fix(deps, frontend, v1.2): update dependency @angular/core to v21.2.20 - #8584
Draft
github-actions[bot] wants to merge 1 commit into
Draft
github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@angular/core](https://redirect.github.com/angular/angular) ([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/core)) | [`21.2.19` → `21.2.20`](https://renovatebot.com/diffs/npm/@angular%2fcore/21.2.19/21.2.20) |  |  | --- ### Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler [CVE-2026-88057](https://nvd.nist.gov/vuln/detail/CVE-2026-88057) / [GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/advisories/GHSA-hh8m-fm6v-7cvg) <details> <summary>More information</summary> #### Details Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as `href`, `src`, `action`, `xlink:href`, and `data`) to protect against Cross-Site Scripting (XSS). Prior to the fix, the Angular compiler determined the `SecurityContext` for directive host bindings (`host: {'[attr.href]': 'value'}` or `@HostBinding('attr.href')`) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to. When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through: - `hostDirectives` composition, - Class inheritance of host bindings, - Dynamic component instantiation (`createComponent` with custom `hostElement` or dynamic directives), - Elements with SVG/MathML namespaces (e.g. `<svg:a>`, `<math>`), or - Elements using tag-neutral selectors (e.g. `:not(...)`), the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. `javascript:...` URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer. ##### Impact An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting). ##### Patches This issue has been resolved in versions: - `22.1.0` - `21.2.20` - `20.3.28` ##### Workarounds Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using `DomSanitizer.sanitize(SecurityContext.URL, ...)` before assignment, or restrict the input to validated safe URL schemes (e.g. `http://`, `https://`). #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N` #### References - [https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg) - [https://github.com/angular/angular/issues/69550](https://redirect.github.com/angular/angular/issues/69550) - [https://github.com/angular/angular/pull/69558](https://redirect.github.com/angular/angular/pull/69558) - [https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264](https://redirect.github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264) - [https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee](https://redirect.github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee) - [https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b](https://redirect.github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b) - [https://github.com/angular/angular/releases/tag/v20.3.28](https://redirect.github.com/angular/angular/releases/tag/v20.3.28) - [https://github.com/angular/angular/releases/tag/v21.2.20](https://redirect.github.com/angular/angular/releases/tag/v21.2.20) - [https://github.com/angular/angular/releases/tag/v22.1.0](https://redirect.github.com/angular/angular/releases/tag/v22.1.0) - [https://github.com/advisories/GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/advisories/GHSA-hh8m-fm6v-7cvg) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-hh8m-fm6v-7cvg) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler [CVE-2026-88057](https://nvd.nist.gov/vuln/detail/CVE-2026-88057) / [GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/advisories/GHSA-hh8m-fm6v-7cvg) <details> <summary>More information</summary> #### Details Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as `href`, `src`, `action`, `xlink:href`, and `data`) to protect against Cross-Site Scripting (XSS). Prior to the fix, the Angular compiler determined the `SecurityContext` for directive host bindings (`host: {'[attr.href]': 'value'}` or `@HostBinding('attr.href')`) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to. When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through: - `hostDirectives` composition, - Class inheritance of host bindings, - Dynamic component instantiation (`createComponent` with custom `hostElement` or dynamic directives), - Elements with SVG/MathML namespaces (e.g. `<svg:a>`, `<math>`), or - Elements using tag-neutral selectors (e.g. `:not(...)`), the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. `javascript:...` URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer. ##### Impact An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting). ##### Patches This issue has been resolved in versions: - `22.1.0` - `21.2.20` - `20.3.28` ##### Workarounds Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using `DomSanitizer.sanitize(SecurityContext.URL, ...)` before assignment, or restrict the input to validated safe URL schemes (e.g. `http://`, `https://`). #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N` #### References - [https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg) - [https://github.com/angular/angular/issues/69550](https://redirect.github.com/angular/angular/issues/69550) - [https://github.com/angular/angular/pull/69558](https://redirect.github.com/angular/angular/pull/69558) - [https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264](https://redirect.github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264) - [https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee](https://redirect.github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee) - [https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b](https://redirect.github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b) - [https://github.com/angular/angular](https://redirect.github.com/angular/angular) - [https://github.com/angular/angular/releases/tag/v20.3.28](https://redirect.github.com/angular/angular/releases/tag/v20.3.28) - [https://github.com/angular/angular/releases/tag/v21.2.20](https://redirect.github.com/angular/angular/releases/tag/v21.2.20) - [https://github.com/angular/angular/releases/tag/v22.1.0](https://redirect.github.com/angular/angular/releases/tag/v22.1.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-hh8m-fm6v-7cvg) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>angular/angular (@​angular/core)</summary> ### [`v21.2.20`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21220-2026-08-12) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.19...v21.2.20) ##### core | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ---------------------------------------- | | [6afe6fa781](https://redirect.github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee) | fix | sanitize host bindings on concrete hosts | ##### http | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | --------------------------------------------------- | | [fec5977df4](https://redirect.github.com/angular/angular/commit/fec5977df4dda3a10d5ce2923e3e06d86ba11ee7) | fix | match header values exactly when deleting | | [e33d69a71c](https://redirect.github.com/angular/angular/commit/e33d69a71c5beb8fe5785b53fd6b37658334e8e0) | fix | preserve immutability of materialized clones | | [caf616670f](https://redirect.github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d) | fix | run root interceptors in the terminal request chain | <!-- CHANGELOG SPLIT MARKER --> </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwicmVsZWFzZS92MS4yIiwic2VjdXJpdHkiXX0=--> --------- (backported from commit 8284b42) Co-authored-by: mengw15 <125719918+mengw15@users.noreply.github.com> Co-authored-by: Xuan Gu <162244362+xuang7@users.noreply.github.com>
Contributor
Author
|
The cherry-pick conflicted and was committed with conflict markers. Resolve the conflicts on this branch, then mark this PR ready for review. Conflicting files:
|
1 task
Contributor
This was referenced Sep 21, 2026
renovate-bot
pushed a commit
to renovate-bot/apache-_-texera
that referenced
this pull request
Sep 21, 2026
…pache#8626) ### What changes were proposed in this PR? `Direct Backport Push` cherry-picks a cleanly-applying fix onto the release branch and pushes it. Every one of those pushes has been rejected since 2026-07-24: `release/*` is covered by the Merge Queue ruleset, which requires a pull request of everyone. apache#8379 tried to exempt the Actions app from it; GitHub refuses to create that bypass, and apache#8624 reverts it. ASF policy points the same way — an automated service must not push to a branch subject to official release without prior authorization from Infrastructure. Both outcomes now open a pull request. The conflicted one is unchanged: a draft, assigned to its author. A clean one opens **ready for review and assigned to nobody**, because there is no code for anyone to write on it. What a clean backport still needs is its checks started, and that is the part worth stating plainly. GitHub creates no workflow run for anything `GITHUB_TOKEN` does, so a bot-opened pull request has none — and nothing will arrive on its own: | action on a pull request with no checks | starts the three required contexts | | --- | --- | | push any commit to the branch | yes (`synchronize`) | | close and reopen it | yes (`reopened`) | | mark it ready for review | **no** — none of the three workflows listens for `ready_for_review` | | add or remove a label | only `Required Checks` | | "Re-run all jobs" | no — with no run there is nothing to re-run | A conflicted backport never had this problem: its author pushes a resolution, and that push brings CI with it. A clean one has nobody to push anything. So the comment the conflict path already posts for its instructions now says, for a clean backport, the one action that works — and says that marking it ready for review is not it. That leaves the release manager three ordinary buttons: reopen, approve, and auto-merge if they would rather not come back when the checks finish. The approval is not automated and should not be: the `release/*` label on the original PR records the decision, and this is the look at the tree that actually lands. Nothing here depends on a token's pull-request scope, on an Actions bypass, or on a close/reopen the workflow performs itself. Those are the paths that can only be proven in production, and that fail quietly when they are wrong — which is how apache#8432, apache#8494 and apache#8562 were lost. `push_entries` is now always empty, leaving `push-backports` unreachable. Removing it is left to a separate change, so that this one is a behaviour change and that one is a pure deletion. ### Any related issues, documentation, discussions? Closes apache#8377. apache#8378 proposed the same routing with the workflow performing the close/reopen itself and arming auto-merge; this drops both in favour of the release manager's own click, and is closed in favour of this. ### How was this PR tested? The routing was driven locally against a stubbed `github-script` environment. With the pre-merge preflight green, both targets come out as pull-request entries carrying `clean: "true"` and `push_entries` empty; with it neutral, `clean: "false"`; with no completed signal, neither target is acted on, as before. Restoring the old `pushEntries.push` turns that check red, so it is not vacuous. The workflow parses, and all four inline `github-script` bodies pass `node --check`. That a bot-opened pull request starts with no checks is what this repository already shows: apache#8584 — bot-opened, one commit, nobody pushed to it — carries no check runs at all, while apache#8553, opened the same way, has the full set after a commit was pushed. That `ready_for_review` does not start them is in the triggers: `required-checks.yml` lists `opened`/`reopened`/`synchronize`/`labeled`/`unlabeled`, `check-header.yml` takes the bare `pull_request:` defaults, and `lint-pr.yml` lists `opened`/`edited`/`reopened`/`synchronize`. Not provable before merge: that a human reopen produces the three contexts on a backport PR. apache#8619 to apache#8623 — five backports into `release/v1.3` opened by hand this week — show that the contexts do appear and pass on a pull request into a release branch; the reopen path shares everything with them but the event that starts the run. ### Was this PR authored or co-authored using generative AI tooling? Yes. Generated-by: Claude Code (claude-opus-5)
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this PR?
Automated backport of #8494 to
release/v1.2.Source: 8284b42 · automation run
Any related issues, documentation, discussions?
Backport of #8494. Fixes CVE-2026-88057 (see #8494 for details).
How was this PR tested?
Release-branch CI runs on this branch once the conflicts are resolved and this PR is marked ready for review.
Was this PR authored or co-authored using generative AI tooling?
No.