New Web App deployment loses URL query string parameters in nested HtmlService iframes; older deployment on same project still works (filed as Google Issue 553614966)

[Pietro Paolo Conconi]

I maintain a Google Apps Script web app used in production for years, built around doGet(e) that reads query string parameters (for example maschera, compagnia, esercizio) and loads different HTML masks inside nested iframes via HtmlService.createHtmlOutputFromFile(). I am seeing two related problems that both point to the same root cause on Google's side.

First, on the long-standing deployment, republishing an update (Deploy, Manage deployments, Edit, New version) sometimes does not serve the updated HTML/JS to users; they keep getting old cached content from the web app URL even after a hard refresh and in incognito windows, until much later when it updates on its own.

Second, and more seriously, I created a brand-new Web App deployment from the same project, using identical Code.gs and HTML files as the working one. On this new deployment, the top-level page loads fine, but every link that passes query parameters to load a specific mask fails: the parameters never reach the inner iframe content, and the app falls back to a session lost state. I confirmed via DevTools that the query string is present on the initial request but is not available inside the nested iframe's window.location. I also tried switching from HtmlService.createHtmlOutputFromFile() to HtmlService.createTemplateFromFile().evaluate(), with no difference. The old deployment, on the same project with the same code, continues to pass parameters correctly; only newly created deployments show this failure.

I filed this with Google as Issue 553614966, currently status Assigned. Has anyone else run into new Apps Script Web App deployments failing to propagate query parameters into nested iframes, or serving stale content after republishing, while older deployments on the same project keep working? Is there a known workaround, for example passing state via PropertiesService, a URL hash fragment, or postMessage instead of relying on query parameters reaching the iframe?