docs: document allowedHosts SSR requirement in v21 update guide#68403
docs: document allowedHosts SSR requirement in v21 update guide#68403erkamyaman wants to merge 1 commit intoangular:mainfrom
Conversation
The GHSA-x288-3778-4hhx patch requires `allowedHosts` on `CommonEngine` or SSR silently falls back to CSR. Add a checklist item to the v21 update guide.
| 'The `lastSuccessfulNavigation` property on the Router has been converted to a signal. To get its value, you now need to invoke it as a function: `router.lastSuccessfulNavigation()`.', | ||
| }, | ||
| { | ||
| possibleIn: 2100, |
There was a problem hiding this comment.
This is actually not possible in 21.0.0, it became available in 21.1.5. So we can't include it in the v21 update guide, it will need to be in v22 as our update guide typically only shows instructions for major versions.
While its possible to define support for 21.1.5 as the target version in the update guide I don't think that we would want to have it included here, from an update guide perspective this should be in v22. If you want the action text to include that its available as of 21.1.5 I think that is fine as well.
There was a problem hiding this comment.
I would have said that this is actually okay. The update guide itself recommands running ng update @angular/core@21 @angular/cli@21 which will update to 21.2+.
The GHSA-x288-3778-4hhx patch requires
allowedHostsonCommonEngineor SSR silently falls back to CSR. Add a checklist item to the v21 update guide.fixes #68391
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
The Angular update guide does not mention that security patch GHSA-x288-3778-4hhx makes
allowedHostsmandatory onCommonEngine. Apps that upgrade without setting it see SSR silently fall back to CSR — HTTP 200 with an empty<app-root></app-root>and only aconsole.errorthat's easy to miss.Issue Number: #68391
What is the new behavior?
The update checklist now includes a step for upgrades that cross v21, instructing SSR users to set
allowedHostsonCommonEngineinserver.tsand pointing to security advisory GHSA-x288-3778-4hhx as the rationale.Does this PR introduce a breaking change?
Other information
Addresses ask (a) from the issue. The other two asks, an
ng updateACTION REQUIREDwarning and a more visible runtime fallback, involve CLI migration scripts and@angular/ssrruntime behavior, so they're out of scope for this docs PR.