fix(deps): update dependency @angular/core to v19 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/core (source)	~18.2.0 → ~19.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Angular vulnerable to XSS in i18n attribute bindings

CVE-2026-32635 / GHSA-g93w-mfhg-p222

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.

The following example illustrates the issue:

<a href="" i18n-href>Click me</a>

The following attributes have been confirmed to be vulnerable:

• action
• background
• cite
• codebase
• data
• formaction
• href
• itemtype
• longdesc
• poster
• src
• xlink:href

Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

• Session Hijacking: Stealing session cookies and authentication tokens.
• Data Exfiltration: Capturing and transmitting sensitive user data.
• Unauthorized Actions: Performing actions on behalf of the user.

Attack Preconditions

1. The application must use a vulnerable version of Angular.
2. The application must bind unsanitized user input to one of the attributes mentioned above.
3. The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.

Patches

• 22.0.0-next.3
• 21.2.4
• 20.3.18
• 19.2.20

Workarounds

The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.

Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:

import {Component, inject, SecurityContext} from '@​angular/core';
import {DomSanitizer} from '@​angular/platform-browser';

@​Component({
  template: `
    <form action="" i18n-action>
      <button>Submit</button>
    </form>
  `,
})
export class App {
  url: string;

  constructor() {
    const dangerousUrl = 'javascript:alert(1)';
    const sanitizer = inject(DomSanitizer);
    this.url = sanitizer.sanitize(SecurityContext.URL, dangerousUrl) || '';
  }
}

References

• Fix 1
• Fix 2

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222
• https://nvd.nist.gov/vuln/detail/CVE-2026-32635
• https://github.com/angular/angular/pull/67541
• https://github.com/angular/angular/pull/67561
• https://github.com/angular/angular/commit/224e60ecb1b90115baa702f1c06edc1d64d86187
• https://github.com/angular/angular/commit/78dea55351fb305b33a919c43a6b363137eca166
• https://github.com/angular/angular/commit/8630319f74c9575a21693d875cc7d5252516146d
• https://github.com/angular/angular/commit/ed2d324f9cc12aab6cfa0569ef10b73243a62c65
• https://github.com/angular/angular

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.

In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.

When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.

Impact

When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:

• Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
• Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
• Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.

Attack Preconditions

1. The victim application must explicitly use SVG <script> elements within its templates.
2. The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
3. The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).

Patches

• 19.2.18
• 20.3.16
• 21.0.7
• 21.1.0-rc.0

Workarounds

Until the patch is applied, developers should:

• Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
• Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.

Resources

• https://github.com/angular/angular/pull/66318

Severity

• CVSS Score: 8.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-jrmj-c5cx-3cw6
• https://nvd.nist.gov/vuln/detail/CVE-2026-22610
• https://github.com/angular/angular/pull/66318
• https://github.com/angular/angular/commit/91dc91bae4a1bbefc58bef6ef739d0e02ab44d56
• https://github.com/angular/angular

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Angular i18n vulnerable to Cross-Site Scripting

CVE-2026-27970 / GHSA-prjf-86w9-mfqv

More information

Details

A Cross-site Scripting (XSS) vulnerability has been identified in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript.

Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user.

If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript.

Impact

When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to:

• Credential Exfiltration: Stealing sensitive user data stored in page memory, LocalStorage, IndexedDB, or cookies available to JS and sending them to an attacker controlled server.
• Page Vandalism: Mutating the page to read or act differently than intended by the developer.

Attach Preconditions

• The attacker must compromise the translation file (xliff, xtb, etc.).
• Unlike most XSS vulnerabilities, this one is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client.
• The victim application must use Angular i18n.
• The victim application must use one or more ICU messages.
• The victim application must render an ICU message.
• The victim application must not defend against XSS via a safe Content-Security Policy (CSP) or Trusted Types.

Patches

• 21.2.0
• 21.1.6
• 20.3.17
• 19.2.19

Workarounds

Until the patch is applied, developers should consider:

• Reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application.
• Enabling strict CSP controls to block unauthorized JavaScript from executing on the page.
• Enabling Trusted Types to enforce proper HTML sanitization.

References

• Fix

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv
• https://nvd.nist.gov/vuln/detail/CVE-2026-27970
• https://github.com/angular/angular/pull/67183
• https://github.com/angular/angular/commit/306f367899dfc2e04238fecd3455547b5d54075d
• https://github.com/angular/angular/commit/7d58b798c626bb0e4e5f89ca8affdce4f352b232
• https://github.com/angular/angular/commit/b85830953281ff3a1a77bbfe69019d352d509c93
• https://angular.dev/best-practices/security#enforcing-trusted-types
• https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
• https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS
• https://github.com/angular/angular

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/core)

v19.0.0

Compare Source

Blog post: https://blog.angular.dev/meet-angular-v19-7b29dfd05b84

Breaking Changes

compiler

• this.foo property reads no longer refer to template context variables. If you intended to read the template variable, do not use this..
• changes to CSS selectors parsing where introduced, mainly to: pseudo selectors :where() and :is(),
  parsing of :host and host-context, parsing selectors within pseudo selector arguments (for instance comma separated selectors).
  These changes could lead to a different specificity of the resulting selectors and/or previously broken selectors being applied now,
  for example :where(:host) used to transform to :where()[ng-host] and is being :where([ng-host]) now. Unlike the previous outcome,
  the new result can target elements and therefore could lead to breakages.

core

• Angular directives, components and pipes are now standalone by default.

  • Specify standalone: false for declarations that are currently declared in @NgModules.
  • ng update for v19 will take care of this automatically.

• TypeScript versions less than 5.5 are no longer supported.

• Timing changes for effect API (in developer preview):

  • effects which are triggered outside of change detection run as part of
    the change detection process instead of as a microtask. Depending on the
    specifics of application/test setup, this can result in them executing
    earlier or later (or requiring additional test steps to trigger; see below
    examples).

  • effects which are triggered during change detection (e.g. by input
    signals) run earlier, before the component's template.

• ExperimentalPendingTasks has been renamed to PendingTasks.

• The autoDetect feature of ComponentFixture will now
  attach the fixture to the ApplicationRef. As a result, errors during
  automatic change detection of the fixture be reported to the ErrorHandler.
  This change may cause custom error handlers to observe new failures that were previously unreported.

• createComponent will now render default fallback with empty projectableNodes.

  • When passing an empty array to projectableNodes in the createComponent API, the default fallback content
    of the ng-content will be rendered if present. To prevent rendering the default content, pass document.createTextNode('') as a projectableNode.

  // The first ng-content will render the default fallback content if present
  createComponent(MyComponent. { projectableNodes: [[], [secondNode]] });
  
  // To prevent projecting the default fallback content:
  createComponent(MyComponent. { projectableNodes: [[document.createTextNode('')], [secondNode]] });

• Errors that are thrown during ApplicationRef.tick
  will now be rethrown when using TestBed. These errors should be
  resolved by ensuring the test environment is set up correctly to
  complete change detection successfully. There are two alternatives to
  catch the errors:

  • Instead of waiting for automatic change detection to happen, trigger
    it synchronously and expect the error. For example, a jasmine test
    could write expect(() => TestBed.inject(ApplicationRef).tick()).toThrow()
  • TestBed will reject any outstanding ComponentFixture.whenStable promises. A jasmine test,
    for example, could write expectAsync(fixture.whenStable()).toBeRejected().

  As a last resort, you can configure errors to not be rethrown by
  setting rethrowApplicationErrors to false in TestBed.configureTestingModule.

• The timers that are used for zone coalescing and hybrid
  mode scheduling (which schedules an application state synchronization
  when changes happen outside the Angular zone) will now run in the zone
  above Angular rather than the root zone. This will mostly affect tests
  which use fakeAsync: these timers will now be visible to fakeAsync
  and can be affected by tick or flush.

• The deprecated factories property in KeyValueDiffers has been removed.

elements

• as part of switching away from custom CD behavior to the
  hybrid scheduler, timing of change detection around custom elements has
  changed subtly. These changes make elements more efficient, but can cause
  tests which encoded assumptions about how or when elements would be checked
  to require updating.

localize

• The name option in the ng add @localize`` schematic has been removed in favor of the project option.

platform-browser

• The deprecated BrowserModule.withServerTransition method has been removed. Please use the APP_ID DI token to set the application id instead.

router

• The Router.errorHandler property has been removed.
  Adding an error handler should be configured in either
  withNavigationErrorHandler with provideRouter or the errorHandler
  property in the extra options of RouterModule.forRoot. In addition,
  the error handler cannot be used to change the return value of the
  router navigation promise or prevent it from rejecting. Instead, if you
  want to prevent the promise from rejecting, use resolveNavigationPromiseOnError.
• The return type of the Resolve interface now includes
  RedirectCommand.

common

Commit	Type	Description
24c6373820	feat	add optional rounded transform support in cloudinary image loader (#​55364)
50f08e6c4b	feat	automatically use sizes auto in NgOptimizedImage (#​57479)
13c13067bc	feat	disable keyvalue sorting using null compareFn (#​57487)

compiler

Commit	Type	Description
a2e4ee0cb3	feat	add diagnostic for unused standalone imports (#​57605)
0c9d721ac1	feat	add support for the typeof keyword in template expressions. (#​58183)
09f589f000	fix	this.a should always refer to class property a (#​55183)
98804fd4be	fix	add more specific matcher for hydrate never block (#​58360)
b25121ee4a	fix	avoid having to duplicate core environment (#​58444)
560282aa9b	fix	control flow nodes with root at the end projected incorrectly (#​58607)
2be161d015	fix	fix :host parsing in pseudo-selectors (#​58681)
806a61b5a6	fix	fix multiline selectors (#​58681)
a3cb530d84	fix	handle typeof expressions in serializer (#​58217)
ba4340875a	fix	ignore placeholder-only i18n messages (#​58154)
e5d3abb298	fix	resolve :host:host-context(.foo) (#​58681)
80f56954ce	fix	transform chained pseudo-selectors (#​58681)

compiler-cli

Commit	Type	Description
d9687f43dd	feat	'strictStandalone' flag enforces standalone (#​57935)
9e87593055	feat	ensure template style elements are preprocessed as inline styles (#​57429)
231e6ff6ca	feat	generate the HMR replacement module (#​58205)
dbe612f2cd	fix	disable standalone by default on older versions of Angular (#​58405)
d4d76ead80	fix	do not fail fatal when references to non-existent module are discovered (#​58515)
33fe252c58	fix	do not report unused declarations coming from an imported array (#​57940)
fb44323c51	fix	incorrectly generating relative file paths on case-insensitive platforms (#​58150)
22cd6869ef	fix	make the unused imports diagnostic easier to read (#​58468)
9bbb01c85e	fix	report individual diagnostics for unused imports (#​58589)
4716c3b966	perf	reduce duplicate component style resolution (#​57502)

core

Commit	Type	Description
6ea8e1e9aa	feat	Add a schematics to migrate to standalone: false. (#​57643)
3ebe6b4ad4	feat	Add async run method on ExperimentalPendingTasks (#​56546)
69fc5ae922	feat	Add incremental hydration public api (#​58249)
8ebbae88ca	feat	Add rxjs operator prevent app stability until an event (#​56533)
19edf2c057	feat	add syntactic sugar for initializers (#​53152)
c93b510f9b	feat	allow passing undefined without needing to include it in the type argument of input (#​57621)
ab25a192ba	feat	allow running output migration on a subset of paths (#​58299)
fc59e2a7b7	feat	change effect() execution timing & no-op allowSignalWrites (#​57874)
8bcc663a53	feat	drop support for TypeScript 5.4 (#​57577)
18d8d44b1f	feat	experimental resource() API for async dependencies (#​58255)
9762b24b5e	feat	experimental impl of rxResource() (#​58255)
6b8c494d05	feat	flipping the default value for standalone to true (#​58169)
e6e5d29e83	feat	initial version of the output migration (#​57604)
be2e49639b	feat	introduce afterRenderEffect (#​57549)
ec386e7f12	feat	introduce debugName optional arg to framework signal functions (#​57073)
8311f00faa	feat	introduce the reactive linkedSignal (#​58189)
1b1519224d	feat	mark input, output and model APIs as stable (#​57804)
a7eff3ffaa	feat	mark signal-based query APIs as stable (#​57921)
a1f229850a	feat	migrate ExperimentalPendingTasks to PendingTasks (#​57533)
3f1e7ab6ae	feat	promote outputFromObservable & outputToObservable to stable. (#​58214)
97c44a1d6c	feat	Promote takeUntilDestroyed to stable. (#​58200)
e5adf92965	feat	stabilize @let syntax (#​57813)
b063468027	feat	support TypeScript 5.6 (#​57424)
819ff034ce	feat	treat directives, pipes, components as by default (#​58229)
ee426c62f0	fix	allow signal write error (#​57973)
c095679f92	fix	avoid breaking change with apps using rxjs 6.x (#​58341)
71ee81af2c	fix	clean up event contract once hydration is done (#​58174)
f03d274e87	fix	ComponentFixture autoDetect feature works like production (#​55228)
950a5540f1	fix	Ensure the ViewContext is retained after closure minification (#​57903)
7b1e5be20b	fix	fallback to default ng-content with empty projectable nodes. (#​57480)
0300dd2e18	fix	Fix fixture.detectChanges with autoDetect disabled and zoneless (#​57416)
5fe57d4fbb	fix	fixes issues with control flow and incremental hydration (#​58644)
51933ef5a6	fix	prevent errors on contract cleanup (#​58614)
fd7716440b	fix	Prevents trying to trigger incremental hydration on CSR (#​58366)
656b5d3e78	fix	Re-assign error codes to be within core bounds (<1000) (#​53455)
6e0af6dbbb	fix	resolve forward-referenced host directives during directive matching (#​58492)
468d3fb9b1	fix	rethrow errors during ApplicationRef.tick in TestBed (#​57200)
226a67dabb	fix	Schedulers run in zone above Angular rather than root (#​57553)
97fb86d331	perf	set encapsulation to None for empty component styles (#​57130)
c15ec36bd1	refactor	remove deprecated factories Property in KeyValueDiffers (#​58064)

elements

Commit	Type	Description
fe5c4e086a	fix	support output()-shaped outputs (#​57535)
0cebfd7462	fix	switch to ComponentRef.setInput & remove custom scheduler (#​56728)

forms

Commit	Type	Description
3e7d724037	feat	add ability to clear a FormRecord (#​50750)
18b6f3339f	fix	fix FormRecord type inference (#​50750)

http

Commit	Type	Description
4b9accdf16	feat	promote withRequestsMadeViaParent to stable. (#​58221)
057cf7fb6b	fix	preserve all headers from Headers object (#​57802)

language-service

Commit	Type	Description
8da9fb49b5	feat	add code fix for unused standalone imports (#​57605)
1f067f4507	feat	add code reactoring action to migrate @Input to signal-input (#​57214)
56ee47f2ec	feat	allow code refactorings to compute edits asynchronously (#​57214)
bc83fc1e2e	feat	support converting to signal queries in VSCode extension (#​58106)
5c4305f024	feat	support migrating full classes to signal inputs in VSCode (#​57975)
6342befff8	feat	support migrating full classes to signal queries (#​58263)
7ecfd89592	fix	The suppress diagnostics option should work for external templates (#​57873)

localize

Commit	Type	Description
9c3bd1b5d1	refactor	remove deprecated name option. (#​58063)

migrations

Commit	Type	Description
dff4de0f75	feat	add a combined migration for all signals APIs (#​58259)
b6bc93803c	feat	add schematic to migrate to signal queries (#​58032)
2bfc64daf1	feat	expose output as function migration (#​58299)
59fe9bc772	feat	introduce signal input migration as ng generate schematic (#​57805)
90c7ec39a0	fix	inject migration always inserting generated variables before super call (#​58393)
7a65cdd911	fix	inject migration not inserting generated code after super call in some cases (#​58393)
c1aa411cf1	fix	properly resolve tsconfig paths on windows (#​58137)
e26797b38e	fix	replace removed NgModules in tests with their exports (#​58627)

platform-browser

Commit	Type	Description
c36a1c023b	fix	correctly add external stylesheets to ShadowDOM components (#​58482)
5c61f46409	refactor	remove deprecated BrowserModule.withServerTransition method (#​58062)

platform-server

Commit	Type	Description
9e82559de4	fix	destroy PlatformRef when error happens during the bootstrap() phase (#​58112)

router

Commit	Type	Description
f271021e19	feat	Add routerOutletData input to RouterOutlet directive (#​57051)
b2790813a6	fix	Align RouterModule.forRoot errorHandler with provider error handler (#​57050)
a49c35ec76	fix	remove setter for injector on OutletContext (#​58343)
7436d3180e	fix	Update Resolve interface to include RedirectCommand like ResolveFn (#​57309)

service-worker

Commit	Type	Description
8ddce80a0b	feat	allow specifying maxAge for entire application (#​49601)
1479af978c	feat	finish implementation of refreshAhead feature (#​53356)

v18.2.14

Compare Source

Breaking Changes

core

• The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

  Before:

  const bootstrap = () => bootstrapApplication(AppComponent, config);

  After:

  const bootstrap = (context: BootstrapContext) =>
    bootstrapApplication(AppComponent, config, context);

  A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

  In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

  (cherry picked from commit 8bf80c9)

core

Commit	Type	Description
9d1fb33f5e	fix	introduce BootstrapContext for improved server bootstrapping (#​63640)

v18.2.13

Compare Source

migrations

Commit	Type	Description
06d70a25ea	fix	take care of tests that import both HttpClientModule & HttpClientTestingModule. (#​58777)

v18.2.12

Compare Source

compiler-cli

Commit	Type	Description
4c38160853	fix	correct extraction of generics from type aliases (#​58548)

v18.2.11

Compare Source

core

Commit	Type	Description
5f2d98a1b1	fix	avoid slow stringification when checking for duplicates in dev mode (#​58521)
[3aa45a2fa1](https://redirect.github.com/angular/angular/commit/3aa45a2fa11ad568d12

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: @heap-code/nna@0.0.0
npm error Found: zone.js@0.14.10
npm error node_modules/zone.js
npm error   zone.js@"~0.14.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer zone.js@"~0.15.0" from @angular/core@19.0.7
npm error node_modules/@angular/core
npm error   @angular/core@"~19.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-05-18T12_47_17_681Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-05-18T12_47_17_681Z-debug-0.log