Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 5, 2024

This PR contains the following updates:

Package Change Age Confidence Type Update
@apollo/server (source) 4.10.0 -> 4.12.2 age confidence dependencies minor
@grpc/grpc-js (source) 1.10.1 -> 1.14.1 age confidence dependencies minor
@grpc/proto-loader (source) 0.7.10 -> 0.8.0 age confidence dependencies minor
@nestjs/apollo 12.1.0 -> 12.2.2 age confidence dependencies minor
@nestjs/common (source) 10.3.3 -> 10.4.20 age confidence dependencies minor
@nestjs/core (source) 10.3.3 -> 10.4.20 age confidence dependencies minor
@nestjs/cqrs 10.2.7 -> 10.2.8 age confidence dependencies patch
@nestjs/graphql 12.1.1 -> 12.2.2 age confidence dependencies minor
@nestjs/microservices (source) 10.3.3 -> 10.4.20 age confidence dependencies minor
@nestjs/platform-fastify (source) 10.3.3 -> 10.4.20 age confidence dependencies minor
@nestjs/swagger 7.3.0 -> 7.4.2 age confidence dependencies minor
@types/node (source) 20.11.24 -> 20.19.24 age confidence devDependencies minor
class-validator 0.14.1 -> 0.14.2 age confidence dependencies patch
dotenv 16.4.5 -> 16.6.1 age confidence dependencies minor
envalid 8.0.0 -> 8.1.1 age confidence dependencies minor
eslint (source) 8.57.0 -> 8.57.1 age confidence devDependencies patch
eslint-import-resolver-typescript 3.6.1 -> 3.10.1 age confidence devDependencies minor
eslint-plugin-import 2.29.1 -> 2.32.0 age confidence devDependencies minor
eslint-plugin-prettier 5.1.3 -> 5.5.4 age confidence devDependencies minor
graphql 16.8.1 -> 16.12.0 age confidence dependencies minor
graphql-scalars 1.22.5 -> 1.25.0 age confidence dependencies minor
lint-staged 15.2.2 -> 15.5.2 age confidence devDependencies minor
pnpm/action-setup v2.4.0 -> v2.4.1 age confidence action patch
prettier (source) 3.2.5 -> 3.6.2 age confidence devDependencies minor
reflect-metadata (source) 0.2.1 -> 0.2.2 age confidence dependencies patch
rimraf 5.0.5 -> 5.0.10 age confidence devDependencies patch
rxjs (source) 7.8.1 -> 7.8.2 age confidence dependencies patch
ts-jest (source) 29.1.2 -> 29.4.5 age confidence devDependencies minor
turbo (source) 1.12.4 -> 1.13.4 age confidence devDependencies minor
typescript (source) 5.3.3 -> 5.9.3 age confidence devDependencies minor

Release Notes

apollographql/apollo-server (@​apollo/server)

v4.12.2

Compare Source

(No change; there is a change to the @apollo/server-integration-testsuite used to test integrations, and the two packages always have matching versions.)

v4.12.1

Compare Source

Patch Changes

v4.12.0

Compare Source

Minor Changes
  • #​8054 89e3f84 Thanks @​clenfest! - Adds a new graphql-js validation rule to reject operations that recursively request selections above a specified maximum, which is disabled by default. Use configuration option maxRecursiveSelections=true to enable with a maximum of 10,000,000, or maxRecursiveSelections=<number> for a custom maximum. Enabling this validation can help avoid performance issues with configured validation rules or plugins.
Patch Changes

v4.11.3

Compare Source

Patch Changes

v4.11.2

Compare Source

(No change; there is a change to the @apollo/server-integration-testsuite used to test integrations, and the two packages always have matching versions.)

v4.11.1

Compare Source

Patch Changes
  • #​7952 bb81b2c Thanks @​glasser! - Upgrade dependencies so that automated scans don't detect a vulnerability.

    @apollo/server depends on express which depends on cookie. Versions of express older than v4.21.1 depend on a version of cookie vulnerable to CVE-2024-47764. Users of older express versions who call res.cookie() or res.clearCookie() may be vulnerable to this issue.

    However, Apollo Server does not call this function directly, and it does not expose any object to user code that allows TypeScript users to call this function without an unsafe cast.

    The only way that this direct dependency can cause a vulnerability for users of Apollo Server is if you call startStandaloneServer with a context function that calls Express-specific methods such as res.cookie() or res.clearCookies() on the response object, which is a violation of the TypeScript types provided by startStandaloneServer (which only promise that the response object is a core Node.js http.ServerResponse rather than the Express-specific subclass). So this vulnerability can only affect Apollo Server users who use unsafe JavaScript or unsafe as typecasts in TypeScript.

    However, this upgrade will at least prevent vulnerability scanners from alerting you to this dependency, and we encourage all Express users to upgrade their project's own express dependency to v4.21.1 or newer.

v4.11.0

Compare Source

Minor Changes
  • #​7916 4686454 Thanks @​andrewmcgivery! - Add hideSchemaDetailsFromClientErrors option to ApolloServer to allow hiding 'did you mean' suggestions from validation errors.

    Even with introspection disabled, it is possible to "fuzzy test" a graph manually or with automated tools to try to determine the shape of your schema. This is accomplished by taking advantage of the default behavior where a misspelt field in an operation
    will be met with a validation error that includes a helpful "did you mean" as part of the error text.

    For example, with this option set to true, an error would read Cannot query field "help" on type "Query". whereas with this option set to false it would read Cannot query field "help" on type "Query". Did you mean "hello"?.

    We recommend enabling this option in production to avoid leaking information about your schema to malicious actors.

    To enable, set this option to true in your ApolloServer options:

    const server = new ApolloServer({
      typeDefs,
      resolvers,
      hideSchemaDetailsFromClientErrors: true,
    });

v4.10.5

Compare Source

Patch Changes

v4.10.4

Compare Source

Patch Changes
  • #​7871 18a3827 Thanks @​tninesling! - Subscription heartbeats are initialized prior to awaiting subscribe(). This allows long-running setup to happen in the returned Promise without the subscription being terminated prior to resolution.

v4.10.3

Compare Source

Patch Changes
  • #​7866 5f335a5 Thanks @​tninesling! - Catch errors thrown by subscription generators, and gracefully clean up the subscription instead of crashing.

v4.10.2

Compare Source

Patch Changes
  • #​7849 c7e514c Thanks @​TylerBloom! - In the subscription callback server plugin, terminating a subscription now immediately closes the internal async generator. This avoids that generator existing after termination and until the next message is received.

v4.10.1

Compare Source

Patch Changes
  • #​7843 72f568e Thanks @​bscherlein! - Improves timing of the willResolveField end hook on fields which return Promises resolving to Arrays. This makes the use of the setCacheHint method more reliable.
grpc/grpc-node (@​grpc/grpc-js)

v1.14.1: @​grpc/grpc-js 1.14.1

Compare Source

  • Fix a regression of the settings used internally for HTTP/2 sessions (#​3023)

v1.14.0: @​grpc/grpc-js 1.14.0

Compare Source

Changelog
Experimental API Changes

Added:

  • CHANNEL_ARGS_CONFIG_SELECTOR_KEY
  • StatusOr<T>
  • CallStream
  • statusOrFromValue
  • statusOrFromError

Modified:

  • ResolverListener#onSuccessfulResolution now has the signature (endpointList: StatusOr<Endpoint[]>, attributes: { [key: string]: unknown }, serviceConfig: StatusOr<ServiceConfig> | null, resolutionNote: string): boolean
  • LoadBalancer#updateAddressList now has the signature `updateAddressList(endpointList: StatusOr<Endpoint[]>,lbConfig: TypedLoadBalancingConfig, channelOptions: ChannelOptions, resolutionNote: string): boolean

v1.13.4: @​grpc/grpc-js 1.13.4

Compare Source

  • Fix ability to set SNI with ssl_target_name_override option (#​2956)

v1.13.3: @​grpc/grpc-js 1.13.3

Compare Source

  • Disable Nagle's algorithm (#​2936)
  • Avoid calling http2.getDefaultSettings (#​2937)

v1.13.2: @​grpc/grpc-js 1.13.2

Compare Source

  • Fix a bug that caused clients to be unable to connect through local proxies (#​2933)

v1.13.1: @​grpc/grpc-js 1.13.1

Compare Source

  • Fix a bug that caused the rejectUnauthorized channel credentials option to be handled incorrectly (#​2926)
  • Fix a bug that caused the client to never send retries if any retryThrottling config was set (#​2927)
  • Fix a bug that caused clients to incorrectly send retries if the feature was disabled by a channel option and a retry config was provided (#​2927)

v1.13.0

Compare Source

v1.12.6

Compare Source

  • Allow garbage collection of IDLE channels (#​2896)

v1.12.5: @​grpc/grpc-js 1.12.5

Compare Source

  • Prioritize HTTP status errors over message decoding errors (#​2873)

v1.12.4: @​grpc/grpc-js 1.12.4

Compare Source

  • Prioritize reporting UNAVAILABLE status when handing connection drops (#​2862)

v1.12.3: @​grpc/grpc-js 1.12.3

Compare Source

  • Report UNAVAILABLE if possible when handling connection drops (#​2861)

v1.12.2: @​grpc/grpc-js 1.12.2

Compare Source

  • Use util.promisify instead of fs/promises for Node 12 compatibility (#​2838)

v1.12.1: @​grpc/grpc-js 1.12.1

Compare Source

  • Port bugfixes from 1.11.x into 1.12.x (#​2836)

v1.12.0: @​grpc/grpc-js 1.12.0

Compare Source

Changelog

  • Provide the method_name for the CallCredentials callback generateMetadata (#​2814 contributed by @​becoded)
  • Add an optional rejectUnauthorized field to the VerifyOptions interface, which can be passed as an argument to credentials.createSsl and createFromSecureContext (#​2812 contributed by @​vinothsa4891)

Experimental API changes

Added:

  • CaCertificateUpdate
  • CaCertificateUpdateListener
  • IdentityCertificateUpdate
  • IdentityCertificateUpdateListener
  • CertificateProvider
  • FileWatcherCertificateProvider
  • FileWatcherCertificateProviderConfig
  • createCertificateProviderChannelCredentials
  • createCertificateProviderServerCredentials

Modified:

  • LoadBalancer: The constructor now takes an additional argument of type ChannelCredentials.
  • ChannelControlHelper#createSubchannel: Now takes an additional argument of type ChannelCredentials | null. This should be passed along if overriding this function.
  • LeafLoadBalancer: The constructor now takes an additional argument of type ChannelCredentials.

v1.11.3: @​grpc/grpc-js 1.11.3

Compare Source

  • Ensure the client queries the name resolver again after connections drop while using the round_robin load balancing policy (#​2825)

v1.11.2: @​grpc/grpc-js 1.11.2

Compare Source

  • Fix client crash on receiving a custom error code (#​2801 contributed by @​hastom)
  • Report connection errors more consistently (#​2808)
  • Avoid computing the channel constructor trace log when that tracer is not enabled (#​2817 contributed by @​ygalbel)

v1.11.1: @​grpc/grpc-js 1.11.1

Compare Source

  • Revert a change that used APIs that were not available in early minor versions of Node 14 (#​2799 contributed by @​xqin)

v1.11.0: @​grpc/grpc-js 1.11.0

Compare Source

Changelog

Experimental API changes

Added:

  • splitHostPort
  • HostPort
  • createServerCredentialsWithInterceptors

v1.10.11: @​grpc/grpc-js 1.10.11

Compare Source

  • Fix a bug that caused clients to reconnect unnecessarily while no requests are pending. (#​2784)
  • Fix a bug that caused clients to fail to re-establish existing connections while waiting for DNS results (#​2784)
  • Fix a bug that caused servers to sometimes not close idle connections depending on timing (#​2790)
  • Fix a bug that caused calls to be pending indefinitely while unable to start after a channel is closed (#​2791)

v1.10.10: @​grpc/grpc-js 1.10.10

Compare Source

  • Various improvements to handling of keepalive timers (#​2760 by @​davidfiala)
  • Fix a bug causing unary response client requests to hang when unexpectedly receiving multiple messages (#​2772)
  • Fix a bug causing some requests to fail when making requests through a local proxy (#​2746 contributed by @​mjameswh, backported in #​2777)
  • Fix handling of URL-encoded user credentials in proxy configuration (#​2761 contributed by @​brendan-myers, backported in #​2777)
  • Fix missing client-side handling of the grpc.max_send_message_length channel option (#​2779)

v1.10.9: @​grpc/grpc-js 1.10.9

Compare Source

  • Avoid buffering significantly more than grpc.max_receive_message_size per received message.

v1.10.8: @​grpc/grpc-js 1.10.8

Compare Source

  • Fix a bug that caused channels with unix: targets to not reconnect after the channel goes idle (#​2750)

v1.10.7: @​grpc/grpc-js 1.10.7

Compare Source

  • Improve reporting of HTTP error codes (#​2723)
  • Update dependency on @grpc/proto-loader to the latest version (#​2732)

v1.10.6: @​grpc/grpc-js 1.10.6

Compare Source

  • Fix a bug that could cause a server to sometimes send the status early (#​2708)

v1.10.5: @​grpc/grpc-js 1.10.5

Compare Source

  • Resolve exception when Error.stackTraceLimit is undefined (#​2701 contributed by @​davidfiala)
  • Call configured checkServerIdentity when grpc.ssl_target_name_override is set (#​2704)
  • Add more information to DEADLINE_EXCEEDED error details strings (#​2692)

v1.10.4: @​grpc/grpc-js 1.10.4

Compare Source

  • Fix a bug that caused server interceptors to crash when using partially-populated ResponderBuilder and ListenerBuilder objects (#​2696)
  • Avoid sending RST_STREAM from the client when the server has already finished its side of the stream (#​2695)

v1.10.3: @​grpc/grpc-js 1.10.3

Compare Source

v1.10.2: @​grpc/grpc-js 1.10.2

Compare Source

  • Implement server connection idle timeouts and improve channelz performance (#​2677 contributed by @​AVVS)
  • Fix a bug that caused clients to automatically reconnect even when there were no active requests (#​2680)
  • Modify order of server call events to more closely match pre-1.10.x behavior (#​2683)
nestjs/graphql (@​nestjs/apollo)

v12.2.2

Compare Source

12.2.2 (2024-12-04)

Enhancements
  • graphql
    • #​3346 refactor(graphql/lib): definitions generator defaultTypeMapping type reinforcement (@​Neosoulink)
Dependencies
Committers: 2

v12.2.1

Compare Source

12.2.1 (2024-10-23)

Bug fixes
  • graphql
Enhancements
Dependencies
Committers: 4

v12.2.0

Compare Source

v12.2.0 (2024-07-02)

Bug fixes
Enhancements
  • apollo, graphql
    • #​3222 feat(graphql): add support for option newline at the end of schema file (@​sabolch)
Docs
Dependencies

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from adrianmjim as a code owner March 5, 2024 20:41
@renovate renovate bot added the dependencies label Mar 5, 2024
@renovate renovate bot enabled auto-merge (rebase) March 5, 2024 20:41
@codecov
Copy link

codecov bot commented Mar 5, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.36%. Comparing base (d47e31a) to head (7a8e1f7).

Additional details and impacted files
@@           Coverage Diff           @@
##             main      #77   +/-   ##
=======================================
  Coverage   99.36%   99.36%           
=======================================
  Files         110      110           
  Lines         947      947           
  Branches       45       45           
=======================================
  Hits          941      941           
  Misses          6        6           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.


🚨 Try these New Features:

@renovate renovate bot changed the title fix(deps): update dependency @apollo/server to v4.10.1 fix(deps): update all non-major dependencies Mar 6, 2024
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 5 times, most recently from 533540d to 9bdfd85 Compare March 13, 2024 16:41
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 8 times, most recently from 013c324 to d556502 Compare March 21, 2024 19:28
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 7 times, most recently from 2811ca1 to 16ecaf1 Compare March 29, 2024 02:27
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 5 times, most recently from 5cb62cd to 0439c93 Compare April 2, 2024 22:44
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 3 times, most recently from c3018d7 to 1444238 Compare June 6, 2025 20:53
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch from 1444238 to 69e77d0 Compare June 14, 2025 00:00
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 2 times, most recently from e073545 to 535e70d Compare June 23, 2025 02:30
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch from 535e70d to 6a71c85 Compare July 5, 2025 12:15
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch from 6a71c85 to d9be861 Compare July 20, 2025 08:11
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 4 times, most recently from d87dda9 to d50dbe9 Compare August 8, 2025 17:39
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch from d50dbe9 to 81c34e3 Compare August 16, 2025 03:31
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch from 81c34e3 to fda2ed7 Compare September 4, 2025 23:41
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 4 times, most recently from 35b9b58 to c6b4684 Compare September 16, 2025 21:48
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch from c6b4684 to 5f43ecc Compare September 21, 2025 10:45
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 3 times, most recently from 2a5e95a to fb21c01 Compare October 1, 2025 02:31
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 3 times, most recently from c5d1218 to c122294 Compare October 15, 2025 07:08
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch 2 times, most recently from 0e229e5 to bdb0b4b Compare October 25, 2025 03:54
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch from bdb0b4b to 31c9296 Compare November 2, 2025 07:41
@renovate renovate bot force-pushed the renovate/all-non-major-dependencies branch from 31c9296 to 1139645 Compare November 9, 2025 11:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant