Update dependency @angular/common [SECURITY]#20
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
Conversation
renovate
Bot
force-pushed
the
renovate/npm-angular-common-vulnerability
branch
2 times, most recently
from
0bfefe0 to
75f7e97
Compare
renovate
Bot
force-pushed
the
renovate/npm-angular-common-vulnerability
branch
from
75f7e97 to
5d6b284
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-angular-common-vulnerability
branch
from
5d6b284 to
3dc6493
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^9.1.12→^9.1.12 || ^21.0.0~9.1.12→~19.2.0GitHub Vulnerability Alerts
CVE-2025-66035
The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain.
Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (
http://orhttps://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to theX-XSRF-TOKENheader.Impact
The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.
Attack Preconditions
POST) to a protocol-relative URL (e.g.,//attacker.com) that they control.Patches
Workarounds
Developers should avoid using protocol-relative URLs (URLs starting with
//) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single/) or fully qualified, trusted absolute URLs.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:NRelease Notes
angular/angular (@angular/common)
v21.2.8Compare Source
compiler
compiler-cli
core
language-service
v21.2.7Compare Source
compiler
compiler-cli
core
object[data]as resource URL context (#67797)localize
router
v21.2.6Compare Source
common
compiler
core
migrations
v21.2.5Compare Source
compiler
compiler-cli
core
migrations
service-worker
v21.2.4Compare Source
compiler
core
v21.2.3Compare Source
core
toString()representationv21.2.2Compare Source
compiler
compiler-cli
forms
v21.2.1Compare Source
core
http
v21.2.0Compare Source
common
compiler
instanceofbinary operatorAstVisitor.visitEmptyExpr()compiler-cli
core
forms
language-server
onDidChangeWatchedFileslanguage-service
router
canMatchparamsIsActiveMatchOptionsAPIs to accept a Partialv21.1.6Compare Source
Breaking Changes
core
Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.
(cherry picked from commit
306f367)common
compiler-cli
core
v21.1.5Compare Source
No user facing changes in this release
v21.1.4Compare Source
compiler
core
forms
http
v21.1.3Compare Source
core
linkedSignal.updateshould propagate errorsforms
localize
router
v21.1.2Compare Source
forms
language-service
router
v21.1.1Compare Source
compiler-cli
core
forms
v21.1.0Compare Source
Deprecations
upgrade
VERSIONfrom@angular/upgradeis deprecated. Please use the entry from@angular/upgrade/staticinstead.common
compiler
core
StaticProviderforprovidePlatformInitializerforms
platform-browser
contexttocreateApplicationcreateApplicationrouter
upgrade
VERSIONexportv21.0.9Compare Source
forms
migrations
v21.0.8Compare Source
core
v21.0.7Compare Source
compiler
compiler-cli
importsexpressionConfiguration
📅 Schedule: (in timezone Europe/Zurich)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.