fix(deps): update all npm non-major packages >= 1.0 #358

renovate · 2023-06-15T21:49:31Z

This PR contains the following updates:

Package	Change	Type	Update
@apollo/federation-internals (source)	`2.9.1` -> `2.9.3`	dependencies	patch
@apollo/query-planner (source)	`2.9.1` -> `2.9.3`	dependencies	patch
@apollo/usage-reporting-protobuf (source)	`4.1.0` -> `4.1.1`	dependencies	patch
make-dir-cli	`3.0.0` -> `3.1.0`	devDependencies	minor
node (source)	`16.20.0` -> `16.20.2`	volta	patch
npm (source)	`9.7.1` -> `9.9.3`	volta	minor
typescript (source)	`5.1.3` -> `5.6.3`	devDependencies	minor

Release Notes

apollographql/federation (@apollo/federation-internals)

`v2.9.3`

Compare Source

Patch Changes

fix: normalize field set selection sets (#3162)

FieldSet scalar represents a selection set without outer braces. This means that users could potentially specify some selections that could be normalized (i.e. eliminate duplicate field selections, hoist/collapse unnecessary inline fragments, etc). Previously we were using @requires field set selection AS-IS for edge conditions. With this change we will now normalize the FieldSet selections before using them as fetch node conditions.
Fixed missing referenced variables in the variableUsages field of fetch operations (#3166)

Query variables used in fetch operation should be listed in the variableUsages field. However, there was a bug where variables referenced by query-level directives could be missing in the field.
Fix fragment generation recursion logic to apply minification on all subselections. (#3158)
Fixed a bug that __typename with applied directives gets lost in fetch operations. (#3164)

The sibling typename optimization used by query planner simplifies operations by folding __typename selections into their sibling selections. However, that optimization does not account for directives or aliases. The bug was applying the optimization even if the __typename has directives on it, which caused the selection to lose its directives. Now, __typename with directives (or aliases) are excluded from the optimization.

`v2.9.2`

Compare Source

Patch Changes

Fixes handling of a __typename selection during query planning process. (#3156)

When expanding fragments we were keeping references to the same Fields regardless where those fragments appeared in our original selection set. This was generally fine as in most cases we would have same inline fragment selection sets across whole operation but was causing problems when we were applying another optimization by collapsing those expanded inline fragments creating a new selection set. As a result, if any single field selection (within that fragment) would perform optimization around the usage of __typename, ALL occurrences of that field selection would get that optimization as well.
Add validations for demand control directive applications (#3148)

apollographql/federation (@apollo/query-planner)

`v2.9.3`

Compare Source

Patch Changes

Fixes edge case where contextual arguments can yield inefficient query plans. Also fixes naming of query plan arguments which can be a problem when using contextual variables in multiple subgraphs (#3140)
Ensure all useless fetch groups are removed (#3163)

When removing "useless" fetch nodes/groups we remove them in-place while still iterating over the same list. This leads to potentially skipping processing of some the children fetch nodes, as when we remove nodes we left shift all remaining children but the iterator keeps the old position unchanged effectively skipping next child.
fix: normalize field set selection sets (#3162)

FieldSet scalar represents a selection set without outer braces. This means that users could potentially specify some selections that could be normalized (i.e. eliminate duplicate field selections, hoist/collapse unnecessary inline fragments, etc). Previously we were using @requires field set selection AS-IS for edge conditions. With this change we will now normalize the FieldSet selections before using them as fetch node conditions.
Fixed missing referenced variables in the variableUsages field of fetch operations (#3166)

Query variables used in fetch operation should be listed in the variableUsages field. However, there was a bug where variables referenced by query-level directives could be missing in the field.
Fixed a bug that __typename with applied directives gets lost in fetch operations. (#3164)

The sibling typename optimization used by query planner simplifies operations by folding __typename selections into their sibling selections. However, that optimization does not account for directives or aliases. The bug was applying the optimization even if the __typename has directives on it, which caused the selection to lose its directives. Now, __typename with directives (or aliases) are excluded from the optimization.
Updated dependencies [345661c558773e4eb5d5f0b28464a8d1acdc2a2d, e00e1c9892b48ac89823597113989830877966ef, cc4573471696ef78d04fa00c4cf8e5c50314ba9f, 062572b3253e8640b60a0bf58b83945094b76b6f, df5eb3cb0e2b4802fcd425ab9c23714de2707db3, 1c99cb0dcc6c639ac351210932623ab0bd6907e4]:
- @apollo/query-graphs @2.9.3
- @apollo/federation-internals @2.9.3

`v2.9.2`

Compare Source

Patch Changes

Fixes handling of a __typename selection during query planning process. (#3156)

When expanding fragments we were keeping references to the same Fields regardless where those fragments appeared in our original selection set. This was generally fine as in most cases we would have same inline fragment selection sets across whole operation but was causing problems when we were applying another optimization by collapsing those expanded inline fragments creating a new selection set. As a result, if any single field selection (within that fragment) would perform optimization around the usage of __typename, ALL occurrences of that field selection would get that optimization as well.
Fixes issue where contextual parameters can have naming collisions if used in multiple subgraphs (#3155)
Updated dependencies [2192f355f50db33fe0807d16153f357696b9f190, e1e2605b30efc488b57f62ba43436606a38a3607, 5ac01b534318105e904c1e6598070f753add3bb1]:
- @apollo/federation-internals @2.9.2
- @apollo/query-graphs @2.9.2

apollographql/apollo-server (@apollo/usage-reporting-protobuf)

`v4.1.1`

Compare Source

Patch Changes

#7614 4fadf3ddc Thanks @Cellule! - Publish TypeScript typings for CommonJS modules output.

This allows TypeScript projects that use CommonJS modules with
moduleResolution: "node16" or
moduleResolution: "nodeNext"
to correctly resolves the typings of apollo's packages as CommonJS instead of ESM.

sindresorhus/make-dir-cli (make-dir-cli)

`v3.1.0`

Compare Source

Update make-dir dependency (#3) b477ce2

nodejs/node (node)

`v16.20.2`: 2023-08-09, Version 16.20.2 'Gallium' (LTS), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
OpenSSL Security Releases

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

[40c3958a5a] - deps: update archs files for OpenSSL-1.1.1v (RafaelGSS) #49043
[a9ac9da89a] - deps: fix openssl crypto clean (RafaelGSS) #49043
[362d4c7494] - deps: upgrade openssl sources to OpenSSL_1_1_1v (RafaelGSS) #49043
[d8ccfe9ad4] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#445
[242aaa0caa] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#459

`v16.20.1`: 2023-06-20, Version 16.20.1 'Gallium' (LTS), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
OpenSSL Security Releases
c-ares vulnerabilities:

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

[5a92ea7a3b] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen)
[5df04e893a] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
[c171cbd124] - deps: update c-ares to 1.19.1 (RafaelGSS) #48115
[155d3aac02] - deps: update archs files for OpenSSL-1.1.1u+quic (RafaelGSS) #48369
[8d4c8f8ebe] - deps: upgrade openssl sources to OpenSSL_1_1_1u (RafaelGSS) #48369
[1a5c9284eb] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
[e42ff4b018] - http: disable request smuggling via empty headers (Paolo Insogna) nodejs-private/node-private#429
[10042683c8] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
[a6f4e87bc9] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
[b77000f4d7] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #47851

npm/cli (npm)

`v9.9.3`

Compare Source

Bug Fixes

88ea8c7 #7010 set objectMode for search filter stream (@lukekarrys)
8d9d735 #7010 unpublish: bubble up all errors parsing local package.json (#7049) (@wraithgar)
e0e75e5 #7010 unpublish bugfixes (#7039) (@wraithgar)
4d59ce1 #7047 reverse direction of SPDX SBOM dep rels (#7047) (@bdehamer, @antonbauhofer)
878f22b #7008 properly catch missing url opener error (@wraithgar)
91a8eca #7008 properly catch missing url opener error on interactive prompt (@wraithgar)

Dependencies

1968e0e #7010 [email protected]
d130576 #7010 [email protected]
00f28b8 #7010 [email protected]
57096c3 #7010 [email protected]
3ce677e #7010 [email protected]
89757ed #7010 [email protected]
bc1e841 #7010 [email protected]
01f4049 #7010 [email protected]
15f8982 #7010 [email protected]
88ff949 #7010 [email protected]
3e298f6 #7010 [email protected]
35a6286 #7010 [email protected]
aeb28c4 #7010 [email protected]
edc7e23 #7010 @npmcli/[email protected]
00a3a08 #7010 [email protected]
7f424c3 #7010 [email protected]
79b8538 #7010 [email protected]
b5faf10 #7010 [email protected]
2c62266 #7010 [email protected]
cc0516b #7010 [email protected]
651d362 #7010 [email protected]
4b239c6 #7010 [email protected]
2f65b46 #7010 [email protected]
6c73ddf #7010 [email protected]
73ee6cc #7010 [email protected]
64715a4 #7010 [email protected]
workspace: @npmcli/[email protected]
workspace: @npmcli/[email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]
workspace: [email protected]

Chores

77fa150 #7252 release: do not exclude docs directory from CLI release commits (#7162) (@lukekarrys)
1d4c464 #7252 @npmcli/[email protected] (@lukekarrys)
6780643 #7010 dev dependency updates (@wraithgar)
ce701e9 #7048 fix tests for zlib differences between node versions (#7048) (@wraithgar)

`v9.9.2`

Compare Source

Bug Fixes

4c9a5e1 #6993 look in workspace for exec commands (#6993) (@wraithgar)
bb6f496 #6992 correctly handle object licenses in SBOM generation (#6992) (@bdehamer, @jamietanna)
10db3ca #6990 pkg: properly output in workspace mode (#6990) (@wraithgar)

Documentation

6ab06d7 #6985 update npm-prune description (#6985) (@Eomm)

Dependencies

Workspace: [email protected]

`v9.9.1`

Compare Source

Bug Fixes

0dba79a #6942 add back bin/node-gyp-bin/node-gyp files (@lukekarrys)
c93edb5 #6932 add back bin/node-gyp-bin/node-gyp files (@lukekarrys)

Documentation

e6cce28 #6925 use markdown links instead of html (@lukekarrys)

`v9.9.0`

Compare Source

Features

ecda95a #6841 add npm sbom command (#6841) (@bdehamer)
fdb8a86 #6794 add package-lock-only mode to npm query (@wraithgar)
16c04b1 #6877 add no-package-lock mode to npm audit (@wraithgar)
66ef765 #6776 Add --cpu and --os option to override platform specific install (#6776) (@yukukotani)

Bug Fixes

c9406f7 #6791 deprecate: ignore implicit workspace mode (#6758) (#6791) (@wraithgar)
0b1d7c3 #6779 allow searching packages with no description (#6779) (@wraithgar, @lukekarrys)

Documentation

9750720 #6694 fix example path (#6694) (@fvilers)

Dependencies

`v9.8.1`

Compare Source

Bug Fixes

38351c9 #6651 warn on autocorrected package.json entries during publish (@wraithgar)
02c7ddb #6642 much clearer npx 'canceled' error (#6642) (@rahulio96, @AaronHamilton965)

Documentation

36bf5fe #6643 Added steps for using npm/npx locally to CONTRIBUTING.md (#6643) (@AaronHamilton965, @rahulio96)

Bug Fixes

939a188 #6574 ignore node prereleases in npm engines check (#6574) (@wraithgar)
d980405 #6556 better color support detection (#6556) (@lukekarrys)
40d7e09 #6555 remove unnecessary package.json values (#6555) (@lukekarrys)
3a7378d #6554 cleanup bin contents (@lukekarrys)
e722439 #6497 move all definitions to @npmcli/config package (@lukekarrys)

Documentation

405ffbf #6557 remove redundant statement about files attribute (#6557) (@DaviDevMod)
cd1e6aa #6551 add flag package-lock-only for npm install (#6551) (@m4rch3n1ng)

Dependencies

aebc523 #6585 [email protected] [email protected] (#6585)
bb6054b #6573 [email protected]
aee4a30 #6573 [email protected]
6105dbc #6573 [email protected]
22d44e8 #6573 [email protected]
fdd02fd #6573 [email protected]
7797075 #6573 [email protected]
f9780cc #6573 [email protected]
72d6a79 #6573 [email protected]
98f1f5f #6573 [email protected]
8710ff8 #6573 [email protected]
0cb539d #6573 [email protected]
39ad586 #6573 [email protected]
5e0070c #6573 [email protected] [email protected]
26cf235 #6573 [email protected]
Workspace: @npmcli/[email protected]
Workspace: @npmcli/[email protected]
Workspace: [email protected]
Workspace: [email protected]
Workspace: [email protected]
Workspace: [email protected]
Workspace: [email protected]

microsoft/TypeScript (typescript)

`v5.6.3`

Compare Source

`v5.6.2`

Compare Source