Bump the npm_and_yarn group across 5 directories with 2 updates by dependabot[bot] · Pull Request #356 · ekino/v6y

dependabot · 2026-03-20T08:17:17Z

Bumps the npm_and_yarn group with 1 update in the /v6y-apps/bff directory: @apollo/server.
Bumps the npm_and_yarn group with 1 update in the /v6y-apps/front directory: next.
Bumps the npm_and_yarn group with 1 update in the /v6y-apps/front-bo directory: next.
Bumps the npm_and_yarn group with 1 update in the /v6y-libs/ui-kit directory: next.
Bumps the npm_and_yarn group with 1 update in the /v6y-libs/ui-kit-front directory: next.

Updates @apollo/server from 4.11.3 to 5.4.0

Release notes

Sourced from @apollo/server's releases.

@apollo/server-integration-testsuite@5.4.0

Patch Changes

Updated dependencies [d25a5bd]:

@apollo/server@5.4.0

@apollo/server@5.4.0

Minor Changes

d25a5bd Thanks @phryneas! - ⚠️ SECURITY @apollo/server/standalone:

The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, we may tighten this restriction further to only allow UTF-8.

If you were not using startStandaloneServer, you were not affected by this vulnerability.

Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

@apollo/server-integration-testsuite@5.3.0

Patch Changes

Updated dependencies [8e54e58, 26320bc]:

@apollo/server@5.3.0

@apollo/server@5.3.0

Minor Changes
#8062 8e54e58 Thanks @cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)
const server = new ApolloServer({
  typeDefs,
  resolvers,
  executionOptions: {
    maxCoercionErrors: 50,
  },
});
#8014 26320bc Thanks @mo4islona! - Expose graphql validation options.
const server = new ApolloServer({
  typeDefs,

... (truncated)

Changelog

Sourced from @apollo/server's changelog.

5.4.0

Minor Changes

d25a5bd Thanks @phryneas! - ⚠️ SECURITY @apollo/server/standalone:

The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, we may tighten this restriction further to only allow UTF-8.

If you were not using startStandaloneServer, you were not affected by this vulnerability.

Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

5.3.0

Minor Changes
#8062 8e54e58 Thanks @cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)
const server = new ApolloServer({
  typeDefs,
  resolvers,
  executionOptions: {
    maxCoercionErrors: 50,
  },
});
#8014 26320bc Thanks @mo4islona! - Expose graphql validation options.
const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationOptions: {
    maxErrors: 10,
  },
});
5.2.0

Minor Changes

... (truncated)

Commits

ad45d15 Version Packages (#8179)
d25a5bd Merge commit from fork
443e547 fix repository urls
28d6d47 Version Packages (#8172)
26320bc feat: Allow configuration of graphql validation options #8014
f2c16a7 bump dependency
8e54e58 feat: Allow configuration of graphql execution options(maxCoercionErrors)
7be3686 Version Packages (#8163)
51acbeb Require legacy incremental execute as an ApolloServer option instead of a d...
ae1be29 Version Packages (#8155)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @apollo/server since your current version.

Updates next from 15.5.10 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)

Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @styfle and @lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

v15.5.11

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Tracing: Fix memory leak in span map (#85529)

fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#89134)

Turbopack: fix NFT tracing of sharp 0.34 (#82340)

Turbopack: support pattern into exports field (#82757)

NFT tracing fixes (#84155 and #85323)

Turbopack: validate CSS without computing all paths (#83810)

feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#89129)

Credits

Huge thanks to @timneutkens, @mischnic, @ztanner, and @wyattjoh for helping!

Commits

d7b012d v15.5.14
2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
cfd5f53 v15.5.13
15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
d23f41c v15.5.12
8e75765 fix unlock in publish-native
6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
7a94645 Apply needs for publishRelease
bbfd4e3 v15.5.11
Additional commits viewable in compare view

Updates next from 15.5.10 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)

Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @styfle and @lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

v15.5.11

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Tracing: Fix memory leak in span map (#85529)

fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#89134)

Turbopack: fix NFT tracing of sharp 0.34 (#82340)

Turbopack: support pattern into exports field (#82757)

NFT tracing fixes (#84155 and #85323)

Turbopack: validate CSS without computing all paths (#83810)

feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#89129)

Credits

Huge thanks to @timneutkens, @mischnic, @ztanner, and @wyattjoh for helping!

Commits

d7b012d v15.5.14
2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
cfd5f53 v15.5.13
15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
d23f41c v15.5.12
8e75765 fix unlock in publish-native
6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
7a94645 Apply needs for publishRelease
bbfd4e3 v15.5.11
Additional commits viewable in compare view

Updates next from 15.5.10 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)

Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @styfle and @lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

v15.5.11

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Tracing: Fix memory leak in span map (#85529)

fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#89134)

Turbopack: fix NFT tracing of sharp 0.34 (#82340)

Turbopack: support pattern into exports field (#82757)

NFT tracing fixes (#84155 and #85323)

Turbopack: validate CSS without computing all paths (#83810)

feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#89129)

Credits

Huge thanks to @timneutkens, @mischnic, @ztanner, and @wyattjoh for helping!

Commits

d7b012d v15.5.14
2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
cfd5f53 v15.5.13
15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
d23f41c v15.5.12
8e75765 fix unlock in publish-native
6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
7a94645 Apply needs for publishRelease
bbfd4e3 v15.5.11
Additional commits viewable in compare view

Updates next from 15.5.10 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)

Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @styfle and @lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

v15.5.11

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Tracing: Fix memory leak in span map (#85529)

fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#89134)

Turbopack: fix NFT tracing of sharp 0.34 (#82340)

Turbopack: support pattern into exports field (#82757)

NFT tracing fixes (#84155 and #85323)

Turbopack: validate CSS without computing all paths (#83810)

feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#89129)

Credits

Huge thanks to @timneutkens, @mischnic, @ztanner, and @wyattjoh for helping!

Commits

d7b012d v15.5.14
2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
cfd5f53 v15.5.13
15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
d23f41c v15.5.12
8e75765 fix unlock in publish-native
6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
7a94645 Apply needs for publishRelease
bbfd4e3 v15.5.11
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the npm_and_yarn group with 1 update in the /v6y-apps/bff directory: [@apollo/server](https://github.com/apollographql/apollo-server/tree/HEAD/packages/server). Bumps the npm_and_yarn group with 1 update in the /v6y-apps/front directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /v6y-apps/front-bo directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /v6y-libs/ui-kit directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /v6y-libs/ui-kit-front directory: [next](https://github.com/vercel/next.js). Updates `@apollo/server` from 4.11.3 to 5.4.0 - [Release notes](https://github.com/apollographql/apollo-server/releases) - [Changelog](https://github.com/apollographql/apollo-server/blob/main/packages/server/CHANGELOG.md) - [Commits](https://github.com/apollographql/apollo-server/commits/@apollo/server@5.4.0/packages/server) Updates `next` from 15.5.10 to 15.5.14 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.10...v15.5.14) Updates `next` from 15.5.10 to 15.5.14 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.10...v15.5.14) Updates `next` from 15.5.10 to 15.5.14 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.10...v15.5.14) Updates `next` from 15.5.10 to 15.5.14 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.10...v15.5.14) --- updated-dependencies: - dependency-name: "@apollo/server" dependency-version: 5.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.14 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.14 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.14 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.14 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 20, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/v6y-apps/bff/npm_and_yarn-8d6517d69d branch 2 times, most recently from 295ddb9 to 87b5445 Compare March 25, 2026 07:35

dependabot Bot force-pushed the dependabot/npm_and_yarn/v6y-apps/bff/npm_and_yarn-8d6517d69d branch from 87b5445 to 887cc26 Compare March 26, 2026 09:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 5 directories with 2 updates#356

Bump the npm_and_yarn group across 5 directories with 2 updates#356
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/v6y-apps/bff/npm_and_yarn-8d6517d69d

dependabot Bot commented on behalf of github Mar 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​apollo/server-integration-testsuite@​5.4.0

Patch Changes

@​apollo/server@​5.4.0

Minor Changes

@​apollo/server-integration-testsuite@​5.3.0

Patch Changes

@​apollo/server@​5.3.0

Minor Changes

5.4.0

Minor Changes

5.3.0

Minor Changes

5.2.0

Minor Changes

v15.5.14

Core Changes

Credits

v15.5.13

Core Changes

Credits

v15.5.12

v15.5.11

Core Changes

Credits

v15.5.14

Core Changes

Credits

v15.5.13

Core Changes

Credits

v15.5.12

v15.5.11

Core Changes

Credits

v15.5.14

Core Changes

Credits

v15.5.13

Core Changes

Credits

v15.5.12

v15.5.11

Core Changes

Credits

v15.5.14

Core Changes

Credits

v15.5.13

Core Changes

Credits

v15.5.12

v15.5.11

Core Changes

Credits

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Mar 20, 2026 •

edited

Loading

`@apollo/server-integration-testsuite@5`.4.0

`@apollo/server@5`.4.0

`@apollo/server-integration-testsuite@5`.3.0

`@apollo/server@5`.3.0