chore: small security fix to update superagent #7649
Conversation
|
@mastrzyz: Thank you for submitting a pull request! Before we can merge it, you'll need to sign the Apollo Contributor License Agreement here: https://contribute.apollographql.com/ |
👷 Deploy request for apollo-server-docs pending review.Visit the deploys page to approve it
|
|
This pull request is automatically built and testable in CodeSandbox. To see build info of the built libraries, click here or the icon next to each commit SHA. Latest deployment of this branch, based on commit b05ef19:
|
trevor-scheer
force-pushed
the
mastrzyz/small_security_fix
branch
from
6dfc093 to
b05ef19
Compare
There was a problem hiding this comment.
Thanks for spotting this, I made a couple tweaks to your branch for the sake of expediency, probably going to cut a release first thing tomorrow.
The main thing is: this should be installed as a dependency to the integration testsuite package specifically rather than the top-level monorepo.
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @apollo/[email protected] ### Minor Changes - [#7634](#7634) [`f8a8ea08f`](f8a8ea0) Thanks [@dfperry5](https://github.com/dfperry5)! - Updating the ApolloServer constructor to take in a stringifyResult function that will allow a consumer to pass in a function that formats the result of an http query. Usage: ```ts const server = new ApolloServer({ typeDefs, resolvers, stringifyResult: (value: FormattedExecutionResult) => { return JSON.stringify(value, null, 2); }, }); ``` ## @apollo/[email protected] ### Patch Changes - [#7649](#7649) [`d33acdfdd`](d33acdf) Thanks [@mastrzyz](https://github.com/mastrzyz)! - Add missing `supertest` dependency - [#7632](#7632) [`64f8177ab`](64f8177) Thanks [@renovate](https://github.com/apps/renovate)! - Update graphql-http dependency - Updated dependencies \[[`f8a8ea08f`](f8a8ea0)]: - @apollo/[email protected] Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
|
Thanks @trevor-scheer , there is a Eslint rule we can enable here as a follow up I can take a look if sounds good —> https://github.com/import-js/eslint-plugin-import/blob/main/docs/rules/no-extraneous-dependencies.md |
|
@mastrzyz sounds good, go ahead and open a PR. Thanks! |
Problem Super Agent is a package used but implicitly installed in node_module due to other packages importing it :
Solution
specify it in the main package.json so to alleviate surprises in the future.
Problem "CookieJar" is a dependency used by Super Agent which currently has a security bulletin :
Solution , perform a minor bump of
SuperAgentwhich has a fix for the CookieJar issueDoes it all work?
formidableandcookiejarare only used bysuperAgentso we can just verify the current tests usingsuperAgentSo Let's run every test!