Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates - #108

Merged
batjko merged 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-a47bdec6d9
Oct 10, 2026
Merged

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates#108
batjko merged 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-a47bdec6d9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
@graphql-tools/executor-legacy-ws 1.1.32 1.1.37
@graphql-tools/utils 11.2.2 12.0.3
brace-expansion 5.0.7 5.0.12
proxy-addr 2.0.7 2.0.8
shell-quote 1.10.0 1.12.0
source-map-js 1.2.1 1.2.2

Updates @graphql-tools/executor-legacy-ws from 1.1.32 to 1.1.37

Changelog

Sourced from @​graphql-tools/executor-legacy-ws's changelog.

1.1.37

Patch Changes

  • Updated dependencies [19f5b33]:
    • @​graphql-tools/utils@​12.0.3

1.1.36

Patch Changes

  • #8480 c2f226e Thanks @​ardatan! - Security: Isolate legacy GraphQL WebSocket executions on a shared buildWSLegacyExecutor().

    A single executor reused across callers kept extensions.connectionParams for the lifetime of the closure and installed one websocket.onmessage handler. A later request could be authenticated with a previous caller's connection_init payload (GHSA-434m-5hcj-pxf3, CWE-613), and an overlapping subscription could receive another operation's data frames because the handler ignored the protocol operation id (GHSA-mp66-8ww2-pcwm, CWE-200).

    Corrected behavior

    • Each execution opens its own socket. connection_init is built from the executor's base connectionParams plus that request's extensions.connectionParams only.
    • data, error, and complete frames are delivered only when id matches the operation that socket started.
    • Operation ids are no longer Date.now().

  • Updated dependencies [b1fbba2, 20d36a5]:

    • @​graphql-tools/utils@​12.0.2

1.1.35

Patch Changes

  • #8426 3831a06 Thanks @​ardatan! - Security: Enable TLS certificate validation by default for legacy GraphQL WebSocket (graphql-ws protocol) connections over wss://.

    buildWSLegacyExecutor() previously hardcoded rejectUnauthorized: false, so Node.js clients accepted any certificate (including self-signed or attacker-controlled ones). Credentials in connectionParams / headers and subscription payloads could be exposed to a network MITM. This addresses GHSA-6fw5-9hq8-w87g (CWE-295).

    Corrected behavior

    • Default is now rejectUnauthorized: true (Node TLS verifies the peer certificate), matching secure-by-default expectations.
    • Connections to endpoints with untrusted/self-signed certificates will fail unless you opt out.

    Opt-out (trusted / local self-signed only)

    buildWSLegacyExecutor(url, WebSocket, {
  rejectUnauthorized: false,
  connectionParams: { /* ... */ },
})

    Or via UrlLoader / LoadFromUrlOptions when subscriptionsProtocol is LEGACY_WS:

    {
  subscriptionsProtocol: SubscriptionProtocol.LEGACY_WS,
  rejectUnauthorized: false,

... (truncated)

Commits
  • 944121e Upcoming Release Changes (#8483)
  • 3a43b4b Upcoming Release Changes (#8460)
  • c2f226e fix(executor-legacy-ws): isolate per-request auth and subscription results (#...
  • 01167f3 chore(release): update monorepo packages versions (#8427)
  • 3831a06 fix(executor-legacy-ws): enable TLS cert validation by default (GHSA-6fw5-9hq...
  • 8b9b7df chore(release): update monorepo packages versions (#8365)
  • 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
  • 9feabd9 chore(release): update monorepo packages versions (#8327)
  • 07cd760 build(deps): bump the actions-deps group across 1 directory with 7 updates (#...
  • 755d699 build(deps): bump the actions-deps group with 4 updates (#8353)
  • See full diff in compare view

Updates @graphql-tools/utils from 11.2.2 to 12.0.3

Changelog

Sourced from @​graphql-tools/utils's changelog.

12.0.3

Patch Changes

  • #8482 19f5b33 Thanks @​ardatan! - Compare incremental path keys to __proto__ at the property access in setObjectKeyPath, in addition to the existing isSafeObjectKey check.

12.0.2

Patch Changes

  • #8456 b1fbba2 Thanks @​renovate! - dependencies updates:

  • #8467 20d36a5 Thanks @​ardatan! - Fix prototype pollution in mergeIncrementalResult

    Path segments are now rejected unless they are primitive strings or numbers, and keys named __proto__, constructor or prototype are still blocked. Previously a non-primitive segment such as ["__proto__"] bypassed the string equality guard and was coerced into a write on Object.prototype.

    Also exports shared isSafeObjectKey / isDangerousObjectKey helpers used by this path walker and other package call sites. @graphql-tools/merge and @graphql-tools/mock are patched so they ship with the new imports; updateInternalDependencies raises their utils floor when 12.0.2 is versioned.

12.0.1

Patch Changes

  • #8368 60db079 Thanks @​ardatan! - Omit mutation/subscription from printSchemaWithDirectives when those root types are no longer present on the schema (e.g. after pruneSchema).

  • #8366 57e316d Thanks @​ardatan! - Allow % in paths checked by isValidPath (e.g. directories from URL-encoded repo names).

  • #8370 1c1c5a0 Thanks @​ardatan! - Clean up observableToAsyncIterable queues and unsubscribe when the observable completes, so iterators do not retain references after done. Fixes leak detection flakes related to #8057.

  • #8370 1c1c5a0 Thanks @​ardatan! - Prefer runtime description values over stale astNode descriptions in printSchemaWithDirectives / getDescriptionNode. Fixes #5508.

  • #8423 0b9529f Thanks @​enisdenjo! - Fix prototype pollution in mergeDeep

    Source keys named __proto__, constructor or prototype are now skipped at every recursion level, and the check for an existing key uses hasOwnProperty instead of in, so inherited properties are never used as merge targets.

    Previously, merging untrusted data such as JSON.parse('{"constructor":{"__proto__":{"call":"x"}}}') could reach and overwrite properties on Object.prototype or Function.prototype.

12.0.0

Major Changes

  • #8346 2273c21 Thanks @​ardatan! - This release adds GraphQL v17 support and aligns the existing executor implementation with the latest GraphQL v17 API changes. The following changes are included:

    • getAsyncHelpers is now available on GraphQLResolveInfo. Its track method is used whenever waitUntil is available, as in Yoga's Explicit Resource Management

... (truncated)

Commits
  • 944121e Upcoming Release Changes (#8483)
  • 19f5b33 fix(utils): compare path keys to proto at the property access (#8482)
  • 3a43b4b Upcoming Release Changes (#8460)
  • 20d36a5 fix(utils): block prototype pollution in mergeIncrementalResult paths
  • b1fbba2 fix(deps): update dependency @​whatwg-node/promise-helpers to v2 (#8456)
  • 77bbaec build(deps): bump the actions-deps group with 7 updates (#8434)
  • 861011f build(deps): bump the actions-deps group with 6 updates (#8432)
  • 8b9b7df chore(release): update monorepo packages versions (#8365)
  • 0b9529f Fix prototype pollution in mergeDeep (#8423)
  • 23ca392 chore(deps): update dependency graphql-scalars to v2 (#8385)
  • Additional commits viewable in compare view

Updates brace-expansion from 5.0.7 to 5.0.12

Commits

Updates proxy-addr from 2.0.7 to 2.0.8

Release notes

Sourced from proxy-addr's releases.

2.0.8

Important

What's Changed

New Contributors

Full Changelog: jshttp/proxy-addr@v2.0.7...v2.0.8

Changelog

Sourced from proxy-addr's changelog.

2.0.8

Commits
  • a11ad82 2.0.8 (#70)
  • 780911d fix: reject IPv4 trust via mapped IPv6 subnets with a short prefix
  • 92e103e fix(ci): use publised as release trigger event (#71)
  • 3e5ac75 ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26 (#69)
  • 4b9db81 chore(ci): npm-publish via workflows (#54)
  • 655e895 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#39)
  • 50ce4d0 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#45)
  • 0fd347f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#63)
  • 6a517fa build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (#64)
  • 0d45e2a Fix "arugment" typo in README (#61)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for proxy-addr since your current version.


Updates shell-quote from 1.10.0 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

Commits

  • [New] parse: support tab-stripping here-documents (<<-) dbfac37
  • [New] parse: support output process substitution (>() 2053315
  • [New] parse: support the case test-next terminator (;;&) 7d688b9
  • [New] parse: support the case fall-through terminator (;&) f27010e
  • [New] parse: support redirecting output despite noclobber (>|) b78d19c
  • [New] parse: support opening a file for reading and writing (<>) 21cc333
  • [New] parse: support redirecting stdout and stderr (&>) 6ad6cd2
  • [New] parse: support appending stdout and stderr (&>>) 90cde9c
  • [Dev Deps] update @ljharb/eslint-config 3a7b4ae

v1.11.0 - 2026-09-29

Fixed

Commits

  • [Fix] quote: reject line terminators in tokens after a comment 6002b2e
  • [Fix] parse: preserve text after special shell parameters 81b08a5
  • [Fix] parse: an escaped backslash does not escape the character after it d708019
  • [Fix] quote: preserve ! in arguments that also contain ' ad39927
  • [Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd
  • [Fix] quote: preserve empty glob patterns 35c9b97
  • [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e
  • [meta] npmignore some files ebfc308
  • [actions] add permissions 3429b0d
  • [actions] set least-privilege cache-mode 36f2394
  • [Dev Deps] update eslint 6de9a41
Commits
  • 6ecb8aa v1.12.0
  • 3a7b4ae [Dev Deps] update @ljharb/eslint-config
  • 7d688b9 [New] parse: support the case test-next terminator (;;&)
  • f27010e [New] parse: support the case fall-through terminator (;&)
  • 90cde9c [New] parse: support appending stdout and stderr (&>>)
  • 6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)
  • 2053315 [New] parse: support output process substitution (>()
  • b78d19c [New] parse: support redirecting output despite noclobber (>|)
  • 21cc333 [New] parse: support opening a file for reading and writing (\<>)
  • dbfac37 [New] parse: support tab-stripping here-documents (<<-)
  • Additional commits viewable in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Changelog

Sourced from source-map-js's changelog.

1.2.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 6 up…
09344db 
…dates

Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@graphql-tools/executor-legacy-ws](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/executors/legacy-ws) | `1.1.32` | `1.1.37` |
| [@graphql-tools/utils](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/utils) | `11.2.2` | `12.0.3` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.7` | `5.0.12` |
| [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.10.0` | `1.12.0` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |



Updates `@graphql-tools/executor-legacy-ws` from 1.1.32 to 1.1.37
- [Release notes](https://github.com/ardatan/graphql-tools/releases)
- [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/executors/legacy-ws/CHANGELOG.md)
- [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/executor-legacy-ws@1.1.37/packages/executors/legacy-ws)

Updates `@graphql-tools/utils` from 11.2.2 to 12.0.3
- [Release notes](https://github.com/ardatan/graphql-tools/releases)
- [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/utils/CHANGELOG.md)
- [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/utils@12.0.3/packages/utils)

Updates `brace-expansion` from 5.0.7 to 5.0.12
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.7...v5.0.12)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

Updates `shell-quote` from 1.10.0 to 1.12.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.10.0...v1.12.0)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

---
updated-dependencies:
- dependency-name: "@graphql-tools/executor-legacy-ws"
  dependency-version: 1.1.37
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@graphql-tools/utils"
  dependency-version: 12.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 10, 2026
@batjko
batjko merged commit 995d3f1 into master Oct 10, 2026
3 checks passed
@batjko
batjko deleted the dependabot/npm_and_yarn/npm_and_yarn-a47bdec6d9 branch October 10, 2026 20:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@batjko