Skip to content

Update all apollo server non-major dependencies - #101

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/upper-case-directive-all-apollo-server-minor-patch
Open

Update all apollo server non-major dependencies#101
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/upper-case-directive-all-apollo-server-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 26, 2023 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@apollo/server (source) 5.0.0 → 5.5.1 age confidence
@graphql-tools/schema (source) 10.0.24 → 10.0.38 age confidence
@graphql-tools/utils (source) 10.9.0 → 10.11.0 age confidence
@types/node (source) 20.19.8 → 20.19.43 age confidence
@types/node (source) 18.17.0 → 18.19.130 age confidence
apollo-server (source) 3.12.0 → 3.13.0 age confidence
apollo-server (source) 2.26.1 → 2.26.2 age confidence
graphql 16.11.0 → 16.14.2 age confidence
typescript (source) 5.8.3 → 5.9.3 age confidence

Release Notes

apollographql/apollo-server (@​apollo/server)

v5.5.1

Compare Source

Patch Changes

v5.5.0

Compare Source

Minor Changes

  • #​8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

v5.4.0

Compare Source

Minor Changes

  • d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

    The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

    In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
    Any other character set will be rejected with a 415 Unsupported Media Type error.
    Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8.
    Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now.
    In a future major release, we may tighten this restriction further to only allow UTF-8.

    If you were not using startStandaloneServer, you were not affected by this vulnerability.

    Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
    For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

v5.3.0

Compare Source

Minor Changes

  • #​8062 8e54e58 Thanks @​cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

    const server = new ApolloServer({
  typeDefs,
  resolvers,
  executionOptions: {
    maxCoercionErrors: 50,
  },
});

  • #​8014 26320bc Thanks @​mo4islona! - Expose graphql validation options.

    const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationOptions: {
    maxErrors: 10,
  },
});

v5.2.0

Compare Source

Minor Changes

  • #​8161 51acbeb Thanks @​jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.

    import { legacyExecuteIncrementally } from '@​yaacovcr/transform';

const server = new ApolloServer({
  // ...
  legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
});

    If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

v5.1.0

Compare Source

Minor Changes

  • #​8148 80a1a1a Thanks @​jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with graphql@17.0.0-alpha.9. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.

    Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.

ardatan/graphql-tools (@​graphql-tools/schema)

v10.0.38

Compare Source

Patch Changes

v10.0.37

Compare Source

Patch Changes

v10.0.36

Compare Source

Patch Changes

v10.0.35

Compare Source

Patch Changes

v10.0.34

Compare Source

Patch Changes

v10.0.33

Compare Source

Patch Changes

v10.0.32

Compare Source

Patch Changes

v10.0.31

Compare Source

Patch Changes

v10.0.30

Compare Source

Patch Changes

v10.0.29

Compare Source

Patch Changes

v10.0.28

Compare Source

Patch Changes

v10.0.27

Compare Source

Patch Changes

v10.0.26

Compare Source

Patch Changes

v10.0.25

Compare Source

Patch Changes
ardatan/graphql-tools (@​graphql-tools/utils)

v10.11.0

Compare Source

Minor Changes

  • #​7588
    2118a80
    Thanks @​EmrysMyrddin! - Add optional schema coordinate in error
    extensions. This extension allows to precisely identify the source of the error by automated tools
    like tracing or monitoring.

    This new feature is opt-in, you have to enable it using schemaCoordinateInErrors executor
    option.

    Caution: This feature, when enabled, will expose information about your schema. If you need to
    keep your schema private and secret, you should strip this attribute at serialization time before
    sending errors to the client.

    import { parse } from 'graphql'
import { normalizedExecutor } from '@​graphql-tools/executor'
import { getSchemaCoordinate } from '@​graphql-tools/utils'
import schema from './schema'

const result = await normalizedExecutor({
  schema,
  document: parse(`...`),
  schemaCoordinateInErrors: true // enable adding schema coordinate to graphql errors
})

if (result.errors) {
  for (const error of result.errors) {
    console.log('Error in resolver ', error.coordinate, ':', error.message)
    // or with `getSchemaCoordinate` util, to workaround types if needed
    console.log('Error in resolver', getSchemaCoordinate(error), ':', error.message)
  }
}

v10.10.3

Compare Source

Patch Changes
  • #​7683
    2fe123a
    Thanks @​ardatan! - Revert
    #​7683 which can cause unexpected breaking changes so
    as before the schema extension node will always be converted to a schema definition node

v10.10.2

Compare Source

Patch Changes

  • #​7679
    dddc5f6
    Thanks @​ardatan! - Support "federation/subgraph style" schemas in
    astFromSchema and printSchemaWithDirectives

    If a GraphQLSchema doesn't have any defined operation types, we should print the schema
    definition as an extension rather than omitting it entirely. They are not a valid schema on their
    own, but they are valid subgraph schemas in a federation setup, and it is possible to build such
    schemas with assumeValid options.

    // A schema without defined root types
buildSchema(
  /* GraphQL */ `
    extend schema @​link(url: "https://specs.apollo.dev/federation/v2.0", import: ["@​key"])

    type User @​key(fields: "id") {
      id: ID!
      username: String
    }
  `,
  { assumeValid: true, assumeValidSDL: true }
)

v10.10.1

Compare Source

Patch Changes

v10.10.0

Compare Source

Minor Changes

  • #​5269
    fded91e
    Thanks @​uroslates! - Add default values to the arguments

    When the schema is like following;

    type Query {
    getAllPages(currentPage: Int = 0, pageSize: Int = 10, pageType: getAllPages_pageType = ContentPage, sort: String = "asc"): PagesList
}

enum getAllPages_pageType {
    ContentPage
    CategoryPage
    CatalogPage
}

type PagesList {
    ...
}

    The generated operation will be like following;

    query getAllPages_query($currentPage: Int = 0, $pageSize: Int = 10, $pageType: getAllPages_pageType = ContentPage, $sort: String = "asc") {
    getAllPages(currentPage: $currentPage, pageSize: $pageSize, pageType: $pageType, sort: $sort) {
        ...
    }
}
Patch Changes

  • #​7012
    fd105f4
    Thanks @​ardatan! - Fix the bug in mergeDeep;

    The following inputs and outputs are corrected;

    • mergeDeep([{a:2}, undefined]) - Any nullish values should be ignored so it should return
      {a:2}
    • mergeDeep([]) - no sources should return undefined
    • mergeDeep([undefined]) - no sources should return undefined

  • #​5294
    3b99a9b
    Thanks @​n1ru4l! - Do not map builtin scalars

v10.9.1

Compare Source

Patch Changes
apollographql/apollo-server (apollo-server)

v3.13.0

Compare Source

v3.12.1

Compare Source

graphql/graphql-js (graphql)

v16.14.2

Compare Source

v16.14.2 (2026-06-09)

Docs 📝
7 PRs were merged
Polish 💅
Committers: 2

v16.14.1

Compare Source

v16.14.1 (2026-06-02)

Docs 📝
9 PRs were merged
Polish 💅
Internal 🏠
Committers: 2

v16.14.0

Compare Source

v16.14.0 (2026-05-03)

New Feature 🚀
Bug Fix 🐞
Docs 📝
Committers: 4

v16.13.2

Compare Source

v16.13.1

Compare Source

v16.13.0: 16.13.0

Compare Source

v16.13.0 (2026-02-24)

New Feature 🚀
Bug Fix 🐞
Internal 🏠
3 PRs were merged
Committers: 4

v16.12.0: 16.12.0

Compare Source

v16.12.0 (2025-11-01)

New Feature 🚀
Bug Fix 🐞
Docs 📝
28 PRs were merged
Polish 💅
Internal 🏠
3 PRs were merged
Committers: 9
microsoft/TypeScript (typescript)

v5.9.3: TypeScript 5.9.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

v5.9.2: TypeScript 5.9

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title chore(deps): update dependency @types/node to v18.17.1 fix(deps): update all apollo server non-major dependencies Jul 27, 2023
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 4 times, most recently from e86e645 to 685d13c Compare August 8, 2023 20:40
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from 2c379e3 to 8ef8f60 Compare August 18, 2023 20:45
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 5 times, most recently from 6318d6c to e3511f1 Compare August 28, 2023 01:07
@renovate renovate Bot changed the title fix(deps): update all apollo server non-major dependencies chore(deps): update all apollo server non-major dependencies Aug 30, 2023
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from 3fc273d to 789e336 Compare September 2, 2023 23:07
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from d697a8f to e8681c2 Compare September 15, 2023 08:31
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from 3d5a12d to e410c8e Compare September 19, 2023 10:12
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 3 times, most recently from 9749e98 to 63efad4 Compare October 7, 2023 02:03
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from c58f04d to 9f43f7f Compare October 18, 2023 10:11
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from 1b61a02 to 8352b18 Compare October 31, 2023 11:11
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from 9bb192d to fda1f5a Compare November 14, 2023 02:09
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from eefec55 to 198dd5b Compare January 17, 2024 08:36
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 3 times, most recently from 1e02fc9 to bdb264e Compare January 30, 2024 23:04
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 3 times, most recently from daa298d to 57194a2 Compare February 1, 2024 19:40
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 3 times, most recently from e941f6e to 1382c5b Compare February 15, 2024 16:43
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 4 times, most recently from 77fd042 to 6c16eab Compare February 29, 2024 14:22
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 3 times, most recently from 943a4cd to 7647796 Compare March 13, 2024 14:04
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from 3d648f2 to 472062a Compare March 19, 2024 16:12
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 3 times, most recently from a81d9cc to caafb8b Compare April 2, 2024 23:18
@renovate renovate Bot changed the title chore(deps): update all apollo server non-major dependencies fix(deps): update all apollo server non-major dependencies Apr 3, 2024
@renovate renovate Bot changed the title fix(deps): update all apollo server non-major dependencies chore(deps): update all apollo server non-major dependencies Apr 3, 2024
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from a22f13b to 42cc07e Compare April 9, 2024 04:36
@renovate
renovate Bot force-pushed the renovate/upper-case-directive-all-apollo-server-minor-patch branch 2 times, most recently from cc6e783 to f8d635e Compare May 8, 2024 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@trevor-scheer trevor-scheer

Labels

apollo-server

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@trevor-scheer