deps: bump @apollo/server from 4.7.0 to 4.7.5

dependabot[bot] commented 1 year ago

Bumps @apollo/server from 4.7.0 to 4.7.5.

Release notes

Sourced from @apollo/server's releases.

@apollo/server-integration-testsuite@4.7.5

Patch Changes

Updated dependencies [4fadf3ddc]:

@apollo/cache-control-types@1.0.3

@apollo/server@4.7.5

@apollo/usage-reporting-protobuf@4.1.1

@apollo/server@4.7.5

Patch Changes

#7614 4fadf3ddc Thanks @Cellule! - Publish TypeScript typings for CommonJS modules output.

This allows TypeScript projects that use CommonJS modules with moduleResolution: "node16" or moduleResolution: "nodeNext" to correctly resolves the typings of apollo's packages as CommonJS instead of ESM.

Updated dependencies [4fadf3ddc]:

@apollo/cache-control-types@1.0.3

@apollo/server-gateway-interface@1.1.1

@apollo/usage-reporting-protobuf@4.1.1

@apollo/server-integration-testsuite@4.7.4

Patch Changes

#7604 aeb511c7d Thanks @renovate! - Update graphql-http dependency

0adaf80d1 Thanks @trevor-scheer! - Address Content Security Policy issues

The previous implementation of CSP nonces within the landing pages did not take full advantage of the security benefit of using them. Nonces should only be used once per request, whereas Apollo Server was generating one nonce and reusing it for the lifetime of the instance. The reuse of nonces degrades the security benefit of using them but does not pose a security risk on its own. The CSP provides a defense-in-depth measure against a potential XSS, so in the absence of a known XSS vulnerability there is likely no risk to the user.

The mentioned fix also coincidentally addresses an issue with using crypto functions on startup within Cloudflare Workers. Crypto functions are now called during requests only, which resolves the error that Cloudflare Workers were facing. A recent change introduced a precomputedNonce configuration option to mitigate this issue, but it was an incorrect approach given the nature of CSP nonces. This configuration option is now deprecated and should not be used for any reason since it suffers from the previously mentioned issue of reusing nonces.

Additionally, this change adds other applicable CSPs for the scripts, styles, images, manifest, and iframes that the landing pages load.

A final consequence of this change is an extension of the renderLandingPage plugin hook. This hook can now return an object with an html property which returns a Promise<string> in addition to a string (which was the only option before).

Updated dependencies [0adaf80d1]:

@apollo/server@4.7.4

@apollo/server@4.7.4

Patch Changes

0adaf80d1 Thanks @trevor-scheer! - Address Content Security Policy issues

The previous implementation of CSP nonces within the landing pages did not take full advantage of the security benefit of using them. Nonces should only be used once per request, whereas Apollo Server was generating one nonce and reusing it for the lifetime of the instance. The reuse of nonces degrades the security benefit of using them but does not pose a security risk on its own. The CSP provides a defense-in-depth measure against a potential XSS, so in the absence of a known XSS vulnerability there is likely no risk to the user.

The mentioned fix also coincidentally addresses an issue with using crypto functions on startup within Cloudflare Workers. Crypto functions are now called during requests only, which resolves the error that Cloudflare Workers were facing. A recent change introduced a precomputedNonce configuration option to mitigate this issue, but it was an incorrect approach given the nature of CSP nonces. This configuration option is now deprecated and should not be used for any reason since it suffers from the previously mentioned issue of reusing nonces.

... (truncated)

Changelog

Sourced from @apollo/server's changelog.

4.7.5

Patch Changes

#7614 4fadf3ddc Thanks @Cellule! - Publish TypeScript typings for CommonJS modules output.

This allows TypeScript projects that use CommonJS modules with moduleResolution: "node16" or moduleResolution: "nodeNext" to correctly resolves the typings of apollo's packages as CommonJS instead of ESM.

Updated dependencies [4fadf3ddc]:

@apollo/cache-control-types@1.0.3

@apollo/server-gateway-interface@1.1.1

@apollo/usage-reporting-protobuf@4.1.1

4.7.4

Patch Changes

0adaf80d1 Thanks @trevor-scheer! - Address Content Security Policy issues

The previous implementation of CSP nonces within the landing pages did not take full advantage of the security benefit of using them. Nonces should only be used once per request, whereas Apollo Server was generating one nonce and reusing it for the lifetime of the instance. The reuse of nonces degrades the security benefit of using them but does not pose a security risk on its own. The CSP provides a defense-in-depth measure against a potential XSS, so in the absence of a known XSS vulnerability there is likely no risk to the user.

The mentioned fix also coincidentally addresses an issue with using crypto functions on startup within Cloudflare Workers. Crypto functions are now called during requests only, which resolves the error that Cloudflare Workers were facing. A recent change introduced a precomputedNonce configuration option to mitigate this issue, but it was an incorrect approach given the nature of CSP nonces. This configuration option is now deprecated and should not be used for any reason since it suffers from the previously mentioned issue of reusing nonces.

Additionally, this change adds other applicable CSPs for the scripts, styles, images, manifest, and iframes that the landing pages load.

A final consequence of this change is an extension of the renderLandingPage plugin hook. This hook can now return an object with an html property which returns a Promise<string> in addition to a string (which was the only option before).

4.7.3

Patch Changes
#7601 75b668d9e Thanks @trevor-scheer! - Provide a new configuration option for landing page plugins precomputedNonce which allows users to provide a nonce and avoid calling into uuid functions on startup. This is useful for Cloudflare Workers where random number generation is not available on startup (only during requests). Unless you are using Cloudflare Workers, you can ignore this change.

The example below assumes you've provided a PRECOMPUTED_NONCE variable in your wrangler.toml file.

Example usage:
const server = new ApolloServer({
  // ...
  plugins: [
    ApolloServerPluginLandingPageLocalDefault({
      precomputedNonce: PRECOMPUTED_NONCE,
    }),
  ],
});

... (truncated)

Commits

65a8ac8 Version Packages (#7620)
4fadf3d Publish CommonJS Typescript Types (#7614)
4dd276a Version Packages (#7609)
0adaf80 Merge pull request from GHSA-68jh-rf6x-836f
2f4b034 Version Packages (#7602)
75b668d Allow landing page to be configured with a precomputed nonce (fix for CF work...
51b79ac Version Packages (#7600)
c3f04d0 Update @apollo/utils.usagereporting dependency (#7599)
0233a2d Update codegen types and enforce keeping types up-to-date (#7580)
5ab08c1 Version Packages (#7541)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)