This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-7286-f51a8a91b1b25bf2bb2bdab3e69d27d0bae7bd45 in repository https://gitbox.apache.org/repos/asf/texera.git
commit 6215749d63e4e3f3012a63ba55f35aa38757b2b4 Author: Mend Renovate <[email protected]> AuthorDate: Tue Aug 4 07:49:33 2026 +0100 fix(deps, frontend): update dependency @angular/common to v21.2.19 (#7286) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@angular/common](https://redirect.github.com/angular/angular) ([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/common)) | [`21.2.18` → `21.2.19`](https://renovatebot.com/diffs/npm/@angular%2fcommon/21.2.18/21.2.19) |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/6912) for more information. --- ### Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning [CVE-2026-68945](https://nvd.nist.gov/vuln/detail/CVE-2026-68945) / [GHSA-jhpw-976m-542j](https://redirect.github.com/advisories/GHSA-jhpw-976m-542j) <details> <summary>More information</summary> #### Details Angular's `HttpTransferCache` caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. During SSR, `HttpTransferCache` previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas: ```ts new HttpParams().set('role', 'user,admin') new HttpParams().append('role', 'user').append('role', 'admin') ``` Both requests previously serialized as `role=user,admin`, allowing distinct `HttpClient` requests to produce the same transfer-cache key material. ##### Impact In an SSR application, this cache-key ambiguity can make a later security-sensitive `HttpClient` request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to: - **State Poisoning**: Using incorrect or attacker-influenced cached responses for subsequent application logic. - **Cross-Request Response Reuse**: Reusing cached responses across requests with semantically different parameters. ##### Patched Versions - 22.0.2 - 21.2.19 - 20.3.27 ##### Workarounds If you cannot upgrade immediately, configure your `HttpClient` requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used: ```ts this.http.get('/api/resource', { transferCache: false }); ``` Alternatively, disable the HTTP transfer cache globally in your application bootstrap config: ```ts import { provideClientHydration, withNoHttpTransferCache } from '@​angular/platform-browser'; export const appConfig = { providers: [ provideClientHydration( withNoHttpTransferCache() ) ] }; ``` #### Severity - CVSS Score: 8.8 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j](https://redirect.github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j) - [https://github.com/angular/angular/pull/68571](https://redirect.github.com/angular/angular/pull/68571) - [https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c](https://redirect.github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c) - [https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35) - [https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b](https://redirect.github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b) - [https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c](https://redirect.github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c) - [https://github.com/angular/angular](https://redirect.github.com/angular/angular) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jhpw-976m-542j) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>angular/angular (@​angular/common)</summary> ### [`v21.2.19`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21219-2026-07-29) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.18...v21.2.19) ##### compiler | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | -------------------------------------------------------------------------------- | | [e2660c3dee](https://redirect.github.com/angular/angular/commit/e2660c3deeccb86471f9c11b7e65ebcc89d84e9e) | fix | disallow i18n event attributes | | [7b884f585a](https://redirect.github.com/angular/angular/commit/7b884f585abf50480c271d234c892c141eb61e2c) | fix | restrict possible event handler check to property names longer than 2 characters | ##### http | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ------------------------------------------ | | [948a8d6831](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35) | fix | distinguish repeated transfer cache params | | [9949dccce1](https://redirect.github.com/angular/angular/commit/9949dccce164638597496a6b3881043117dfd1df) | fix | enable xsrf for root-provided HttpClient | ##### platform-server | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ------------------------------- | | [f34a93c946](https://redirect.github.com/angular/angular/commit/f34a93c946c017eff526cfb0c8d17f51e97f01e4) | fix | update domino to latest version | <!-- CHANGELOG SPLIT MARKER --> </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsInJlbGVhc2UvdjEuMiIsInNlY3VyaXR5Il19--> --------- Co-authored-by: Xinyuan Lin <[email protected]> --- frontend/LICENSE-binary | 2 +- frontend/package.json | 2 +- frontend/yarn.lock | 12 ++++++------ 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/frontend/LICENSE-binary b/frontend/LICENSE-binary index 29c0c4881b..c5a64b7287 100644 --- a/frontend/LICENSE-binary +++ b/frontend/LICENSE-binary @@ -246,7 +246,7 @@ Angular / npm packages: - @ali-hm/[email protected] - @angular/[email protected] - @angular/[email protected] - - @angular/[email protected] + - @angular/[email protected] - @angular/[email protected] - @angular/[email protected] - @angular/[email protected] diff --git a/frontend/package.json b/frontend/package.json index cb629ad472..0d64d87427 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -24,7 +24,7 @@ "@ali-hm/angular-tree-component": "12.0.5", "@angular/animations": "21.2.18", "@angular/cdk": "21.2.14", - "@angular/common": "21.2.18", + "@angular/common": "21.2.19", "@angular/compiler": "21.2.19", "@angular/core": "21.2.19", "@angular/forms": "21.2.18", diff --git a/frontend/yarn.lock b/frontend/yarn.lock index 930132024c..36692aa0f9 100644 --- a/frontend/yarn.lock +++ b/frontend/yarn.lock @@ -944,15 +944,15 @@ __metadata: languageName: node linkType: hard -"@angular/common@npm:21.2.18": - version: 21.2.18 - resolution: "@angular/common@npm:21.2.18" +"@angular/common@npm:21.2.19": + version: 21.2.19 + resolution: "@angular/common@npm:21.2.19" dependencies: tslib: "npm:^2.3.0" peerDependencies: - "@angular/core": 21.2.18 + "@angular/core": 21.2.19 rxjs: ^6.5.3 || ^7.4.0 - checksum: 10c0/008cd90260052abc17f3778ed5800f8874fcc3d1decc88a4f24cfb567c48a617c3286a1534a03484d3ed0ceef8af06e690f45f97b0c760515f0902c4a861a226 + checksum: 10c0/e7e562b647ed36fd048e174ef1073d913e92810ab6581b45ce9332201fe38952d87186ff6e73ba1a0e76008aad5c41270a109713742a8769a235e3122104e43b languageName: node linkType: hard @@ -10955,7 +10955,7 @@ __metadata: "@angular/animations": "npm:21.2.18" "@angular/cdk": "npm:21.2.14" "@angular/cli": "npm:21.2.19" - "@angular/common": "npm:21.2.18" + "@angular/common": "npm:21.2.19" "@angular/compiler": "npm:21.2.19" "@angular/compiler-cli": "npm:21.2.18" "@angular/core": "npm:21.2.19"
