You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@texera.apache.org by gi...@apache.org on 2026/09/23 14:07:36 UTC
(texera) 01/01: fix(deps, frontend): update dependency @angular/common to v21.2.20 (#8492)
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-8492-915b2eecbc7dba140a5d68a303e017d2a49ffc9d
in repository https://gitbox.apache.org/repos/asf/texera.git
commit 19c5c6b41e7e16323f430314262f40d8e6c7bfb8
Author: Mend Renovate <bo...@renovateapp.com>
AuthorDate: Wed Sep 23 14:03:03 2026 +0000
fix(deps, frontend): update dependency @angular/common to v21.2.20 (#8492)
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@angular/common](https://redirect.github.com/angular/angular)
([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/common))
| [`21.2.19` →
`21.2.20`](https://renovatebot.com/diffs/npm/@angular%2fcommon/21.2.19/21.2.20)
|
|
|
---
### Angular: Information Leak via `HttpTransferCache` Bypass When Using
`withRequestsMadeViaParent`
[CVE-2026-88059](https://nvd.nist.gov/vuln/detail/CVE-2026-88059) /
[GHSA-p297-fm68-3q8c](https://redirect.github.com/advisories/GHSA-p297-fm68-3q8c)
<details>
<summary>More information</summary>
#### Details
A security bypass vulnerability was discovered in `@angular/common` when
Server-Side Rendering (SSR) and hydration are enabled in applications
using a hierarchical `HttpClient` configuration with
`withRequestsMadeViaParent()`.
The `HttpTransferCache` utility optimizes hydration by caching outgoing
HTTP requests performed during SSR and transferring the cached state to
the client-side application via `TransferState` (serialized as JSON in
`<script id="ng-state">`). Following the remediation of
[CVE-2026-50170](https://redirect.github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x),
`HttpTransferCache` automatically skips caching requests that contain
authentication headers or credentials (`Authorization`, `Cookie`,
`withCredentials`, etc.).
However, when a child `HttpClient` delegates to a parent client via
`withRequestsMadeViaParent()`, the child's `TransferCache` interceptor
evaluates whether the request is eligible for caching **before**
delegating to the parent client's interceptor chain.
If an outgoing request originates as anonymous from the child client,
the child `TransferCache` marks the request as cacheable. When the
request reaches a parent interceptor that injects sensitive
authentication credentials (such as an `Authorization` header or API
token), the parent `TransferCache` correctly skips caching the
authenticated request. However, when the backend returns the private,
authenticated response, the child `TransferCache` still stores the
response in `TransferState` based on its initial pre-delegation
evaluation.
##### Impact
Successful exploitation allows sensitive, user-specific information
belonging to an authenticated user to be leaked to unauthenticated or
unauthorized users. This occurs when:
1. During SSR, a child `HttpClient` initiates an unauthenticated request
that is subsequently authenticated by a parent interceptor.
2. The authenticated response body is cached into the SSR-rendered HTML
page (`TransferState`).
3. The rendered HTML page is stored by a shared caching layer (e.g.,
CDN, edge cache, or reverse proxy) or served across user sessions.
4. Subsequent visitors requesting the same page receive the cached HTML
containing the previous user's private data.
##### Attack Preconditions & Vulnerable Configurations
An application is affected only if **all** of the following conditions
are met:
* **SSR and Hydration Enabled:** The application uses Server-Side
Rendering with hydration enabled (e.g., via `provideClientHydration()`).
* **Hierarchical `HttpClient` with Delegation:** The application
configures a child `HttpClient` using `withRequestsMadeViaParent()`.
* **Parent-Level Authentication Injection:** Authentication credentials
(such as `Authorization` headers, session cookies, or custom API tokens
filtered via `withHttpTransferCacheOptions`) are attached by an
interceptor in the **parent** injector chain rather than on the initial
child request.
* **Shared HTML Caching:** The SSR HTML responses are cached by a shared
caching layer (CDN, reverse proxy, or application-level HTML cache).
##### Vulnerable Code Pattern Example
```ts
// Parent Injector / Application Config
export const appConfig: ApplicationConfig = {
providers: [
provideHttpClient(
// Parent interceptor attaches sensitive Authorization header
withInterceptors([
(req, next) => next(req.clone({ setHeaders: { Authorization: `Bearer ${getToken()}` } }))
])
),
],
};
// Child Injector / Feature or Component Config
const childClient = createEnvironmentInjector(
[
// Child delegates to parent; TransferCache evaluates req BEFORE parent auth interceptor runs
provideHttpClient(withRequestsMadeViaParent()),
],
parentInjector
).get(HttpClient);
// Request originates without auth headers -> marked cacheable by child TransferCache
childClient.get('/api/user/profile').subscribe();
```
##### Patches
The issue is resolved by updating `@angular/common` to run root
interceptors in the terminal request chain so that delegated clients
leave inherited root interceptors to the parent chain, preventing
duplicate execution and ensuring `HttpTransferCache` evaluates cache
eligibility after parent request interceptors run.
* `22.1.1`
* `21.2.20`
* `20.3.28`
##### Workarounds & Mitigations
For applications that cannot immediately upgrade to a patched version,
use one of the following mitigations:
1. **Attach Credentials Before or Within the Child Client:** Ensure
authentication headers (e.g., `Authorization`) are attached directly
when constructing the request or via an interceptor configured directly
on the child `HttpClient`, rather than relying solely on parent
interceptors.
2. **Apply Explicit Cache Filters on the Child Client:** Configure
`withHttpTransferCacheOptions` with a filter on the child client that
explicitly excludes endpoints returning user-specific or sensitive data:
```ts
provideClientHydration(
withHttpTransferCacheOptions({
filter: (req) => !req.url.includes('/api/private/'),
})
)
```
3. **Disable HTTP Transfer Cache for Sensitive Routes:** If specific SSR
routes handle user-authenticated data, disable transfer caching for
those requests or ensure the SSR response sets `Cache-Control: no-store`
/ `private` headers at your edge/CDN layer so personalized HTML is never
shared.
#### Severity
- CVSS Score: 4.0 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N`
#### References
-
[https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c](https://redirect.github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c)
-
[https://github.com/angular/angular/issues/69777](https://redirect.github.com/angular/angular/issues/69777)
-
[https://github.com/angular/angular/pull/69778](https://redirect.github.com/angular/angular/pull/69778)
-
[https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af](https://redirect.github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af)
-
[https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d](https://redirect.github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d)
-
[https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56](https://redirect.github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56)
-
[https://github.com/angular/angular/releases/tag/v20.3.28](https://redirect.github.com/angular/angular/releases/tag/v20.3.28)
-
[https://github.com/angular/angular/releases/tag/v21.2.20](https://redirect.github.com/angular/angular/releases/tag/v21.2.20)
-
[https://github.com/angular/angular/releases/tag/v22.1.1](https://redirect.github.com/angular/angular/releases/tag/v22.1.1)
-
[https://github.com/advisories/GHSA-p297-fm68-3q8c](https://redirect.github.com/advisories/GHSA-p297-fm68-3q8c)
This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-p297-fm68-3q8c)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Angular: Information Leak via `HttpTransferCache` Bypass When Using
`withRequestsMadeViaParent`
[CVE-2026-88059](https://nvd.nist.gov/vuln/detail/CVE-2026-88059) /
[GHSA-p297-fm68-3q8c](https://redirect.github.com/advisories/GHSA-p297-fm68-3q8c)
<details>
<summary>More information</summary>
#### Details
A security bypass vulnerability was discovered in `@angular/common` when
Server-Side Rendering (SSR) and hydration are enabled in applications
using a hierarchical `HttpClient` configuration with
`withRequestsMadeViaParent()`.
The `HttpTransferCache` utility optimizes hydration by caching outgoing
HTTP requests performed during SSR and transferring the cached state to
the client-side application via `TransferState` (serialized as JSON in
`<script id="ng-state">`). Following the remediation of
[CVE-2026-50170](https://redirect.github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x),
`HttpTransferCache` automatically skips caching requests that contain
authentication headers or credentials (`Authorization`, `Cookie`,
`withCredentials`, etc.).
However, when a child `HttpClient` delegates to a parent client via
`withRequestsMadeViaParent()`, the child's `TransferCache` interceptor
evaluates whether the request is eligible for caching **before**
delegating to the parent client's interceptor chain.
If an outgoing request originates as anonymous from the child client,
the child `TransferCache` marks the request as cacheable. When the
request reaches a parent interceptor that injects sensitive
authentication credentials (such as an `Authorization` header or API
token), the parent `TransferCache` correctly skips caching the
authenticated request. However, when the backend returns the private,
authenticated response, the child `TransferCache` still stores the
response in `TransferState` based on its initial pre-delegation
evaluation.
##### Impact
Successful exploitation allows sensitive, user-specific information
belonging to an authenticated user to be leaked to unauthenticated or
unauthorized users. This occurs when:
1. During SSR, a child `HttpClient` initiates an unauthenticated request
that is subsequently authenticated by a parent interceptor.
2. The authenticated response body is cached into the SSR-rendered HTML
page (`TransferState`).
3. The rendered HTML page is stored by a shared caching layer (e.g.,
CDN, edge cache, or reverse proxy) or served across user sessions.
4. Subsequent visitors requesting the same page receive the cached HTML
containing the previous user's private data.
##### Attack Preconditions & Vulnerable Configurations
An application is affected only if **all** of the following conditions
are met:
* **SSR and Hydration Enabled:** The application uses Server-Side
Rendering with hydration enabled (e.g., via `provideClientHydration()`).
* **Hierarchical `HttpClient` with Delegation:** The application
configures a child `HttpClient` using `withRequestsMadeViaParent()`.
* **Parent-Level Authentication Injection:** Authentication credentials
(such as `Authorization` headers, session cookies, or custom API tokens
filtered via `withHttpTransferCacheOptions`) are attached by an
interceptor in the **parent** injector chain rather than on the initial
child request.
* **Shared HTML Caching:** The SSR HTML responses are cached by a shared
caching layer (CDN, reverse proxy, or application-level HTML cache).
##### Vulnerable Code Pattern Example
```ts
// Parent Injector / Application Config
export const appConfig: ApplicationConfig = {
providers: [
provideHttpClient(
// Parent interceptor attaches sensitive Authorization header
withInterceptors([
(req, next) => next(req.clone({ setHeaders: { Authorization: `Bearer ${getToken()}` } }))
])
),
],
};
// Child Injector / Feature or Component Config
const childClient = createEnvironmentInjector(
[
// Child delegates to parent; TransferCache evaluates req BEFORE parent auth interceptor runs
provideHttpClient(withRequestsMadeViaParent()),
],
parentInjector
).get(HttpClient);
// Request originates without auth headers -> marked cacheable by child TransferCache
childClient.get('/api/user/profile').subscribe();
```
##### Patches
The issue is resolved by updating `@angular/common` to run root
interceptors in the terminal request chain so that delegated clients
leave inherited root interceptors to the parent chain, preventing
duplicate execution and ensuring `HttpTransferCache` evaluates cache
eligibility after parent request interceptors run.
* `22.1.1`
* `21.2.20`
* `20.3.28`
##### Workarounds & Mitigations
For applications that cannot immediately upgrade to a patched version,
use one of the following mitigations:
1. **Attach Credentials Before or Within the Child Client:** Ensure
authentication headers (e.g., `Authorization`) are attached directly
when constructing the request or via an interceptor configured directly
on the child `HttpClient`, rather than relying solely on parent
interceptors.
2. **Apply Explicit Cache Filters on the Child Client:** Configure
`withHttpTransferCacheOptions` with a filter on the child client that
explicitly excludes endpoints returning user-specific or sensitive data:
```ts
provideClientHydration(
withHttpTransferCacheOptions({
filter: (req) => !req.url.includes('/api/private/'),
})
)
```
3. **Disable HTTP Transfer Cache for Sensitive Routes:** If specific SSR
routes handle user-authenticated data, disable transfer caching for
those requests or ensure the SSR response sets `Cache-Control: no-store`
/ `private` headers at your edge/CDN layer so personalized HTML is never
shared.
#### Severity
- CVSS Score: 4.0 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N`
#### References
-
[https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c](https://redirect.github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c)
-
[https://github.com/angular/angular/issues/69777](https://redirect.github.com/angular/angular/issues/69777)
-
[https://github.com/angular/angular/pull/69778](https://redirect.github.com/angular/angular/pull/69778)
-
[https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af](https://redirect.github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af)
-
[https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d](https://redirect.github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d)
-
[https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56](https://redirect.github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56)
-
[https://github.com/angular/angular](https://redirect.github.com/angular/angular)
-
[https://github.com/angular/angular/releases/tag/v20.3.28](https://redirect.github.com/angular/angular/releases/tag/v20.3.28)
-
[https://github.com/angular/angular/releases/tag/v21.2.20](https://redirect.github.com/angular/angular/releases/tag/v21.2.20)
-
[https://github.com/angular/angular/releases/tag/v22.1.1](https://redirect.github.com/angular/angular/releases/tag/v22.1.1)
This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-p297-fm68-3q8c) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>angular/angular (@​angular/common)</summary>
###
[`v21.2.20`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21220-2026-08-12)
[Compare
Source](https://redirect.github.com/angular/angular/compare/v21.2.19...v21.2.20)
##### core
| Commit | Type | Description |
|
------------------------------------------------------------------------------------------------
| ---- | ---------------------------------------- |
|
[6afe6fa781](https://redirect.github.com/angular/angular/commit/6afe6fa781c2f0931f0aedd729b9884a8fe212ee)
| fix | sanitize host bindings on concrete hosts |
##### http
| Commit | Type | Description |
|
------------------------------------------------------------------------------------------------
| ---- | --------------------------------------------------- |
|
[fec5977df4](https://redirect.github.com/angular/angular/commit/fec5977df4dda3a10d5ce2923e3e06d86ba11ee7)
| fix | match header values exactly when deleting |
|
[e33d69a71c](https://redirect.github.com/angular/angular/commit/e33d69a71c5beb8fe5785b53fd6b37658334e8e0)
| fix | preserve immutability of materialized clones |
|
[caf616670f](https://redirect.github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d)
| fix | run root interceptors in the terminal request chain |
<!-- CHANGELOG SPLIT MARKER -->
</details>
---
### Configuration
📅 **Schedule**: (in timezone Etc/UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/apache/texera).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwicmVsZWFzZS92MS4yIiwic2VjdXJpdHkiXX0=-->
---------
Co-authored-by: mengw15 <12...@users.noreply.github.com>
Co-authored-by: Xuan Gu <16...@users.noreply.github.com>
---
frontend/LICENSE-binary | 2 +-
frontend/package.json | 2 +-
frontend/yarn.lock | 12 ++++++------
3 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/frontend/LICENSE-binary b/frontend/LICENSE-binary
index 903da17fd7..35a2f4e069 100644
--- a/frontend/LICENSE-binary
+++ b/frontend/LICENSE-binary
@@ -251,7 +251,7 @@ Angular / npm packages:
- @ali-hm/angular-tree-component@12.0.5
- @angular/animations@21.2.18
- @angular/cdk@21.2.14
- - @angular/common@21.2.19
+ - @angular/common@21.2.20
- @angular/core@21.2.20
- @angular/forms@21.2.18
- @angular/platform-browser@21.2.18
diff --git a/frontend/package.json b/frontend/package.json
index a01e97cef4..b0721f2c51 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -24,7 +24,7 @@
"@ali-hm/angular-tree-component": "12.0.5",
"@angular/animations": "21.2.18",
"@angular/cdk": "21.2.14",
- "@angular/common": "21.2.19",
+ "@angular/common": "21.2.20",
"@angular/compiler": "21.2.20",
"@angular/core": "21.2.20",
"@angular/forms": "21.2.18",
diff --git a/frontend/yarn.lock b/frontend/yarn.lock
index 77f5add04b..d7a767961f 100644
--- a/frontend/yarn.lock
+++ b/frontend/yarn.lock
@@ -707,15 +707,15 @@ __metadata:
languageName: node
linkType: hard
-"@angular/common@npm:21.2.19":
- version: 21.2.19
- resolution: "@angular/common@npm:21.2.19"
+"@angular/common@npm:21.2.20":
+ version: 21.2.20
+ resolution: "@angular/common@npm:21.2.20"
dependencies:
tslib: "npm:^2.3.0"
peerDependencies:
- "@angular/core": 21.2.19
+ "@angular/core": 21.2.20
rxjs: ^6.5.3 || ^7.4.0
- checksum: 10c0/e7e562b647ed36fd048e174ef1073d913e92810ab6581b45ce9332201fe38952d87186ff6e73ba1a0e76008aad5c41270a109713742a8769a235e3122104e43b
+ checksum: 10c0/402065fef44b9dcd6eae5a6042b3b7f9cf4db6cb9a5fb6e9e9bf3e3dd4560ffee75d42d789b7fcd1c6ba2711f24c4f1d53e59b644e9289cc47135da221938e04
languageName: node
linkType: hard
@@ -10718,7 +10718,7 @@ __metadata:
"@angular/animations": "npm:21.2.18"
"@angular/cdk": "npm:21.2.14"
"@angular/cli": "npm:21.2.19"
- "@angular/common": "npm:21.2.19"
+ "@angular/common": "npm:21.2.20"
"@angular/compiler": "npm:21.2.20"
"@angular/compiler-cli": "npm:21.2.18"
"@angular/core": "npm:21.2.20"