You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@texera.apache.org by "renovate-bot (via GitHub)" <gi...@apache.org> on 2026/08/03 19:00:03 UTC
[PR] fix(deps, frontend): update dependency @angular/common to v21.2.19 [texera]
renovate-bot opened a new pull request, #7286:
URL: https://github.com/apache/texera/pull/7286
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@angular/common](https://redirect.github.com/angular/angular) ([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/common)) | [`21.2.18` → `21.2.19`](https://renovatebot.com/diffs/npm/@angular%2fcommon/21.2.18/21.2.19) |  |  |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/6912) for more information.
---
### Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
[CVE-2026-68945](https://nvd.nist.gov/vuln/detail/CVE-2026-68945) / [GHSA-jhpw-976m-542j](https://redirect.github.com/advisories/GHSA-jhpw-976m-542j)
<details>
<summary>More information</summary>
#### Details
Angular's `HttpTransferCache` caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.
During SSR, `HttpTransferCache` previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:
```ts
new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')
```
Both requests previously serialized as `role=user,admin`, allowing distinct `HttpClient` requests to produce the same transfer-cache key material.
##### Impact
In an SSR application, this cache-key ambiguity can make a later security-sensitive `HttpClient` request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to:
- **State Poisoning**: Using incorrect or attacker-influenced cached responses for subsequent application logic.
- **Cross-Request Response Reuse**: Reusing cached responses across requests with semantically different parameters.
##### Patched Versions
- 22.0.2
- 21.2.19
- 20.3.27
##### Workarounds
If you cannot upgrade immediately, configure your `HttpClient` requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used:
```ts
this.http.get('/api/resource', {
transferCache: false
});
```
Alternatively, disable the HTTP transfer cache globally in your application bootstrap config:
```ts
import { provideClientHydration, withNoHttpTransferCache } from '@​angular/platform-browser';
export const appConfig = {
providers: [
provideClientHydration(
withNoHttpTransferCache()
)
]
};
```
#### Severity
- CVSS Score: 8.8 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`
#### References
- [https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j](https://redirect.github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j)
- [https://github.com/angular/angular/pull/68571](https://redirect.github.com/angular/angular/pull/68571)
- [https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c](https://redirect.github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c)
- [https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35)
- [https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b](https://redirect.github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b)
- [https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c](https://redirect.github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c)
- [https://github.com/angular/angular](https://redirect.github.com/angular/angular)
This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jhpw-976m-542j) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>angular/angular (@​angular/common)</summary>
### [`v21.2.19`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21219-2026-07-29)
[Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.18...v21.2.19)
##### compiler
| Commit | Type | Description |
| ------------------------------------------------------------------------------------------------ | ---- | -------------------------------------------------------------------------------- |
| [e2660c3dee](https://redirect.github.com/angular/angular/commit/e2660c3deeccb86471f9c11b7e65ebcc89d84e9e) | fix | disallow i18n event attributes |
| [7b884f585a](https://redirect.github.com/angular/angular/commit/7b884f585abf50480c271d234c892c141eb61e2c) | fix | restrict possible event handler check to property names longer than 2 characters |
##### http
| Commit | Type | Description |
| ------------------------------------------------------------------------------------------------ | ---- | ------------------------------------------ |
| [948a8d6831](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35) | fix | distinguish repeated transfer cache params |
| [9949dccce1](https://redirect.github.com/angular/angular/commit/9949dccce164638597496a6b3881043117dfd1df) | fix | enable xsrf for root-provided HttpClient |
##### platform-server
| Commit | Type | Description |
| ------------------------------------------------------------------------------------------------ | ---- | ------------------------------- |
| [f34a93c946](https://redirect.github.com/angular/angular/commit/f34a93c946c017eff526cfb0c8d17f51e97f01e4) | fix | update domino to latest version |
<!-- CHANGELOG SPLIT MARKER -->
</details>
---
### Configuration
📅 **Schedule**: (in timezone Etc/UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsInJlbGVhc2UvdjEuMiIsInNlY3VyaXR5Il19-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/common to v21.2.19 [texera]
Posted by "aglinxinyuan (via GitHub)" <gi...@apache.org>.
aglinxinyuan merged PR #7286:
URL: https://github.com/apache/texera/pull/7286
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/common to v21.2.19 [texera]
Posted by "forking-renovate[bot] (via GitHub)" <gi...@apache.org>.
forking-renovate[bot] commented on PR #7286:
URL: https://github.com/apache/texera/pull/7286#issuecomment-5171326236
### Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️ **Warning**: custom changes will be lost.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/common to v21.2.19 [texera]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #7286:
URL: https://github.com/apache/texera/pull/7286#discussion_r3707244419
##########
frontend/package.json:
##########
@@ -24,7 +24,7 @@
"@ali-hm/angular-tree-component": "12.0.5",
"@angular/animations": "21.2.18",
"@angular/cdk": "21.2.14",
- "@angular/common": "21.2.18",
+ "@angular/common": "21.2.19",
"@angular/compiler": "21.2.18",
"@angular/core": "21.2.18",
"@angular/forms": "21.2.18",
Review Comment:
`@angular/common` is updated to `21.2.19` but `@angular/core` (and other `@angular/*` packages) remain at `21.2.18`. Angular packages are intended to be kept on the same patch version; mismatches can lead to peer dependency conflicts (and in stricter Yarn setups, install failures). Please bump `@angular/core` (and ideally the rest of the Angular packages in this block) to `21.2.19` and regenerate the lockfile.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/common to v21.2.19 [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #7286:
URL: https://github.com/apache/texera/pull/7286#issuecomment-5170876888
<!-- backport-auto-label-report -->
### Backport auto-label report
This `fix:` PR was checked against each actively-supported release branch. `release/*` labels drive the post-merge backport, so add or remove one to change where this fix lands.
| Release branch | Analysis |
| --- | --- |
| ✅ `release/v1.2` | Already labeled — this fix is queued to backport here. |
_[Auto-label run](https://github.com/apache/texera/actions/runs/30843794332)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/common to v21.2.19 [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #7286:
URL: https://github.com/apache/texera/pull/7286#issuecomment-5175658924
Backport PR opened: draft #7308 (https://github.com/apache/texera/pull/7308) to `release/v1.2`, assigned to @renovate-bot — needs manual work because the cherry-pick conflicts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/common to v21.2.19 [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #7286:
URL: https://github.com/apache/texera/pull/7286#issuecomment-5170874404
<!-- texera-reviewer-suggestion -->
### Automated Reviewer Suggestions
Based on the `git blame` history of the changed files, we recommend the following reviewers:
- **Contributors with relevant context:** `@gupta-sahil01`
You can notify them by mentioning `@gupta-sahil01` in a comment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, frontend): update dependency @angular/common to v21.2.19 [texera]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #7286:
URL: https://github.com/apache/texera/pull/7286#issuecomment-5171167280
### :warning: JUnit XML file not found
The CLI was unable to find any JUnit XML files to upload.
For more help, visit our [troubleshooting guide](https://docs.codecov.com/docs/test-analytics#troubleshooting).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org