fix(deps, frontend): update dependency @angular/common to v21.2.19

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/common (source)	21.2.18 → 21.2.19

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

CVE-2026-68945 / GHSA-jhpw-976m-542j

More information

Details

Angular's HttpTransferCache caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.

During SSR, HttpTransferCache previously generated identical key material for distinct request parameters when repeated values were present because repeated values were joined with commas:

new HttpParams().set('role', 'user,admin')
new HttpParams().append('role', 'user').append('role', 'admin')

Both requests previously serialized as role=user,admin, allowing distinct HttpClient requests to produce the same transfer-cache key material.

Impact

In an SSR application, this cache-key ambiguity can make a later security-sensitive HttpClient request receive the response from an earlier semantically different request in the same render. For example, an attacker-influenced scalar-comma request can be cached and then replayed as the response for a trusted repeated-param authorization or data request to the same URL. As a result, Angular's server-rendered output can be based on the wrong backend response because the trusted request is not dispatched. This can lead to:

• State Poisoning: Using incorrect or attacker-influenced cached responses for subsequent application logic.
• Cross-Request Response Reuse: Reusing cached responses across requests with semantically different parameters.

Patched Versions

• 22.0.2
• 21.2.19
• 20.3.27

Workarounds

If you cannot upgrade immediately, configure your HttpClient requests to skip transfer caching for sensitive endpoints where repeated parameter keys are used:

this.http.get('/api/resource', {
  transferCache: false
});

Alternatively, disable the HTTP transfer cache globally in your application bootstrap config:

import { provideClientHydration, withNoHttpTransferCache } from '@​angular/platform-browser';

export const appConfig = {
  providers: [
    provideClientHydration(
      withNoHttpTransferCache()
    )
  ]
};

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j
• https://github.com/angular/angular/pull/68571
• https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c
• https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35
• https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b
• https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c
• https://github.com/angular/angular

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/common)

v21.2.19

Compare Source

compiler

Commit	Type	Description
e2660c3dee	fix	disallow i18n event attributes
7b884f585a	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
948a8d6831	fix	distinguish repeated transfer cache params
9949dccce1	fix	enable xsrf for root-provided HttpClient

platform-server

Commit	Type	Description
f34a93c946	fix	update domino to latest version

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• No candidates found from git blame history.

[github-actions]

Backport auto-label report

This fix: PR was checked against each actively-supported release branch. release/* labels drive the post-merge backport, so add or remove one to change where this fix lands.

Release branch	Analysis
✅ release/v1.2	Already labeled — this fix is queued to backport here.

Auto-label run.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Updates the frontend’s @angular/common dependency from 21.2.18 to 21.2.19 (includes a security fix for HttpTransferCache key ambiguity in SSR).

Changes:

• Bump @angular/common to 21.2.19 in frontend/package.json
• Update frontend/yarn.lock to resolve @angular/common@21.2.19 and its peer dependency metadata

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
frontend/package.json	Updates the declared @angular/common version to 21.2.19.
frontend/yarn.lock	Updates lockfile resolution/checksum for @angular/common@21.2.19 and updates the root dependency entry.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.19%. Comparing base (f51a8a9) to head (6b91ba2).

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #7286      +/-   ##
============================================
- Coverage     83.19%   83.19%   -0.01%     
+ Complexity     4116     4113       -3     
============================================
  Files          1166     1166              
  Lines         46456    46456              
  Branches       5177     5177              
============================================
- Hits          38651    38647       -4     
  Misses         6098     6098              
- Partials       1707     1711       +4     

Flag	Coverage Δ		*Carryforward flag
access-control-service	70.00% <ø> (ø)		Carriedforward from 2fb1ff4
agent-service	83.65% <ø> (ø)		Carriedforward from 2fb1ff4
amber	80.40% <ø> (-0.02%)	⬇️	Carriedforward from 2fb1ff4
computing-unit-managing-service	43.60% <ø> (ø)		Carriedforward from 2fb1ff4
config-service	65.97% <ø> (ø)		Carriedforward from 2fb1ff4
file-service	69.05% <ø> (ø)		Carriedforward from 2fb1ff4
frontend	83.84% <ø> (-0.01%)	⬇️
notebook-migration-service	78.89% <ø> (ø)		Carriedforward from 2fb1ff4
pyamber	97.36% <ø> (ø)		Carriedforward from 2fb1ff4
workflow-compiling-service	26.31% <ø> (ø)		Carriedforward from 2fb1ff4

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[forking-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Backport PR opened: draft #7308 (#7308) to release/v1.2, assigned to @renovate-bot — needs manual work because the cherry-pick conflicts.