[Snyk] Upgrade @apollo/rover from 0.14.2 to 0.23.0 #204
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade @apollo/rover from 0.14.2 to 0.23.0. See this package in npm: @apollo/rover See this project in Snyk: https://app.snyk.io/org/cachiman-inc/project/5312fdfd-d533-4187-9a75-33fe4986af1c?utm_source=github&utm_medium=referral&page=upgrade-pr
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to upgrade @apollo/rover from 0.14.2 to 0.23.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 23 versions ahead of your current version.
The recommended version was released on 4 months ago.
Issues fixed by the recommended upgrade:
SNYK-JS-AXIOS-6032459
SNYK-JS-AXIOS-6124857
Release notes
Package name: @apollo/rover
-
0.23.0 - 2024-03-26
- Add
- Support unix socket URLs - @ Geal PR #1879
- Use task specific
- Prevent an infinite loop when restarting the router - @ Geal PR #1855
- Use
- Upgrade axios to address a security warning - @ goto-bus-stop PR #1819
- Remove yanked online check - @ dylan-apollo PR #1803
-
-
-
-
0.23.0-rc.3 - 2024-02-20
-
0.23.0-rc.2 - 2024-02-16
-
0.23.0-rc.1 - 2024-01-26
-
0.23.0-rc.0 - 2024-01-18
-
0.22.0 - 2023-12-14
-
-
-
-
-
-
-
0.21.0 - 2023-10-23
-
-
-
0.20.0 - 2023-10-05
-
-
-
- Improve wording of persisted queries documentation - @ Meschreiber, #1760
-
0.19.1 - 2023-09-22
-
- Updates to Rust 1.72.1 - @ EverlastingBugstopper, #1751
-
0.19.0 - 2023-09-19
-
-
- No output styling when writing to a file or redirecting output via a pipe - @ EverlastingBugstopper, #1747
-
-
- Include the list of available templates in Rover's documentation - @ smyrick, #1733
-
0.18.1 - 2023-08-23
-
0.18.0 - 2023-08-10
-
0.17.3 - 2023-08-02
-
0.17.2 - 2023-07-18
-
0.17.1 - 2023-07-14
-
0.16.2 - 2023-06-28
-
0.16.1 - 2023-06-27
-
0.16.0 - 2023-06-15
-
0.16.0-alpha.1 - 2023-06-15
-
0.16.0-alpha.0 - 2023-06-14
-
0.15.0 - 2023-06-14
-
0.15.0-alpha.1 - 2023-05-31
-
0.15.0-alpha.0 - 2023-05-25
-
0.14.2 - 2023-05-31
from @apollo/rover GitHub release notes🚀 Features
--no-urlshorthand tosubgraph publish- @ lennyburdette PR#1809
This is slightly more convenient and less awkward than
--routing-url --allow-invalid-routing-urlSince its 1.43.0 release, the Router can now connect to subgraph over unix sockets. This removes a warning when publishing a schema with a
unix://URL.🐛 Fixes
rayonthreadpools and not the global threadpool - @ garypen PR #1872This increases rover's reliability by executing independent tasks in different thread pools.
When restarting a Router on schema updates, it could happen that an internal task of Rover would go in an infinite loop and consume CPU needlessly. This is now fixed and should make
rover devmore reliable.proposalCoveragein addition toseverityLevelto build correct proposal check messaging - @ swcollard PR #1845This updates the message on proposal checks depending on the
proposalCoveragefield🛠 Maintenance
The vulnerability didn't affect rover, but now you won't get a warning for it!
📚 Documentation
Update dev docs about which Router version is used - @ smyrick PR #1822
Update warning about
federation_versioninrover compose- @ smyrick, @ Meschreiber PR #1806Document how to use
subgraph fetchwith proposals - @ Meschreiber PR #1823To install this specific version of Rover:
This release was automatically created by CircleCI.
If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.
Binaries built for MacOS are signed, notarized, and automatically verified with Gatekeeper.
To install this specific version of Rover:
This release was automatically created by CircleCI.
If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.
Binaries built for MacOS are signed, notarized, and automatically verified with Gatekeeper.
To install this specific version of Rover:
This release was automatically created by CircleCI.
If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.
Binaries built for MacOS are signed, notarized, and automatically verified with Gatekeeper.
To install this specific version of Rover:
This release was automatically created by CircleCI.
If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.
Binaries built for MacOS are signed, notarized, and automatically verified with Gatekeeper.
🚀 Features
Add offline license support - @ BrynCooke PR #1796 - Issue #1793
Adds rover
license fetch <graph_ref>Output:
rover license fetch --graph-id starstuff --profile ghFetching license for starstuff using credentials from the gh profile.
Success!
<redacted jwt>
🐛 Fixes
Handle new rate limit error - @ bnjjj #1798
Update the GraphQL schema and handle the new rate limit error.
🛠 Maintenance
First trial use of a generator (Scaffolding code for creating a new verb for an existing noun/command) - @ tapegram PR #1786
First try at taking the instructions from the readme on how to scaffold a new verb on an existing command and added plop tooling to be able to generate the scaffolding automatically.
npx plopThis is an initial exploratory PR. Later PRs will build this into the dev tooling and expand on the functionality (if we don't decide to remove it)
📚 Documentation
Move Validating client ops to Apollo CLI section - @ Meschreiber #1783
This PR moves Validating client operations into the Rover > Apollo CLI section.
Use shared content component for GH action instructions - @ Meschreiber #1780
This PR replaces some text with a new shared content component containing that text.
Remove note on restricted supergraph.yml expansion - @ dylan-apollo #1779 - issue #1629
supergraph.yamlfiles now supports environment variable expansion everywhere, not just in introspection headers.This release was automatically created by CircleCI.
If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.
Binaries built for MacOS are signed, notarized, and automatically verified with Gatekeeper.
🚀 Features
Add C# as a language in
rover template- @ dylan-apollo, #1769This means you can now filter templates with
--language c-sharp. Check out the first C# template by runningrover template use subgraph-csharp-hotchocolate-annotation!Display proposal check task results in
rover subgraph check- @ swcollard, #1768When running
rover subgraph check, proposal check task results will be displayed in Rover. "Proposals" are a GraphOS feature currently in private preview that allow proposing subgraph schema changes before implementation. Integrating them with checks allows subgraph teams to ensure they have properly implemented a proposed schema change. This change will not affect you if your organization has not been granted preview access by Apollo.This release was automatically created by CircleCI.
If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.
Binaries built for MacOS are signed, notarized, and automatically verified with Gatekeeper.
🚀 Features
Persisted Queries is now GA - @ glasser, #1756
The
rover persisted-queries publishcommand is now out of the public preview phase and has entered general availability. Check out the documentation for this enterprise feature.🐛 Fixes
Better message for a subgraph published with no changes - @ bonnici, #1757
rover subgraph publishnow logs a message tostdoutwhen a subgraph was published and there were no changes to the schema.Don't log username/password if
APOLLO_ROVER_DOWNLOAD_HOSTincludes authentication in the URL - @ EverlastingBugstopper, #1758Previously, when using the
APOLLO_ROVER_DOWNLOAD_HOSTenvironment variable to override the download location of a plugin binary, Rover would log the entire URL to stdout, potentially leaking username and password authentication details if they were included in the URL. Now, Rover strips that information from the URLs before printing the download location. If Rover is not able to strip that information (likely due to an invalid URL), then it doesn't try to print the sanitized URL at all.📚 Documentation
This release was automatically created by CircleCI.
If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.
Binaries built for MacOS are signed, notarized, and automatically verified with Gatekeeper.
🐛 Fixes
Fix diagnostic highlighting in
rover {sub}graph lint for schemas with Unicode- @ goto-bus-stop, #1750Previously, Rover would incorrectly highlight GraphQL syntax in a schema that contained Unicode characters due to the byte offsets reported by Apollo GraphOS. Now, Rover correctly maps byte offsets to character widths and highlights the correct portion of the GraphQL syntax.
🛠 Maintenance
This release was automatically created by CircleCI.
If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.
Binaries built for MacOS are signed, notarized, and automatically verified with Gatekeeper.
🚀 Features
Publish persisted queries generated by the Relay compiler - @ EverlastingBugstopper, #1727
The
rover persisted-queries publishcommand now accepts the--manifest-format relayargument which allows publishing persisted queries generated by the Relay compiler to Apollo GraphOS. See the documentation for more information on this feature.Make checks more resilient by retrying failures - @ swcollard, #1740
Rover will now retry requests for the status of a check workflow. If the retries don't succeed after five minutes, the requests fail, and any intermittent errors are logged.
🐛 Fixes
🛠 Maintenance
Don't issue HEAD request to determine latest versions when the exact version is known - @ EverlastingBugstopper, #1743 and #1744
This change should make it easier to integrate Rover with custom binary mirrors as they do not need to be configured to return an
X-Versionheader when responding to installation requests.Move
introspector-gadgetcrate code back into Rover - @ EverlastingBugstopper, #1736📚 Documentation
This release was automatically created by CircleCI.
If you would like to verify that the binary you have downloaded was built from the source code in this repository, you can compute a checksum of the zipped tarball and compare it to the checksums that are included as release artifacts.
Binaries built for MacOS are signed, notarized, and automatically verified with Gatekeeper.
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: