Skip to content

chore(deps): update all non-major dependencies - #71

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#71
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Sep 15, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@apollo/server (source) 5.0.0 → 5.5.1 age confidence devDependencies minor
@apollo/server-integration-testsuite (source) 5.0.0 → 5.5.1 age confidence devDependencies minor
@changesets/changelog-github (source) 0.5.1 → 0.7.0 age confidence devDependencies minor
@changesets/cli (source) 2.29.6 → 2.31.1 age confidence devDependencies minor
@typescript-eslint/eslint-plugin (source) 8.43.0 → 8.70.0 age confidence overrides minor
@typescript-eslint/eslint-plugin (source) 8.43.0 → 8.70.0 age confidence devDependencies minor
@typescript-eslint/parser (source) 8.43.0 → 8.70.0 age confidence overrides minor
@typescript-eslint/parser (source) 8.43.0 → 8.70.0 age confidence devDependencies minor
@typescript-eslint/type-utils (source) 8.43.0 → 8.70.0 age confidence overrides minor
@typescript-eslint/utils (source) 8.43.0 → 8.70.0 age confidence overrides minor
cspell (source) 9.2.1 → 9.8.0 age confidence devDependencies minor
node (source) v20.19.5 → 20.20.2 age confidence minor
node 7.1.1 → 7.2.1 age confidence orb minor
npm (source) 11.6.0 → 11.19.1 age confidence volta minor
prettier (source) 3.6.2 → 3.9.6 age confidence devDependencies minor
ts-jest (source) 29.4.1 → 29.4.12 age confidence devDependencies patch
typescript (source) 5.9.2 → 5.9.3 age confidence devDependencies patch

Release Notes

apollographql/apollo-server (@​apollo/server)

v5.5.1

Compare Source

Patch Changes

v5.5.0

Compare Source

Minor Changes

  • #​8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

v5.4.0

Compare Source

Minor Changes

  • d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

    The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

    In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
    Any other character set will be rejected with a 415 Unsupported Media Type error.
    Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8.
    Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now.
    In a future major release, we may tighten this restriction further to only allow UTF-8.

    If you were not using startStandaloneServer, you were not affected by this vulnerability.

    Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
    For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

v5.3.0

Compare Source

Minor Changes

  • #​8062 8e54e58 Thanks @​cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

    const server = new ApolloServer({
  typeDefs,
  resolvers,
  executionOptions: {
    maxCoercionErrors: 50,
  },
});

  • #​8014 26320bc Thanks @​mo4islona! - Expose graphql validation options.

    const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationOptions: {
    maxErrors: 10,
  },
});

v5.2.0

Compare Source

Minor Changes

  • #​8161 51acbeb Thanks @​jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.

    import { legacyExecuteIncrementally } from '@yaacovcr/transform';

const server = new ApolloServer({
  // ...
  legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
});

    If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

v5.1.0

Compare Source

Minor Changes

  • #​8148 80a1a1a Thanks @​jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with graphql@17.0.0-alpha.9. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.

    Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.

apollographql/apollo-server (@​apollo/server-integration-testsuite)

v5.5.1

Compare Source

Patch Changes

v5.5.0

Compare Source

Minor Changes

  • #​8191 ada1200 - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

Patch Changes

v5.4.0

Compare Source

Patch Changes

v5.3.0

Compare Source

Patch Changes

v5.2.0

Compare Source

Patch Changes

v5.1.0

Compare Source

Patch Changes
changesets/changesets (@​changesets/changelog-github)

v0.7.0

Compare Source

Minor Changes

v0.6.0

Compare Source

Minor Changes
Patch Changes

v0.5.2

Compare Source

Patch Changes
changesets/changesets (@​changesets/cli)

v2.31.1

Compare Source

Patch Changes
  • #​2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

v2.31.0

Compare Source

Minor Changes

  • #​1889 96ca062 Thanks @​mixelburg! - Error on unsupported flags for individual CLI commands and print the matching command usage to make mistakes easier to spot.

  • #​1873 42943b7 Thanks @​mixelburg! - Respond to --help on all subcommands. Previously, --help was only handled when it was the sole argument; passing it alongside a subcommand (e.g. changeset version --help) would silently execute the command instead. Now --help always exits early and prints per-command usage when a known subcommand is provided, or the general help text otherwise.

Patch Changes

v2.30.0

Compare Source

Minor Changes

  • #​1840 057cca2 Thanks @​wotan-allfather! - Add --since flag to add command

    The add command now supports a --since flag that allows you to specify which branch, tag, or git ref to use when detecting changed packages. This is useful for gitflow workflows where you have multiple target branches and the baseBranch config option doesn't cover all use cases.

    Example: changeset add --since=develop

    If not provided, the command falls back to the baseBranch value in your .changeset/config.json.

  • #​1845 2b4a66a Thanks @​Andarist! - Delegate OTP prompting to the package manager instead of handling it in-process. This allows Changesets to use the package manager's native web auth support.

  • #​1774 667fe5a Thanks @​bluwy! - Support importing custom commit option ES module. Previously, it used require() which only worked for CJS modules, however now it uses import() which supports both CJS and ES modules.

  • #​1839 73b1809 Thanks @​leochiu-a! - Add a --message (-m) flag to changeset add (and default changeset) so the changeset summary can be provided from the command line. When --message is present, the summary prompt is skipped while the final confirmation step is kept.

  • #​1806 0e8e01e Thanks @​luisadame! - Changeset CLI can now be run from the nested directories in the project, where the .changeset directory has to be found in one of the parent directories

Patch Changes

v2.29.8

Compare Source

Patch Changes

v2.29.7

Compare Source

Patch Changes
typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.70.0

Compare Source

🚀 Features
  • eslint-plugin: [no-generated-empty-object-type] add rule (#​12730)
🩹 Fixes
  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#​12780)
  • eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#​12728)
  • eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#​12729)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

Compare Source

🚀 Features
  • eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#​12603)
🩹 Fixes
  • eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#​12727)
  • eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#​12741)
  • eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#​12731)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.68.0

Compare Source

🚀 Features
  • eslint-plugin: [strict-void-return] add fix suggestions (#​12086)
🩹 Fixes
  • eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#​12739)
  • eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#​12646)
  • eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#​12711)
  • eslint-plugin: [unified-signatures] report identical signatures (#​12678)
  • eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#​12707)
  • eslint-plugin: [unified-signatures] deduplicate types in report (#​12656)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.67.0

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

Compare Source

🩹 Fixes
  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#​12617)
  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#​12588)
  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#​12607)
  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#​12591)
  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#​12590)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.65.0

Compare Source

🚀 Features
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#​12578)
  • add warning when TS 7 is detected (#​12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#​12527, #​19562, #​11889)
🩹 Fixes
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#​12568)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#​12448)
  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#​12515)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

Compare Source

🚀 Features
  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#​12500)
  • typescript-estree: throw for invalid definite assignment in class properties (#​12543)
🩹 Fixes
  • eslint-plugin: [require-array-sort-compare] handle constrained arrays (#​12512)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

Compare Source

🚀 Features
  • eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#​12426)
🩹 Fixes
  • eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#​12492)
  • eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#​12491, #​12485)
  • eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#​12447, #​12446)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

Compare Source

🩹 Fixes
  • eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#​12443, #​12418)
  • eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#​12365)
  • eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#​12328)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

Compare Source

🚀 Features
  • remove redundant package.json "files" (#​12444)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.1

Compare Source

🩹 Fixes
  • eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#​12388)
  • eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#​12413)
  • eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#​12394, #​12393)
  • eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#​12281)
  • eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#​12396, #​10577)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.0

Compare Source

🚀 Features
  • ast-spec: change type of UnaryExpression.prefix to always true (#​12372)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.1

Compare Source

🩹 Fixes
  • eslint-plugin: [no-shadow] correct rule to match ESLint v10 handling (#​12182)
  • eslint-plugin: respect ECMAScript line terminators in ts-comment rules (#​12352)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.0

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.4

Compare Source

🩹 Fixes
  • eslint-plugin: [no-floating-promises] stack overflow when using recursive types (#​12294)
❤️ Thank You

See GitHub Releases for more information.

You can read about our [versioning strate

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) September 15, 2025 01:54
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 8dbb0dc to eb6dd52 Compare September 20, 2025 08:38
@renovate renovate Bot changed the title chore(deps): update dependency @changesets/cli to v2.29.7 chore(deps): update all non-major dependencies Sep 20, 2025
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from eb6dd52 to 43c8e70 Compare September 27, 2025 08:37
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 244e34c to af9e56c Compare October 11, 2025 09:08
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from af9e56c to bd5dd53 Compare October 18, 2025 09:56
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 5edaeb0 to 5811379 Compare October 28, 2025 21:52
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from d1f68e7 to 316030a Compare November 6, 2025 11:12
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from dffa34f to 896711e Compare November 17, 2025 18:01
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 89b0be6 to 58dcc0b Compare November 25, 2025 20:46
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 00174c5 to 4006322 Compare December 3, 2025 05:35
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 54bbc13 to c4f3965 Compare January 22, 2026 02:36
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from f5b48c3 to d744d87 Compare January 26, 2026 18:24
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from e1e291f to 8b51c57 Compare February 4, 2026 18:51
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 3f733b4 to c8bcb3b Compare February 12, 2026 14:51
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from e5119a1 to 5c67c18 Compare February 23, 2026 16:46
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 91f4634 to 5516f3b Compare February 26, 2026 01:47
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from db885cc to 2e1b7fb Compare March 9, 2026 18:17
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 8b734c5 to 1d1c3a3 Compare March 16, 2026 20:39
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 71b19ec to 2108d31 Compare March 24, 2026 21:28
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 2108d31 to 0ce07ef Compare March 26, 2026 20:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

Assignees

No one assigned

Labels

🎄 dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants