fix(deps): update all non-major dependencies#77
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #77 +/- ##
=======================================
Coverage 99.36% 99.36%
=======================================
Files 110 110
Lines 947 947
Branches 45 45
=======================================
Hits 941 941
Misses 6 6 ☔ View full report in Codecov by Sentry. 🚨 Try these New Features:
|
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
5 times, most recently
from
533540d to
9bdfd85
Compare
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
8 times, most recently
from
013c324 to
d556502
Compare
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
7 times, most recently
from
2811ca1 to
16ecaf1
Compare
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
5 times, most recently
from
5cb62cd to
0439c93
Compare
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
4 times, most recently
from
86aff99 to
1256698
Compare
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
4 times, most recently
from
17b5c1a to
264ee35
Compare
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
3 times, most recently
from
25e7ca2 to
deda8ca
Compare
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
7 times, most recently
from
f928cc2 to
f03b595
Compare
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
4 times, most recently
from
5446a2f to
7dde23f
Compare
renovate
bot
force-pushed
the
renovate/all-non-major-dependencies
branch
7 times, most recently
from
73d74cd to
ace8b7c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.10.0→4.13.01.10.1→1.14.30.7.10→0.8.012.1.0→12.2.210.3.3→10.4.2210.3.3→10.4.2210.2.7→10.2.812.1.1→12.2.210.3.3→10.4.2210.3.3→10.4.227.3.0→7.4.220.11.24→20.19.390.14.1→0.15.116.4.5→16.6.18.0.0→8.1.18.57.0→8.57.13.6.1→3.10.12.29.1→2.32.05.1.3→5.5.516.8.1→16.13.21.22.5→1.25.015.2.2→15.5.2v2.4.0→v2.4.13.2.5→3.8.10.2.1→0.2.25.0.5→5.0.107.8.1→7.8.229.1.2→29.4.91.12.4→1.13.45.3.3→5.9.3Release Notes
apollographql/apollo-server (@apollo/server)
v4.13.0Compare Source
Minor Changes
#8180⚠️ SECURITY
e9d49d1Thanks @github-actions! -@apollo/server/standalone:The default configuration of
startStandaloneServerwas vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
Any other character set will be rejected with a
415 Unsupported Media Typeerror.Additionally, upstream libraries used by this version of Apollo Server may not support all of these encodings, so some requests may still fail even if they pass this check.
If you were not using
startStandaloneServer, you were not affected by this vulnerability.Generally, please note that we provide
startStandaloneServeras a convenience tool for quickly getting started with Apollo Server.For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.
Also please note that Apollo Server 4.x is considered EOL as of January 26, 2026, and Apollo no longer commits to providing support or updates for it. Please prioritize migrating to Apollo Server 5.x for continued support and updates.
v4.12.2Compare Source
(No change; there is a change to the
@apollo/server-integration-testsuiteused to test integrations, and the two packages always have matching versions.)v4.12.1Compare Source
Patch Changes
41f98d4Thanks @glasser! - Update README.md to recommend Express v5 integration now that Express v5 is released.v4.12.0Compare Source
Minor Changes
89e3f84Thanks @clenfest! - Adds a new graphql-js validation rule to reject operations that recursively request selections above a specified maximum, which is disabled by default. Use configuration optionmaxRecursiveSelections=trueto enable with a maximum of 10,000,000, ormaxRecursiveSelections=<number>for a custom maximum. Enabling this validation can help avoid performance issues with configured validation rules or plugins.Patch Changes
2550d9fThanks @slagiewka! - Add return after sending 400 response in doubly escaped JSON parser middlewarev4.11.3Compare Source
Patch Changes
f4228e8Thanks @glasser! - Compatibility with Next.js Turbopack. Fixes #8004.v4.11.2Compare Source
(No change; there is a change to the
@apollo/server-integration-testsuiteused to test integrations, and the two packages always have matching versions.)v4.11.1Compare Source
Patch Changes
#7952
bb81b2cThanks @glasser! - Upgrade dependencies so that automated scans don't detect a vulnerability.@apollo/serverdepends onexpresswhich depends oncookie. Versions ofexpressolder than v4.21.1 depend on a version ofcookievulnerable to CVE-2024-47764. Users of olderexpressversions who callres.cookie()orres.clearCookie()may be vulnerable to this issue.However, Apollo Server does not call this function directly, and it does not expose any object to user code that allows TypeScript users to call this function without an unsafe cast.
The only way that this direct dependency can cause a vulnerability for users of Apollo Server is if you call
startStandaloneServerwith a context function that calls Express-specific methods such asres.cookie()orres.clearCookies()on the response object, which is a violation of the TypeScript types provided bystartStandaloneServer(which only promise that the response object is a core Node.jshttp.ServerResponserather than the Express-specific subclass). So this vulnerability can only affect Apollo Server users who use unsafe JavaScript or unsafeastypecasts in TypeScript.However, this upgrade will at least prevent vulnerability scanners from alerting you to this dependency, and we encourage all Express users to upgrade their project's own
expressdependency to v4.21.1 or newer.v4.11.0Compare Source
Minor Changes
#7916
4686454Thanks @andrewmcgivery! - AddhideSchemaDetailsFromClientErrorsoption to ApolloServer to allow hiding 'did you mean' suggestions from validation errors.Even with introspection disabled, it is possible to "fuzzy test" a graph manually or with automated tools to try to determine the shape of your schema. This is accomplished by taking advantage of the default behavior where a misspelt field in an operation
will be met with a validation error that includes a helpful "did you mean" as part of the error text.
For example, with this option set to
true, an error would readCannot query field "help" on type "Query".whereas with this option set tofalseit would readCannot query field "help" on type "Query". Did you mean "hello"?.We recommend enabling this option in production to avoid leaking information about your schema to malicious actors.
To enable, set this option to
truein yourApolloServeroptions:v4.10.5Compare Source
Patch Changes
#7821
b2e15e7Thanks @renovate! - Non-major dependency updates#7900
86d7111Thanks @trevor-scheer! - Inline a small dependency that was causing build issues for ESM projectsv4.10.4Compare Source
Patch Changes
18a3827Thanks @tninesling! - Subscription heartbeats are initialized prior to awaiting subscribe(). This allows long-running setup to happen in the returned Promise without the subscription being terminated prior to resolution.v4.10.3Compare Source
Patch Changes
5f335a5Thanks @tninesling! - Catch errors thrown by subscription generators, and gracefully clean up the subscription instead of crashing.v4.10.2Compare Source
Patch Changes
c7e514cThanks @TylerBloom! - In the subscription callback server plugin, terminating a subscription now immediately closes the internal async generator. This avoids that generator existing after termination and until the next message is received.v4.10.1Compare Source
Patch Changes
72f568eThanks @bscherlein! - Improves timing of thewillResolveFieldend hook on fields which return Promises resolving to Arrays. This makes the use of thesetCacheHintmethod more reliable.grpc/grpc-node (@grpc/grpc-js)
v1.14.3: @grpc/grpc-js 1.14.3Compare Source
v1.14.2: @grpc/grpc-js 1.14.2Compare Source
v1.14.1: @grpc/grpc-js 1.14.1Compare Source
v1.14.0: @grpc/grpc-js 1.14.0Compare Source
Changelog
getAuthContextmethod to client and server call classes (more details can be found in gRFC L35) (#2920)getConnectionInfomethod to theServerInterceptingCallclass (#2922)weighted_round_robinload balancing policy (#2998)round_robinLB policy (#2979)Experimental API Changes
Added:
CHANNEL_ARGS_CONFIG_SELECTOR_KEYStatusOr<T>CallStreamstatusOrFromValuestatusOrFromErrorModified:
ResolverListener#onSuccessfulResolutionnow has the signature(endpointList: StatusOr<Endpoint[]>, attributes: { [key: string]: unknown }, serviceConfig: StatusOr<ServiceConfig> | null, resolutionNote: string): booleanLoadBalancer#updateAddressListnow has the signature `updateAddressList(endpointList: StatusOr<Endpoint[]>,lbConfig: TypedLoadBalancingConfig, channelOptions: ChannelOptions, resolutionNote: string): booleanv1.13.4: @grpc/grpc-js 1.13.4Compare Source
ssl_target_name_overrideoption (#2956)v1.13.3: @grpc/grpc-js 1.13.3Compare Source
http2.getDefaultSettings(#2937)v1.13.2: @grpc/grpc-js 1.13.2Compare Source
v1.13.1: @grpc/grpc-js 1.13.1Compare Source
rejectUnauthorizedchannel credentials option to be handled incorrectly (#2926)retryThrottlingconfig was set (#2927)v1.13.0Compare Source
v1.12.6Compare Source
v1.12.5: @grpc/grpc-js 1.12.5Compare Source
v1.12.4: @grpc/grpc-js 1.12.4Compare Source
v1.12.3: @grpc/grpc-js 1.12.3Compare Source
v1.12.2: @grpc/grpc-js 1.12.2Compare Source
util.promisifyinstead offs/promisesfor Node 12 compatibility (#2838)v1.12.1: @grpc/grpc-js 1.12.1Compare Source
v1.12.0: @grpc/grpc-js 1.12.0Compare Source
Changelog
rejectUnauthorizedfield to theVerifyOptionsinterface, which can be passed as an argument tocredentials.createSslandcreateFromSecureContext(#2812 contributed by @vinothsa4891)Experimental API changes
Added:
CaCertificateUpdateCaCertificateUpdateListenerIdentityCertificateUpdateIdentityCertificateUpdateListenerCertificateProviderFileWatcherCertificateProviderFileWatcherCertificateProviderConfigcreateCertificateProviderChannelCredentialscreateCertificateProviderServerCredentialsModified:
LoadBalancer: The constructor now takes an additional argument of typeChannelCredentials.ChannelControlHelper#createSubchannel: Now takes an additional argument of typeChannelCredentials | null. This should be passed along if overriding this function.LeafLoadBalancer: The constructor now takes an additional argument of typeChannelCredentials.v1.11.3: @grpc/grpc-js 1.11.3Compare Source
v1.11.2: @grpc/grpc-js 1.11.2Compare Source
v1.11.1: @grpc/grpc-js 1.11.1Compare Source
v1.11.0: @grpc/grpc-js 1.11.0Compare Source
Changelog
getHostmethod to server call objects (#2783, #2793)Experimental API changes
Added:
splitHostPortHostPortcreateServerCredentialsWithInterceptorsv1.10.11: @grpc/grpc-js 1.10.11Compare Source
v1.10.10: @grpc/grpc-js 1.10.10Compare Source
grpc.max_send_message_lengthchannel option (#2779)v1.10.9: @grpc/grpc-js 1.10.9Compare Source
grpc.max_receive_message_sizeper received message.v1.10.8: @grpc/grpc-js 1.10.8Compare Source
unix:targets to not reconnect after the channel goes idle (#2750)v1.10.7: @grpc/grpc-js 1.10.7Compare Source
@grpc/proto-loaderto the latest version (#2732)v1.10.6: @grpc/grpc-js 1.10.6Compare Source
v1.10.5: @grpc/grpc-js 1.10.5Compare Source
Error.stackTraceLimitisundefined(#2701 contributed by @davidfiala)checkServerIdentitywhengrpc.ssl_target_name_overrideis set (#2704)v1.10.4: @grpc/grpc-js 1.10.4Compare Source
ResponderBuilderandListenerBuilderobjects (#2696)v1.10.3: @grpc/grpc-js 1.10.3Compare Source
v1.10.2: @grpc/grpc-js 1.10.2Compare Source
nestjs/graphql (@nestjs/apollo)
v12.2.2Compare Source
12.2.2 (2024-12-04)
Enhancements
graphqldefaultTypeMappingtype reinforcement (@Neosoulink)Dependencies
mercuriusgraphqlapollo,graphql,mercuriusCommitters: 2
v12.2.1Compare Source
12.2.1 (2024-10-23)
Bug fixes
graphqlEnhancements
apollographqlDependencies
graphqlapollo,graphql,mercuriusCommitters: 4
v12.2.0Compare Source
v12.2.0 (2024-07-02)
Bug fixes
graphqlapollo,graphqlEnhancements
apollo,graphqlDocs
graphqlDependencies
apollo,graphql,mercuriusmercuriusgraphqlConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.