github.com/angular/angular/compare/v21.2.18...v21.2.19)
##### compiler
| Commit | Type | Description |
|
------------------------------------------------------------------------------------------------
| ---- |
--------------------------------------------------------------------------------
|
|
[e2660c3dee](https://redirect.github.com/angular/angular/commit/e2660c3deeccb86471f9c11b7e65ebcc89d84e9e)
| fix | disallow i18n event attributes |
|
[7b884f585a](https://redirect.github.com/angular/angular/commit/7b884f585abf50480c271d234c892c141eb61e2c)
| fix | restrict possible event handler check to property names longer
than 2 characters |
##### http
| Commit | Type | Description |
|
------------------------------------------------------------------------------------------------
| ---- | ------------------------------------------ |
|
[948a8d6831](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35)
| fix | distinguish repeated transfer cache params |
|
[9949dccce1](https://redirect.github.com/angular/angular/commit/9949dccce164638597496a6b3881043117dfd1df)
| fix | enable xsrf for root-provided HttpClient |
##### platform-server
| Commit | Type | Description |
|
------------------------------------------------------------------------------------------------
| ---- | ------------------------------- |
|
[f34a93c946](https://redirect.github.com/angular/angular/commit/f34a93c946c017eff526cfb0c8d17f51e97f01e4)
| fix | update domino to latest version |
<!-- CHANGELOG SPLIT MARKER -->
</details>
---
### Configuration
📅 **Schedule**: (in timezone Etc/UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/apache/texera).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsInJlbGVhc2UvdjEuMiIsInNlY3VyaXR5Il19-->
---------
Co-authored-by: Xinyuan Lin <[email protected]>
---
frontend/LICENSE-binary | 2 +-
frontend/package.json | 2 +-
frontend/yarn.lock | 12 ++++++------
3 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/frontend/LICENSE-binary b/frontend/LICENSE-binary
index 59a2701336..29c0c4881b 100644
--- a/frontend/LICENSE-binary
+++ b/frontend/LICENSE-binary
@@ -247,7 +247,7 @@ Angular / npm packages:
- @angular/[email protected]
- @angular/[email protected]
- @angular/[email protected]
- - @angular/[email protected]
+ - @angular/[email protected]
- @angular/[email protected]
- @angular/[email protected]
- @angular/[email protected]
diff --git a/frontend/package.json b/frontend/package.json
index cac1dba84c..cb629ad472 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -26,7 +26,7 @@
"@angular/cdk": "21.2.14",
"@angular/common": "21.2.18",
"@angular/compiler": "21.2.19",
- "@angular/core": "21.2.18",
+ "@angular/core": "21.2.19",
"@angular/forms": "21.2.18",
"@angular/localize": "21.2.18",
"@angular/platform-browser": "21.2.18",
diff --git a/frontend/yarn.lock b/frontend/yarn.lock
index ab507fe6c9..930132024c 100644
--- a/frontend/yarn.lock
+++ b/frontend/yarn.lock
@@ -990,13 +990,13 @@ __metadata:
languageName: node
linkType: hard
-"@angular/core@npm:21.2.18":
- version: 21.2.18
- resolution: "@angular/core@npm:21.2.18"
+"@angular/core@npm:21.2.19":
+ version: 21.2.19
+ resolution: "@angular/core@npm:21.2.19"
dependencies:
tslib: "npm:^2.3.0"
peerDependencies:
- "@angular/compiler": 21.2.18
+ "@angular/compiler": 21.2.19
rxjs: ^6.5.3 || ^7.4.0
zone.js: ~0.15.0 || ~0.16.0
peerDependenciesMeta:
@@ -1004,7 +1004,7 @@ __metadata:
optional: true
zone.js:
optional: true
- checksum:
10c0/863c238159b4999f6fa516243641a7418c1d2252ea693401d1a46a0caf9c40f8e6eef6e73974f6ad8579618925c143af7d01735c740c038094dae8f20b2c6f44
+ checksum:
10c0/a060ee271acb93b5a633e5ab66bdf8fc6d13d17782b25d381ec51c5d664778de740d661b17ea36175a15d286422ad96760c1c0accf8b44a1ad6175d38869a7fd
languageName: node
linkType: hard
@@ -10958,7 +10958,7 @@ __metadata:
"@angular/common": "npm:21.2.18"
"@angular/compiler": "npm:21.2.19"
"@angular/compiler-cli": "npm:21.2.18"
- "@angular/core": "npm:21.2.18"
+ "@angular/core": "npm:21.2.19"
"@angular/forms": "npm:21.2.18"
"@angular/localize": "npm:21.2.18"
"@angular/platform-browser": "npm:21.2.18"
