fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@apollo/server (source)	4.11.0 -> 4.11.3
@types/node (source)	22.8.1 -> 22.10.6
express (source)	4.21.1 -> 4.21.2
graphql	16.9.0 -> 16.10.0
typescript (source)	5.6.3 -> 5.7.3

---

Release Notes

apollographql/apollo-server (@​apollo/server)

v4.11.3

Compare Source

Patch Changes

• #​8010 f4228e8 Thanks @​glasser! - Compatibility with Next.js Turbopack. Fixes #​8004.

v4.11.2

Compare Source

(No change; there is a change to the @apollo/server-integration-testsuite used to test integrations, and the two packages always have matching versions.)

v4.11.1

Compare Source

Patch Changes

• #​7952 bb81b2c Thanks @​glasser! - Upgrade dependencies so that automated scans don't detect a vulnerability.

  @apollo/server depends on express which depends on cookie. Versions of express older than v4.21.1 depend on a version of cookie vulnerable to CVE-2024-47764. Users of older express versions who call res.cookie() or res.clearCookie() may be vulnerable to this issue.

  However, Apollo Server does not call this function directly, and it does not expose any object to user code that allows TypeScript users to call this function without an unsafe cast.

  The only way that this direct dependency can cause a vulnerability for users of Apollo Server is if you call startStandaloneServer with a context function that calls Express-specific methods such as res.cookie() or res.clearCookies() on the response object, which is a violation of the TypeScript types provided by startStandaloneServer (which only promise that the response object is a core Node.js http.ServerResponse rather than the Express-specific subclass). So this vulnerability can only affect Apollo Server users who use unsafe JavaScript or unsafe as typecasts in TypeScript.

  However, this upgrade will at least prevent vulnerability scanners from alerting you to this dependency, and we encourage all Express users to upgrade their project's own express dependency to v4.21.1 or newer.

expressjs/express (express)

v4.21.2

Compare Source

graphql/graphql-js (graphql)

v16.10.0: 16.10.0

Compare Source

v16.10.0 (2024-12-15)

New Feature 🚀

• #​4286 fix: properly type extensions in GraphQLFormattedError (@​tpoisseau)
• #​4292 Expose tokenCount on the DocumentNode (@​JoviDeCroock)

Bug Fix 🐞

• #​4137 backport(v16): Require non-empty directive locations (#​4100) (@​benjie)
• #​4168 fix(validation): catch OverlappingFieldsCanBeMergedRule violations with nested fragments (@​sachindshinde)
• #​4226 Backport introspection type fix (@​JoviDeCroock)
• #​4291 Address empty selection-set (@​JoviDeCroock)

Docs 📝

10 PRs were merged

• #​4240 Convert from docusaurus to nextra (@​JoviDeCroock)
• #​4248 Add content from https://github.com/graphql/graphql.github.io/pull/1782 (@​JoviDeCroock)
• #​4249 Styling fixes (@​JoviDeCroock)
• #​4256 Various fixes to docs (@​JoviDeCroock)
• #​4279 Solve some low hanging fruit in the documentation (@​JoviDeCroock)
• #​4283 Add overview page and add stackblitz to tutorial (@​JoviDeCroock)
• #​4284 Provide people with tabs so they can use classes as well (@​JoviDeCroock)
• #​4289 Add note about defer/stream being v17 (@​JoviDeCroock)
• #​4290 Write about @oneOf in the graphql-js documentation (@​JoviDeCroock)
• #​4295 Split up in v16 API documentation (@​JoviDeCroock)

Internal 🏠

4 PRs were merged

• #​4138 Upgrade codecov action and pass token (@​benjie)
• #​4139 Fix codecov workflow (@​benjie)
• #​4157 Add GraphQLConf 2024 banner (@​bignimbus)
• #​4193 Upgrade deprecated actions (@​JoviDeCroock)

Committers: 5

• Benjie(@​benjie)
• Jeff Auriemma(@​bignimbus)
• Jovi De Croock(@​JoviDeCroock)
• Sachin D. Shinde(@​sachindshinde)
• tpoisseau(@​tpoisseau)

microsoft/TypeScript (typescript)

v5.7.3

Compare Source

v5.7.2

Compare Source

---

Configuration

📅 Schedule: Branch creation - "* * * * 0,6" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.