chore(deps): update dependency @angular/common to v21.2.19 [security] (main) - #4417
chore(deps): update dependency @angular/common to v21.2.19 [security] (main)#4417renovate[bot] wants to merge 1 commit into
Conversation
|
View your CI Pipeline Execution ↗ for commit 4502aa4
💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗. ☁️ Nx Cloud last updated this comment at |
List of reported errors
|
Codecov Report✅ All modified and coverable lines are covered by tests. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Nx Cloud is proposing a fix for your failed CI:
We updated @angular-devkit/architect from 0.2102.18 to 0.2102.19 in @o3r/localization and @o3r/transloco to resolve a TypeScript type incompatibility introduced by this PR. Upgrading @angular/common caused @angular-devkit/core to resolve to 21.2.19 in the workspace, while the pinned architect@0.2102.18 still pulled @angular-devkit/core@21.2.18 as a transitive dependency, creating two conflicting virtual instances of LoggerApi. Aligning architect to 0.2102.19 eliminates the version split so both context.logger and LocalizationExtractor resolve to the same LoggerApi type.
Warning
❌ We could not verify this fix.
diff --git a/packages/@o3r/localization/package.json b/packages/@o3r/localization/package.json
index adbd5d5b3..406b61aad 100644
--- a/packages/@o3r/localization/package.json
+++ b/packages/@o3r/localization/package.json
@@ -119,7 +119,7 @@
"tslib": "^2.6.2"
},
"devDependencies": {
- "@angular-devkit/architect": "0.2102.18",
+ "@angular-devkit/architect": "0.2102.19",
"@angular-devkit/build-angular": "~21.2.0",
"@angular-devkit/core": "~21.2.0",
"@angular-devkit/schematics": "~21.2.0",
diff --git a/packages/@o3r/transloco/package.json b/packages/@o3r/transloco/package.json
index 8c41ad40c..ba272b1b7 100644
--- a/packages/@o3r/transloco/package.json
+++ b/packages/@o3r/transloco/package.json
@@ -116,7 +116,7 @@
"tslib": "^2.6.2"
},
"devDependencies": {
- "@angular-devkit/architect": "0.2102.18",
+ "@angular-devkit/architect": "0.2102.19",
"@angular-devkit/build-angular": "~21.2.0",
"@angular-devkit/core": "~21.2.0",
"@angular-devkit/schematics": "~21.2.0",
Or Apply changes locally with:
npx nx-cloud apply-locally pRtk-RHkB
Apply fix locally with your editor ↗ View interactive diff ↗
🎓 Learn more about Self-Healing CI on nx.dev
This PR contains the following updates:
21.2.18→21.2.19Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
CVE-2026-68945 / GHSA-jhpw-976m-542j
More information
Details
Angular's
HttpTransferCachecaches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.During SSR,
HttpTransferCachepreviously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:Both requests previously serialized as
role=user,admin, allowing distinctHttpClientrequests to produce the same transfer-cache key material.Impact
In an SSR application, this cache-key ambiguity can make a later security-sensitive
HttpClientrequest receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to:Patched Versions
Workarounds
If you cannot upgrade immediately, configure your
HttpClientrequests to skip transfer caching for sensitive endpoints where repeated parameter keys are used:Alternatively, disable the HTTP transfer cache globally in your application bootstrap config:
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
angular/angular (@angular/common)
v21.2.19Compare Source
compiler
http
platform-server
Configuration
📅 Schedule: (in timezone Europe/Paris)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.