From bab73f27073997a3510f60a517c683d57904e4bd Mon Sep 17 00:00:00 2001 From: Mend Renovate Date: Fri, 18 Sep 2026 01:04:12 +0000 Subject: [PATCH] fix(deps, frontend): update dependency @angular/core to v21.2.20 (#8494) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@angular/core](https://redirect.github.com/angular/angular) ([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/core)) | [`21.2.19` → `21.2.20`](https://renovatebot.com/diffs/npm/@angular%2fcore/21.2.19/21.2.20) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@angular%2fcore/21.2.20?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@angular%2fcore/21.2.19/21.2.20?slim=true) | --- ### Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler [CVE-2026-88057](https://nvd.nist.gov/vuln/detail/CVE-2026-88057) / [GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/advisories/GHSA-hh8m-fm6v-7cvg)
More information #### Details Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as `href`, `src`, `action`, `xlink:href`, and `data`) to protect against Cross-Site Scripting (XSS). Prior to the fix, the Angular compiler determined the `SecurityContext` for directive host bindings (`host: {'[attr.href]': 'value'}` or `@HostBinding('attr.href')`) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to. When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through: - `hostDirectives` composition, - Class inheritance of host bindings, - Dynamic component instantiation (`createComponent` with custom `hostElement` or dynamic directives), - Elements with SVG/MathML namespaces (e.g. ``, ``), or - Elements using tag-neutral selectors (e.g. `:not(...)`), the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. `javascript:...` URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer. ##### Impact An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting). ##### Patches This issue has been resolved in versions: - `22.1.0` - `21.2.20` - `20.3.28` ##### Workarounds Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using `DomSanitizer.sanitize(SecurityContext.URL, ...)` before assignment, or restrict the input to validated safe URL schemes (e.g. `http://`, `https://`). #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N` #### References - [https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg) - [https://github.com/angular/angular/issues/69550](https://redirect.github.com/angular/angular/issues/69550) - [https://github.com/angular/angular/pull/69558](https://redirect.github.com/angular/angular/pull/69558) - [https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264](https://redirect.github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264) - [https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee](https://redirect.github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee) - [https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b](https://redirect.github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b) - [https://github.com/angular/angular/releases/tag/v20.3.28](https://redirect.github.com/angular/angular/releases/tag/v20.3.28) - [https://github.com/angular/angular/releases/tag/v21.2.20](https://redirect.github.com/angular/angular/releases/tag/v21.2.20) - [https://github.com/angular/angular/releases/tag/v22.1.0](https://redirect.github.com/angular/angular/releases/tag/v22.1.0) - [https://github.com/advisories/GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/advisories/GHSA-hh8m-fm6v-7cvg) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-hh8m-fm6v-7cvg) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
--- ### Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler [CVE-2026-88057](https://nvd.nist.gov/vuln/detail/CVE-2026-88057) / [GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/advisories/GHSA-hh8m-fm6v-7cvg)
More information #### Details Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as `href`, `src`, `action`, `xlink:href`, and `data`) to protect against Cross-Site Scripting (XSS). Prior to the fix, the Angular compiler determined the `SecurityContext` for directive host bindings (`host: {'[attr.href]': 'value'}` or `@HostBinding('attr.href')`) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to. When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through: - `hostDirectives` composition, - Class inheritance of host bindings, - Dynamic component instantiation (`createComponent` with custom `hostElement` or dynamic directives), - Elements with SVG/MathML namespaces (e.g. ``, ``), or - Elements using tag-neutral selectors (e.g. `:not(...)`), the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. `javascript:...` URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer. ##### Impact An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting). ##### Patches This issue has been resolved in versions: - `22.1.0` - `21.2.20` - `20.3.28` ##### Workarounds Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using `DomSanitizer.sanitize(SecurityContext.URL, ...)` before assignment, or restrict the input to validated safe URL schemes (e.g. `http://`, `https://`). #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N` #### References - [https://github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg](https://redirect.github.com/angular/angular/security/advisories/GHSA-hh8m-fm6v-7cvg) - [https://github.com/angular/angular/issues/69550](https://redirect.github.com/angular/angular/issues/69550) - [https://github.com/angular/angular/pull/69558](https://redirect.github.com/angular/angular/pull/69558) - [https://github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264](https://redirect.github.com/angular/angular/commit/2f96c8020f85ccb715a76de4b79a0c680c2c7264) - [https://github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee](https://redirect.github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee) - [https://github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b](https://redirect.github.com/angular/angular/commit/6caa298dee58319b2d674dc91364e26ffe3ecb2b) - [https://github.com/angular/angular](https://redirect.github.com/angular/angular) - [https://github.com/angular/angular/releases/tag/v20.3.28](https://redirect.github.com/angular/angular/releases/tag/v20.3.28) - [https://github.com/angular/angular/releases/tag/v21.2.20](https://redirect.github.com/angular/angular/releases/tag/v21.2.20) - [https://github.com/angular/angular/releases/tag/v22.1.0](https://redirect.github.com/angular/angular/releases/tag/v22.1.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-hh8m-fm6v-7cvg) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
--- ### Release Notes
angular/angular (@​angular/core) ### [`v21.2.20`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21220-2026-08-12) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.19...v21.2.20) ##### core | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ---------------------------------------- | | [6afe6fa781](https://redirect.github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee) | fix | sanitize host bindings on concrete hosts | ##### http | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | --------------------------------------------------- | | [fec5977df4](https://redirect.github.com/angular/angular/commit/fec5977df4dda3a10d5ce2923e3e06d86ba11ee7) | fix | match header values exactly when deleting | | [e33d69a71c](https://redirect.github.com/angular/angular/commit/e33d69a71c5beb8fe5785b53fd6b37658334e8e0) | fix | preserve immutability of materialized clones | | [caf616670f](https://redirect.github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d) | fix | run root interceptors in the terminal request chain |
--- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera). --------- (backported from commit 8284b4280c4cd988a4b072900fb7dca7b89cf56b) Co-authored-by: mengw15 <125719918+mengw15@users.noreply.github.com> Co-authored-by: Xuan Gu <162244362+xuang7@users.noreply.github.com> --- frontend/LICENSE-binary | 7 +++++++ frontend/package.json | 9 +++++++++ frontend/yarn.lock | 20 +++++++++++++++----- 3 files changed, 31 insertions(+), 5 deletions(-) diff --git a/frontend/LICENSE-binary b/frontend/LICENSE-binary index 588e083566c..2e4a9fa2e7c 100644 --- a/frontend/LICENSE-binary +++ b/frontend/LICENSE-binary @@ -238,10 +238,17 @@ Angular / npm packages: - @angular/animations@21.2.17 - @angular/cdk@21.2.14 - @angular/common@21.2.19 +<<<<<<< HEAD - @angular/core@21.2.19 - @angular/forms@21.2.17 - @angular/platform-browser@21.2.17 - @angular/router@21.2.17 +======= + - @angular/core@21.2.20 + - @angular/forms@21.2.18 + - @angular/platform-browser@21.2.18 + - @angular/router@21.2.18 +>>>>>>> 8284b4280 (fix(deps, frontend): update dependency @angular/core to v21.2.20 (#8494)) - @ant-design/colors@7.2.1 - @ant-design/fast-color@2.0.6 - @ant-design/icons-angular@21.0.0 diff --git a/frontend/package.json b/frontend/package.json index bdab27e6c14..0e40cf6e097 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -27,12 +27,21 @@ "@angular/cdk": "21.2.14", "@angular/common": "21.2.19", "@angular/compiler": "21.2.19", +<<<<<<< HEAD "@angular/core": "21.2.19", "@angular/forms": "21.2.17", "@angular/localize": "21.2.17", "@angular/platform-browser": "21.2.17", "@angular/platform-browser-dynamic": "21.2.17", "@angular/router": "21.2.17", +======= + "@angular/core": "21.2.20", + "@angular/forms": "21.2.18", + "@angular/localize": "21.2.18", + "@angular/platform-browser": "21.2.18", + "@angular/platform-browser-dynamic": "21.2.18", + "@angular/router": "21.2.18", +>>>>>>> 8284b4280 (fix(deps, frontend): update dependency @angular/core to v21.2.20 (#8494)) "@auth0/angular-jwt": "5.1.0", "@codingame/monaco-vscode-java-default-extension": "8.0.4", "@codingame/monaco-vscode-python-default-extension": "8.0.4", diff --git a/frontend/yarn.lock b/frontend/yarn.lock index c499550187a..a9c5f1d82c7 100644 --- a/frontend/yarn.lock +++ b/frontend/yarn.lock @@ -732,13 +732,13 @@ __metadata: languageName: node linkType: hard -"@angular/core@npm:21.2.19": - version: 21.2.19 - resolution: "@angular/core@npm:21.2.19" +"@angular/core@npm:21.2.20": + version: 21.2.20 + resolution: "@angular/core@npm:21.2.20" dependencies: tslib: "npm:^2.3.0" peerDependencies: - "@angular/compiler": 21.2.19 + "@angular/compiler": 21.2.20 rxjs: ^6.5.3 || ^7.4.0 zone.js: ~0.15.0 || ~0.16.0 peerDependenciesMeta: @@ -746,7 +746,7 @@ __metadata: optional: true zone.js: optional: true - checksum: 10c0/a060ee271acb93b5a633e5ab66bdf8fc6d13d17782b25d381ec51c5d664778de740d661b17ea36175a15d286422ad96760c1c0accf8b44a1ad6175d38869a7fd + checksum: 10c0/8827cc0b8a8cc1beebed43244fce103259776dfe68dd0755d04bcd7fc2b76e1eecdfdad33798dfeb4a5825f93746525f2901e9aa1a401d27e7a4189db5fd4a54 languageName: node linkType: hard @@ -10609,6 +10609,7 @@ __metadata: "@angular/cli": "npm:21.2.18" "@angular/common": "npm:21.2.19" "@angular/compiler": "npm:21.2.19" +<<<<<<< HEAD "@angular/compiler-cli": "npm:21.2.17" "@angular/core": "npm:21.2.19" "@angular/forms": "npm:21.2.17" @@ -10616,6 +10617,15 @@ __metadata: "@angular/platform-browser": "npm:21.2.17" "@angular/platform-browser-dynamic": "npm:21.2.17" "@angular/router": "npm:21.2.17" +======= + "@angular/compiler-cli": "npm:21.2.18" + "@angular/core": "npm:21.2.20" + "@angular/forms": "npm:21.2.18" + "@angular/localize": "npm:21.2.18" + "@angular/platform-browser": "npm:21.2.18" + "@angular/platform-browser-dynamic": "npm:21.2.18" + "@angular/router": "npm:21.2.18" +>>>>>>> 8284b4280 (fix(deps, frontend): update dependency @angular/core to v21.2.20 (#8494)) "@auth0/angular-jwt": "npm:5.1.0" "@codingame/monaco-vscode-java-default-extension": "npm:8.0.4" "@codingame/monaco-vscode-python-default-extension": "npm:8.0.4"