-
-
Notifications
You must be signed in to change notification settings - Fork 4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): update dependency @apollo/server to v4.11.2 #486
Open
renovate
wants to merge
1
commit into
master
Choose a base branch
from
renovate/apollo-graphql-packages
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.9.4
chore(deps): update dependency @apollo/server to v4.9.5
Oct 26, 2023
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
October 26, 2023 21:55
ffe662f
to
3f62ab2
Compare
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
3 times, most recently
from
November 13, 2023 11:12
7a3da42
to
4a3d7cc
Compare
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
January 2, 2024 22:27
4a3d7cc
to
531b873
Compare
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.9.5
chore(deps): update dependency @apollo/server to v4.10.0
Jan 2, 2024
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
3 times, most recently
from
January 5, 2024 10:06
3044ad0
to
a034766
Compare
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
March 5, 2024 20:36
a034766
to
af69a19
Compare
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.10.0
chore(deps): update dependency @apollo/server to v4.10.1
Mar 5, 2024
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
March 6, 2024 09:05
af69a19
to
2357bc1
Compare
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
March 22, 2024 21:37
2357bc1
to
590701c
Compare
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.10.1
chore(deps): update dependency @apollo/server to v4.10.2
Mar 22, 2024
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.10.2
chore(deps): update dependency @apollo/server to v4.10.3
Apr 15, 2024
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
2 times, most recently
from
April 18, 2024 20:12
e2291d1
to
9bf552b
Compare
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.10.3
chore(deps): update dependency @apollo/server to v4.10.4
Apr 18, 2024
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
June 10, 2024 08:03
9bf552b
to
2380644
Compare
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
July 23, 2024 01:05
2380644
to
98c31e1
Compare
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.10.4
chore(deps): update dependency @apollo/server to v4.10.5
Jul 23, 2024
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
August 8, 2024 17:15
98c31e1
to
d96df1b
Compare
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.10.5
chore(deps): update dependency @apollo/server to v4.11.0
Aug 8, 2024
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
October 29, 2024 19:51
d96df1b
to
51eb8d8
Compare
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.11.0
chore(deps): update dependency @apollo/server to v4.11.1
Oct 29, 2024
renovate
bot
force-pushed
the
renovate/apollo-graphql-packages
branch
from
October 30, 2024 00:58
51eb8d8
to
4405a11
Compare
renovate
bot
changed the title
chore(deps): update dependency @apollo/server to v4.11.1
chore(deps): update dependency @apollo/server to v4.11.2
Oct 30, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.9.3
->4.11.2
Release Notes
apollographql/apollo-server (@apollo/server)
v4.11.2
Compare Source
(No change; there is a change to the
@apollo/server-integration-testsuite
used to test integrations, and the two packages always have matching versions.)v4.11.1
Compare Source
Patch Changes
#7952
bb81b2c
Thanks @glasser! - Upgrade dependencies so that automated scans don't detect a vulnerability.@apollo/server
depends onexpress
which depends oncookie
. Versions ofexpress
older than v4.21.1 depend on a version ofcookie
vulnerable to CVE-2024-47764. Users of olderexpress
versions who callres.cookie()
orres.clearCookie()
may be vulnerable to this issue.However, Apollo Server does not call this function directly, and it does not expose any object to user code that allows TypeScript users to call this function without an unsafe cast.
The only way that this direct dependency can cause a vulnerability for users of Apollo Server is if you call
startStandaloneServer
with a context function that calls Express-specific methods such asres.cookie()
orres.clearCookies()
on the response object, which is a violation of the TypeScript types provided bystartStandaloneServer
(which only promise that the response object is a core Node.jshttp.ServerResponse
rather than the Express-specific subclass). So this vulnerability can only affect Apollo Server users who use unsafe JavaScript or unsafeas
typecasts in TypeScript.However, this upgrade will at least prevent vulnerability scanners from alerting you to this dependency, and we encourage all Express users to upgrade their project's own
express
dependency to v4.21.1 or newer.v4.11.0
Compare Source
Minor Changes
#7916
4686454
Thanks @andrewmcgivery! - AddhideSchemaDetailsFromClientErrors
option to ApolloServer to allow hiding 'did you mean' suggestions from validation errors.Even with introspection disabled, it is possible to "fuzzy test" a graph manually or with automated tools to try to determine the shape of your schema. This is accomplished by taking advantage of the default behavior where a misspelt field in an operation
will be met with a validation error that includes a helpful "did you mean" as part of the error text.
For example, with this option set to
true
, an error would readCannot query field "help" on type "Query".
whereas with this option set tofalse
it would readCannot query field "help" on type "Query". Did you mean "hello"?
.We recommend enabling this option in production to avoid leaking information about your schema to malicious actors.
To enable, set this option to
true
in yourApolloServer
options:v4.10.5
Compare Source
Patch Changes
#7821
b2e15e7
Thanks @renovate! - Non-major dependency updates#7900
86d7111
Thanks @trevor-scheer! - Inline a small dependency that was causing build issues for ESM projectsv4.10.4
Compare Source
Patch Changes
18a3827
Thanks @tninesling! - Subscription heartbeats are initialized prior to awaiting subscribe(). This allows long-running setup to happen in the returned Promise without the subscription being terminated prior to resolution.v4.10.3
Compare Source
Patch Changes
5f335a5
Thanks @tninesling! - Catch errors thrown by subscription generators, and gracefully clean up the subscription instead of crashing.v4.10.2
Compare Source
Patch Changes
c7e514c
Thanks @TylerBloom! - In the subscription callback server plugin, terminating a subscription now immediately closes the internal async generator. This avoids that generator existing after termination and until the next message is received.v4.10.1
Compare Source
Patch Changes
72f568e
Thanks @bscherlein! - Improves timing of thewillResolveField
end hook on fields which return Promises resolving to Arrays. This makes the use of thesetCacheHint
method more reliable.v4.10.0
Compare Source
Minor Changes
#7786
869ec98
Thanks @ganemone! - Restore missing v1skipValidation
option asdangerouslyDisableValidation
. Note that enabling this option exposes your server to potential security and unexpected runtime issues. Apollo will not support issues that arise as a result of using this option.#7803
e9a0d6e
Thanks @favna! - allowstringifyResult
to return aPromise<string>
Users who implemented the
stringifyResult
hook can now expect error responses to be formatted with the hook as well. Please take care when updating to this version to ensure this is the desired behavior, or implement the desired behavior accordingly in yourstringifyResult
hook. This was considered a non-breaking change as we consider that it was an oversight in the original PR that introducedstringifyResult
hook.Patch Changes
#7793
9bd7748
Thanks @bnjjj! - General availability of subscription callback protocol#7799
63dc50f
Thanks @stijnbe! - Fix type of ApolloServerPluginUsageReporting reportTimer#7740
fe68c1b
Thanks @barnisanov! - Uninstalledbody-parser
and usedexpress
built-inbody-parser
functionality instead(mainly the json middleware)v4.9.5
Compare Source
Patch Changes
#7741
07585fe39
Thanks @mayakoneval! - Pin major releases of embeddable Explorer & Sandbox code.#7769
4fac1628c
Thanks @cwikla! - Change SchemaReporter.pollTimer from being a NodeJS.Timer to a NodeJS.Timeoutv4.9.4
Compare Source
Patch Changes
#7747
ddce036e1
Thanks @trevor-scheer! - The minimum version ofgraphql
officially supported by Apollo Server 4 as a peer dependency, v16.6.0, contains a serious bug that can crash your Node server. This bug is fixed in the immediate next version,[email protected]
, and we strongly encourage you to upgrade your installation ofgraphql
to at least v16.7.0 to avoid this bug. (For backwards compatibility reasons, we cannot change Apollo Server 4's minimum peer dependency, but will change it when we release Apollo Server 5.)Apollo Server 4 contained a particular line of code that makes triggering this crashing bug much more likely. This line was already removed in Apollo Server v3.8.2 (see #6398) but the fix was accidentally not included in Apollo Server 4. We are now including this change in Apollo Server 4, which will reduce the likelihood of hitting this crashing bug for users of
graphql
v16.6.0. That said, taking this@apollo/server
upgrade does not prevent this bug from being triggered in other ways, and the real fix to this crashing bug is to upgradegraphql
.Configuration
📅 Schedule: Branch creation - "* 0-3 * * 1" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.