Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: Bump the graphql group with 8 updates #2112

Merged
merged 3 commits into from
Jul 6, 2023
Merged

chore: Bump the graphql group with 8 updates #2112

merged 3 commits into from
Jul 6, 2023

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 6, 2023 •
edited
Loading

Bumps the graphql group with 8 updates:

Package Update
@apollo/client 3.7.15 to 3.7.16
@apollo/server 4.7.1 to 4.7.5
@graphql-tools/schema 9.0.19 to 10.0.0
@graphql-codegen/typed-document-node 5.0.0 to 5.0.1
@graphql-codegen/typescript-operations 3.0.4 to 4.0.1
@graphql-eslint/eslint-plugin 3.18.0 to 3.20.0
@graphql-inspector/cli 3.4.19 to 4.0.1
graphql-codegen-typescript-validation-schema 0.10.0 to 0.11.1

Updates @apollo/client from 3.7.15 to 3.7.16

Release notes

Sourced from @​apollo/client's releases.

v3.7.16

Patch Changes

  • #10806 cb1540504 Thanks @​phryneas! - Fix a bug in PersistedQueryLink that would cause it to permanently skip persisted queries after a 400 or 500 status code.

  • #10807 b32369592 Thanks @​phryneas! - PersistedQueryLink will now also check for error codes in extensions.

  • #10982 b9be7a814 Thanks @​sdeleur-sc! - Update relayStylePagination to avoid populating startCursor when only a single cursor is present under the edges field. Use that cursor only as the endCursor.

  • #10962 772cfa3cb Thanks @​jerelmiller! - Remove useGETForQueries option in BatchHttpLink.Options type since it is not supported.

Potentially breaking change in PersistedQueryLink

Previously, if the PersistedQueryLink encountered a single 400 or 500 error, it would stop sending any persisted queries in the future. This allowed you to use the link even if a server had no support for persisted queries.

We have decided to change this behavior, so now the PersistedQueryLink will only stop trying to send query hashes if the server responds with a PERSISTED_QUERY_NOT_SUPPORTED error code as it was unclear whether a 400 or 500 status code was in fact because the server did not support persisted queries.

If you relied on the previous behaviour, maybe because you were communicating with a server that might or might not support persisted queries, but would return with a different kind of error, you can use the disable option callback to override this behavior like this:

createPersistedQueryLink({
  // ... other options ...
  disable({ operation }){
    const { response } = operation.getContext();
    return (
      response &&
      response.status &&
      (response.status === 400 || response.status === 500)
    );
  }
})

Alternatively, consider removing the link entirely when your server does not support persisted queries.

Changelog

Sourced from @​apollo/client's changelog.

3.7.16

Patch Changes

  • #10806 cb1540504 Thanks @​phryneas! - Fix a bug in PersistedQueryLink that would cause it to permanently skip persisted queries after a 400 or 500 status code.

  • #10807 b32369592 Thanks @​phryneas! - PersistedQueryLink will now also check for error codes in extensions.

  • #10982 b9be7a814 Thanks @​sdeleur-sc! - Update relayStylePagination to avoid populating startCursor when only a single cursor is present under the edges field. Use that cursor only as the endCursor.

  • #10962 772cfa3cb Thanks @​jerelmiller! - Remove useGETForQueries option in BatchHttpLink.Options type since it is not supported.

Commits
  • 2e59045 Version Packages (#10965)
  • e9daa02 Add 3.9 to roadmap (#10996)
  • cb15405 PersistedQueryLink: do not permanently skip persisted queries after a 400 o...
  • f26ff2e renovate: add package groups (#10803)
  • b9be7a8 Don't set startCursor in relayStylePagination when only one cursor is present...
  • 05f4d6d chore: make tag name dynamic in postpublish message for prereleases (#10981)
  • b323695 PersistedQueryLink: also check for extension error codes (#10807)
  • 772cfa3 Remove useGETForQueries option in BatchHttpLink.Options (#10962)
  • a1dac63 chore(deps): update dependency @​typescript-eslint/parser to v5.59.9 (#10946)
  • 582d063 chore(deps): update dependency eslint to v8.42.0 (#10948)
  • Additional commits viewable in compare view

Updates @apollo/server from 4.7.1 to 4.7.5

Release notes

Sourced from @​apollo/server's releases.

@​apollo/server-integration-testsuite@​4.7.5

Patch Changes

  • Updated dependencies [4fadf3ddc]:
    • @​apollo/cache-control-types@​1.0.3
    • @​apollo/server@​4.7.5
    • @​apollo/usage-reporting-protobuf@​4.1.1

@​apollo/server@​4.7.5

Patch Changes

  • #7614 4fadf3ddc Thanks @​Cellule! - Publish TypeScript typings for CommonJS modules output.

    This allows TypeScript projects that use CommonJS modules with moduleResolution: "node16" or moduleResolution: "nodeNext" to correctly resolves the typings of apollo's packages as CommonJS instead of ESM.

  • Updated dependencies [4fadf3ddc]:

    • @​apollo/cache-control-types@​1.0.3
    • @​apollo/server-gateway-interface@​1.1.1
    • @​apollo/usage-reporting-protobuf@​4.1.1

@​apollo/server-integration-testsuite@​4.7.4

Patch Changes

  • #7604 aeb511c7d Thanks @​renovate! - Update graphql-http dependency

  • 0adaf80d1 Thanks @​trevor-scheer! - Address Content Security Policy issues

    The previous implementation of CSP nonces within the landing pages did not take full advantage of the security benefit of using them. Nonces should only be used once per request, whereas Apollo Server was generating one nonce and reusing it for the lifetime of the instance. The reuse of nonces degrades the security benefit of using them but does not pose a security risk on its own. The CSP provides a defense-in-depth measure against a potential XSS, so in the absence of a known XSS vulnerability there is likely no risk to the user.

    The mentioned fix also coincidentally addresses an issue with using crypto functions on startup within Cloudflare Workers. Crypto functions are now called during requests only, which resolves the error that Cloudflare Workers were facing. A recent change introduced a precomputedNonce configuration option to mitigate this issue, but it was an incorrect approach given the nature of CSP nonces. This configuration option is now deprecated and should not be used for any reason since it suffers from the previously mentioned issue of reusing nonces.

    Additionally, this change adds other applicable CSPs for the scripts, styles, images, manifest, and iframes that the landing pages load.

    A final consequence of this change is an extension of the renderLandingPage plugin hook. This hook can now return an object with an html property which returns a Promise<string> in addition to a string (which was the only option before).

  • Updated dependencies [0adaf80d1]:

    • @​apollo/server@​4.7.4

@​apollo/server@​4.7.4

Patch Changes

  • 0adaf80d1 Thanks @​trevor-scheer! - Address Content Security Policy issues

    The previous implementation of CSP nonces within the landing pages did not take full advantage of the security benefit of using them. Nonces should only be used once per request, whereas Apollo Server was generating one nonce and reusing it for the lifetime of the instance. The reuse of nonces degrades the security benefit of using them but does not pose a security risk on its own. The CSP provides a defense-in-depth measure against a potential XSS, so in the absence of a known XSS vulnerability there is likely no risk to the user.

    The mentioned fix also coincidentally addresses an issue with using crypto functions on startup within Cloudflare Workers. Crypto functions are now called during requests only, which resolves the error that Cloudflare Workers were facing. A recent change introduced a precomputedNonce configuration option to mitigate this issue, but it was an incorrect approach given the nature of CSP nonces. This configuration option is now deprecated and should not be used for any reason since it suffers from the previously mentioned issue of reusing nonces.

... (truncated)

Changelog

Sourced from @​apollo/server's changelog.

4.7.5

Patch Changes

  • #7614 4fadf3ddc Thanks @​Cellule! - Publish TypeScript typings for CommonJS modules output.

    This allows TypeScript projects that use CommonJS modules with moduleResolution: "node16" or moduleResolution: "nodeNext" to correctly resolves the typings of apollo's packages as CommonJS instead of ESM.

  • Updated dependencies [4fadf3ddc]:

    • @​apollo/cache-control-types@​1.0.3
    • @​apollo/server-gateway-interface@​1.1.1
    • @​apollo/usage-reporting-protobuf@​4.1.1

4.7.4

Patch Changes

  • 0adaf80d1 Thanks @​trevor-scheer! - Address Content Security Policy issues

    The previous implementation of CSP nonces within the landing pages did not take full advantage of the security benefit of using them. Nonces should only be used once per request, whereas Apollo Server was generating one nonce and reusing it for the lifetime of the instance. The reuse of nonces degrades the security benefit of using them but does not pose a security risk on its own. The CSP provides a defense-in-depth measure against a potential XSS, so in the absence of a known XSS vulnerability there is likely no risk to the user.

    The mentioned fix also coincidentally addresses an issue with using crypto functions on startup within Cloudflare Workers. Crypto functions are now called during requests only, which resolves the error that Cloudflare Workers were facing. A recent change introduced a precomputedNonce configuration option to mitigate this issue, but it was an incorrect approach given the nature of CSP nonces. This configuration option is now deprecated and should not be used for any reason since it suffers from the previously mentioned issue of reusing nonces.

    Additionally, this change adds other applicable CSPs for the scripts, styles, images, manifest, and iframes that the landing pages load.

    A final consequence of this change is an extension of the renderLandingPage plugin hook. This hook can now return an object with an html property which returns a Promise<string> in addition to a string (which was the only option before).

4.7.3

Patch Changes

  • #7601 75b668d9e Thanks @​trevor-scheer! - Provide a new configuration option for landing page plugins precomputedNonce which allows users to provide a nonce and avoid calling into uuid functions on startup. This is useful for Cloudflare Workers where random number generation is not available on startup (only during requests). Unless you are using Cloudflare Workers, you can ignore this change.

    The example below assumes you've provided a PRECOMPUTED_NONCE variable in your wrangler.toml file.

    Example usage:

    const server = new ApolloServer({
  // ...
  plugins: [
    ApolloServerPluginLandingPageLocalDefault({
      precomputedNonce: PRECOMPUTED_NONCE,
    }),
  ],
});

... (truncated)

Commits

Updates @graphql-tools/schema from 9.0.19 to 10.0.0

Changelog

Sourced from @​graphql-tools/schema's changelog.

10.0.0

Major Changes

Patch Changes

Commits

Updates @graphql-codegen/typed-document-node from 5.0.0 to 5.0.1

Release notes

Sourced from @​graphql-codegen/typed-document-node's releases.

Release 2022-08-04T13:12:01.667Z

@​graphql-codegen/graphql-modules-preset@​2.5.0

Minor Changes

Release 2022-08-04T13:05:23.977Z

No release notes provided.

Release 2022-08-04T13:02:57.827Z

No release notes provided.

Changelog

Sourced from @​graphql-codegen/typed-document-node's changelog.

5.0.1

Patch Changes

  • Updated dependencies [2276708d0]:
    • @​graphql-codegen/visitor-plugin-common@​4.0.1
Commits

Updates @graphql-codegen/typescript-operations from 3.0.4 to 4.0.1

Release notes

Sourced from @​graphql-codegen/typescript-operations's releases.

Release 2022-08-04T13:12:01.667Z

@​graphql-codegen/graphql-modules-preset@​2.5.0

Minor Changes

Release 2022-08-04T13:05:23.977Z

No release notes provided.

Release 2022-08-04T13:02:57.827Z

No release notes provided.

@​graphql-codegen/typescript-react-query@​4.0.0

Major Changes

  • 5c7592b4d: Introduces breaking changes to support react-query@4.0.0:

    • react query package is now @tanstack/react-query -> import changes
    • introduced a legacyMode flag (false by default)

    /!\ If you are using the 'react-query' package or react-query < 4, please set the legacyMode option to true. /!\

@​graphql-codegen/typescript-urql@​3.6.3

Patch Changes

  • ab66ba104: Add useQuery argument generic type

@​graphql-codegen/typescript-react-query@​3.6.2

Patch Changes

  • Updated dependencies [2cbcbb371]
    • @​graphql-codegen/visitor-plugin-common@​2.12.0
    • @​graphql-codegen/plugin-helpers@​2.6.0

@​graphql-codegen/typescript-urql@​3.6.2

Patch Changes

  • Updated dependencies [2cbcbb371]
    • @​graphql-codegen/visitor-plugin-common@​2.12.0
    • @​graphql-codegen/plugin-helpers@​2.6.0

@​graphql-codegen/typescript-react-apollo@​3.3.2

Patch Changes

  • Updated dependencies [2cbcbb371]
    • @​graphql-codegen/visitor-plugin-common@​2.12.0
    • @​graphql-codegen/plugin-helpers@​2.6.0

@​graphql-codegen/typescript-vue-apollo@​3.3.2

... (truncated)

Changelog

Sourced from @​graphql-codegen/typescript-operations's changelog.

4.0.1

Patch Changes

  • #9497 2276708d0 Thanks @​eddeee888! - Revert default ID scalar input type to string

    We changed the ID Scalar input type from string to string | number in the latest major version of typescript plugin. This causes issues for server plugins (e.g. typescript-resolvers) that depends on typescript plugin. This is because the scalar type needs to be manually inverted on setup which is confusing.

  • Updated dependencies [2276708d0]:

    • @​graphql-codegen/visitor-plugin-common@​4.0.1
    • @​graphql-codegen/typescript@​4.0.1

4.0.0

Major Changes

  • #9375 ba84a3a27 Thanks @​eddeee888! - Implement Scalars with input/output types

    In GraphQL, Scalar types can be different for client and server. For example, given the native GraphQL ID:

    • A client may send string or number in the input
    • A client receives string in its selection set (i.e output)
    • A server receives string in the resolver (GraphQL parses string or number received from the client to string)
    • A server may return string or number (GraphQL serializes the value to string before sending it to the client )

    Currently, we represent every Scalar with only one type. This is what codegen generates as base type:

    export type Scalars = {
  ID: string;
};

    Then, this is used in both input and output type e.g.

    export type Book = {
  __typename?: 'Book';
  id: Scalars['ID']; // Output's ID can be `string` 👍
};
export type QueryBookArgs = {
id: Scalars['ID']; // Input's ID can be string or number. However, the type is only string here 👎
};

    This PR extends each Scalar to have input and output:

    export type Scalars = {

... (truncated)

Commits

Updates @graphql-eslint/eslint-plugin from 3.18.0 to 3.20.0

Commits

Updates @graphql-inspector/cli from 3.4.19 to 4.0.1

Changelog

Sourced from @​graphql-inspector/cli's changelog.

4.0.1

Patch Changes

  • Updated dependencies [e448617f, 733fec4a, e448617f, 733fec4a]:
    • @​graphql-inspector/commands@​4.0.1
    • @​graphql-inspector/loaders@​4.0.1
    • @​graphql-inspector/audit-command@​4.0.1
    • @​graphql-inspector/coverage-command@​5.0.1
    • @​graphql-inspector/diff-command@​4.0.1
    • @​graphql-inspector/docs-command@​4.0.1
    • @​graphql-inspector/introspect-command@​4.0.1
    • @​graphql-inspector/serve-command@​4.0.1
    • @​graphql-inspector/similar-command@​4.0.1
    • @​graphql-inspector/validate-command@​4.0.1

4.0.0

Major Changes

Patch Changes

... (truncated)

Commits

Updates graphql-codegen-typescript-validation-schema from 0.10.0 to 0.11.1

Release notes

Sourced from graphql-codegen-typescript-validation-schema's releases.

v0.11.1

What's Changed

Full Changelog: Code-Hex/graphql-codegen-typescript-validation-schema@v0.11.0...v0.11.1

v0.11.0

What's Changed

New Contributors

Full Changelog: Code-Hex/graphql-codegen-typescript-validation-schema@v0.10.0...v0.11.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/graphql-0efb710bf1 branch 3 times, most recently from 36793be to d0b969e Compare July 6, 2023 12:04
@github-actions
Copy link

github-actions bot commented Jul 6, 2023 •
edited
Loading

Deployed d565a8c to https://gentle-forest-03418aa03-2112.westeurope.3.azurestaticapps.net

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/graphql-0efb710bf1 branch 4 times, most recently from d66e1c8 to 28927e0 Compare July 6, 2023 15:47
@dependabot
chore: Bump the graphql group with 8 updates
327078c 
Bumps the graphql group with 8 updates:

| Package | Update |
| --- | --- |
| [@apollo/client](https://github.com/apollographql/apollo-client) | 3.7.15 to 3.7.16 |
| [@apollo/server](https://github.com/apollographql/apollo-server/tree/HEAD/packages/server) | 4.7.1 to 4.7.5 |
| [@graphql-tools/schema](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/schema) | 9.0.19 to 10.0.0 |
| [@graphql-codegen/typed-document-node](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/plugins/typescript/typed-document-node) | 5.0.0 to 5.0.1 |
| [@graphql-codegen/typescript-operations](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/plugins/typescript/operations) | 3.0.4 to 4.0.1 |
| [@graphql-eslint/eslint-plugin](https://github.com/B2o5T/graphql-eslint) | 3.18.0 to 3.20.0 |
| [@graphql-inspector/cli](https://github.com/kamilkisiela/graphql-inspector/tree/HEAD/packages/cli) | 3.4.19 to 4.0.1 |
| [graphql-codegen-typescript-validation-schema](https://github.com/Code-Hex/graphql-codegen-typescript-validation-schema) | 0.10.0 to 0.11.1 |


Updates `@apollo/client` from 3.7.15 to 3.7.16
- [Release notes](https://github.com/apollographql/apollo-client/releases)
- [Changelog](https://github.com/apollographql/apollo-client/blob/main/CHANGELOG.md)
- [Commits](apollographql/apollo-client@v3.7.15...v3.7.16)

Updates `@apollo/server` from 4.7.1 to 4.7.5
- [Release notes](https://github.com/apollographql/apollo-server/releases)
- [Changelog](https://github.com/apollographql/apollo-server/blob/main/packages/server/CHANGELOG.md)
- [Commits](https://github.com/apollographql/apollo-server/commits/@apollo/server@4.7.5/packages/server)

Updates `@graphql-tools/schema` from 9.0.19 to 10.0.0
- [Release notes](https://github.com/ardatan/graphql-tools/releases)
- [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/schema/CHANGELOG.md)
- [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/schema@10.0.0/packages/schema)

Updates `@graphql-codegen/typed-document-node` from 5.0.0 to 5.0.1
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/plugins/typescript/typed-document-node/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/typed-document-node@5.0.1/packages/plugins/typescript/typed-document-node)

Updates `@graphql-codegen/typescript-operations` from 3.0.4 to 4.0.1
- [Release notes](https://github.com/dotansimha/graphql-code-generator/releases)
- [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/plugins/typescript/operations/CHANGELOG.md)
- [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/typescript-operations@4.0.1/packages/plugins/typescript/operations)

Updates `@graphql-eslint/eslint-plugin` from 3.18.0 to 3.20.0
- [Release notes](https://github.com/B2o5T/graphql-eslint/releases)
- [Commits](https://github.com/B2o5T/graphql-eslint/compare/@graphql-eslint/eslint-plugin@3.18.0...@graphql-eslint/eslint-plugin@3.20.0)

Updates `@graphql-inspector/cli` from 3.4.19 to 4.0.1
- [Release notes](https://github.com/kamilkisiela/graphql-inspector/releases)
- [Changelog](https://github.com/kamilkisiela/graphql-inspector/blob/master/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/kamilkisiela/graphql-inspector/commits/@graphql-inspector/cli@4.0.1/packages/cli)

Updates `graphql-codegen-typescript-validation-schema` from 0.10.0 to 0.11.1
- [Release notes](https://github.com/Code-Hex/graphql-codegen-typescript-validation-schema/releases)
- [Commits](Code-Hex/graphql-codegen-typescript-validation-schema@v0.10.0...v0.11.1)

---
updated-dependencies:
- dependency-name: "@apollo/client"
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: graphql
- dependency-name: "@apollo/server"
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: graphql
- dependency-name: "@graphql-tools/schema"
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: graphql
- dependency-name: "@graphql-codegen/typed-document-node"
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: graphql
- dependency-name: "@graphql-codegen/typescript-operations"
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: graphql
- dependency-name: "@graphql-eslint/eslint-plugin"
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: graphql
- dependency-name: "@graphql-inspector/cli"
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: graphql
- dependency-name: graphql-codegen-typescript-validation-schema
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: graphql
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/graphql-0efb710bf1 branch from 28927e0 to 327078c Compare July 6, 2023 20:23
@tobiasdiez tobiasdiez mentioned this pull request Jul 6, 2023
Open
51 tasks
@tobiasdiez tobiasdiez merged commit 5ed80c4 into main Jul 6, 2023
5 checks passed
@tobiasdiez tobiasdiez deleted the dependabot/npm_and_yarn/graphql-0efb710bf1 branch July 6, 2023 21:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
status: safe to test type: dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@tobiasdiez