Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@apollo/server (source)	4.11.0 -> 4.11.2
@apollo/server-integration-testsuite (source)	4.11.0 -> 4.11.2
@types/node (source)	18.19.59 -> 18.19.64
@typescript-eslint/eslint-plugin (source)	8.11.0 -> 8.13.0
@typescript-eslint/parser (source)	8.11.0 -> 8.13.0
next14 (source)	14.2.16 -> 14.2.17

---

Release Notes

apollographql/apollo-server (@​apollo/server)

v4.11.2

Compare Source

(No change; there is a change to the @apollo/server-integration-testsuite used to test integrations, and the two packages always have matching versions.)

v4.11.1

Compare Source

Patch Changes

• #​7952 bb81b2c Thanks @​glasser! - Upgrade dependencies so that automated scans don't detect a vulnerability.

  @apollo/server depends on express which depends on cookie. Versions of express older than v4.21.1 depend on a version of cookie vulnerable to CVE-2024-47764. Users of older express versions who call res.cookie() or res.clearCookie() may be vulnerable to this issue.

  However, Apollo Server does not call this function directly, and it does not expose any object to user code that allows TypeScript users to call this function without an unsafe cast.

  The only way that this direct dependency can cause a vulnerability for users of Apollo Server is if you call startStandaloneServer with a context function that calls Express-specific methods such as res.cookie() or res.clearCookies() on the response object, which is a violation of the TypeScript types provided by startStandaloneServer (which only promise that the response object is a core Node.js http.ServerResponse rather than the Express-specific subclass). So this vulnerability can only affect Apollo Server users who use unsafe JavaScript or unsafe as typecasts in TypeScript.

  However, this upgrade will at least prevent vulnerability scanners from alerting you to this dependency, and we encourage all Express users to upgrade their project's own express dependency to v4.21.1 or newer.

apollographql/apollo-server (@​apollo/server-integration-testsuite)

v4.11.2

Compare Source

Patch Changes

• #​7879 b0fb33b Thanks @​renovate! - Update graphql-http dependency

• #​7968 68977e2 Thanks @​glasser! - Upgrade supertest and superagent dependencies

• Updated dependencies []:

  • @​apollo/server@​4.11.2

v4.11.1

Compare Source

Patch Changes

• #​7952 bb81b2c Thanks @​glasser! - Upgrade dependencies so that automated scans don't detect a vulnerability.

  @apollo/server depends on express which depends on cookie. Versions of express older than v4.21.1 depend on a version of cookie vulnerable to CVE-2024-47764. Users of older express versions who call res.cookie() or res.clearCookie() may be vulnerable to this issue.

  However, Apollo Server does not call this function directly, and it does not expose any object to user code that allows TypeScript users to call this function without an unsafe cast.

  The only way that this direct dependency can cause a vulnerability for users of Apollo Server is if you call startStandaloneServer with a context function that calls Express-specific methods such as res.cookie() or res.clearCookies() on the response object, which is a violation of the TypeScript types provided by startStandaloneServer (which only promise that the response object is a core Node.js http.ServerResponse rather than the Express-specific subclass). So this vulnerability can only affect Apollo Server users who use unsafe JavaScript or unsafe as typecasts in TypeScript.

  However, this upgrade will at least prevent vulnerability scanners from alerting you to this dependency, and we encourage all Express users to upgrade their project's own express dependency to v4.21.1 or newer.

• Updated dependencies [bb81b2c]:

  • @​apollo/server@​4.11.1

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.13.0

Compare Source

🚀 Features

• eslint-plugin: [only-throw-error] add allow option (#​10221)
• eslint-plugin: [prefer-nullish-coalescing] add option ignoreBooleanCoercion (#​9924)
• eslint-plugin: disable no-class-assign rule in eslint-recommended config (#​10250)

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] add support for covering a missing property with undefined (#​10232)
• eslint-plugin: [consistent-type-definitions] don't leave trailing parens when fixing type to interface (#​10235)
• eslint-plugin: [no-deprecated] report when exported class implements/extends deprecated entity (#​10259)
• eslint-plugin: [no-deprecated] report on deprecated variables used inside dynamic imports (#​10261)
• eslint-plugin: [no-unnecessary-condition] falsey bigint should be falsey (#​10205)

❤️ Thank You

• auvred @​auvred
• Kim Sang Du @​developer-bandi
• Kirk Waiblinger @​kirkwaiblinger
• Mark de Dios @​peanutenthusiast
• Ronen Amiel
• YeonJuan @​yeonjuan

You can read about our versioning strategy and releases on our website.

v8.12.2

Compare Source

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] invert considerDefaultExhaustiveForUnions (#​10223)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

You can read about our versioning strategy and releases on our website.

v8.12.1

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.12.0

Compare Source

🚀 Features

• eslint-plugin: [no-base-to-string] handle String() (#​10005)
• eslint-plugin: [switch-exhaustiveness-check] add allowDefaultCaseMatchUnionMember option (#​9954)
• eslint-plugin: [consistent-indexed-object-style] report mapped types (#​10160)
• eslint-plugin: [prefer-nullish-coalescing] add support for assignment expressions (#​10152)

❤️ Thank You

• Abraham Guo
• Kim Sang Du @​developer-bandi
• Kirk Waiblinger @​kirkwaiblinger
• YeonJuan @​yeonjuan

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.13.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.12.2

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.12.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.12.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

vercel/next.js (next14)

v14.2.17

Compare Source

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.