renovate-bot opened a new pull request, #7286: URL: https://github.com/apache/texera/pull/7286
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@angular/common](https://redirect.github.com/angular/angular) ([source](https://redirect.github.com/angular/angular/tree/HEAD/packages/common)) | [`21.2.18` → `21.2.19`](https://renovatebot.com/diffs/npm/@angular%2fcommon/21.2.18/21.2.19) |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/6912) for more information. --- ### Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning [CVE-2026-68945](https://nvd.nist.gov/vuln/detail/CVE-2026-68945) / [GHSA-jhpw-976m-542j](https://redirect.github.com/advisories/GHSA-jhpw-976m-542j) <details> <summary>More information</summary> #### Details Angular's `HttpTransferCache` caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. During SSR, `HttpTransferCache` previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas: ```ts new HttpParams().set('role', 'user,admin') new HttpParams().append('role', 'user').append('role', 'admin') ``` Both requests previously serialized as `role=user,admin`, allowing distinct `HttpClient` requests to produce the same transfer-cache key material. ##### Impact In an SSR application, this cache-key ambiguity can make a later security-sensitive `HttpClient` request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to: - **State Poisoning**: Using incorrect or attacker-influenced cached responses for subsequent application logic. - **Cross-Request Response Reuse**: Reusing cached responses across requests with semantically different parameters. ##### Patched Versions - 22.0.2 - 21.2.19 - 20.3.27 ##### Workarounds If you cannot upgrade immediately, configure your `HttpClient` requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used: ```ts this.http.get('/api/resource', { transferCache: false }); ``` Alternatively, disable the HTTP transfer cache globally in your application bootstrap config: ```ts import { provideClientHydration, withNoHttpTransferCache } from '@​angular/platform-browser'; export const appConfig = { providers: [ provideClientHydration( withNoHttpTransferCache() ) ] }; ``` #### Severity - CVSS Score: 8.8 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j](https://redirect.github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j) - [https://github.com/angular/angular/pull/68571](https://redirect.github.com/angular/angular/pull/68571) - [https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c](https://redirect.github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c) - [https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35) - [https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b](https://redirect.github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b) - [https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c](https://redirect.github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c) - [https://github.com/angular/angular](https://redirect.github.com/angular/angular) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jhpw-976m-542j) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>angular/angular (@​angular/common)</summary> ### [`v21.2.19`](https://redirect.github.com/angular/angular/blob/HEAD/CHANGELOG.md#21219-2026-07-29) [Compare Source](https://redirect.github.com/angular/angular/compare/v21.2.18...v21.2.19) ##### compiler | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | -------------------------------------------------------------------------------- | | [e2660c3dee](https://redirect.github.com/angular/angular/commit/e2660c3deeccb86471f9c11b7e65ebcc89d84e9e) | fix | disallow i18n event attributes | | [7b884f585a](https://redirect.github.com/angular/angular/commit/7b884f585abf50480c271d234c892c141eb61e2c) | fix | restrict possible event handler check to property names longer than 2 characters | ##### http | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ------------------------------------------ | | [948a8d6831](https://redirect.github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35) | fix | distinguish repeated transfer cache params | | [9949dccce1](https://redirect.github.com/angular/angular/commit/9949dccce164638597496a6b3881043117dfd1df) | fix | enable xsrf for root-provided HttpClient | ##### platform-server | Commit | Type | Description | | ------------------------------------------------------------------------------------------------ | ---- | ------------------------------- | | [f34a93c946](https://redirect.github.com/angular/angular/commit/f34a93c946c017eff526cfb0c8d17f51e97f01e4) | fix | update domino to latest version | <!-- CHANGELOG SPLIT MARKER --> </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsInJlbGVhc2UvdjEuMiIsInNlY3VyaXR5Il19--> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
