Repository navigation
Bump @graphql-tools/utils to v12.0.3 and @graphql-codegen/* to latest - #500
Merged
Merged
Conversation
The preset's direct dependencies no longer pull in versions affected by GHSA-7mx3-vvmw-hjmv (prototype pollution in mergeDeep, @graphql-tools/utils <=12.0.0). Transitive copies via @graphql-codegen/* and graphql-config clear once those packages release with the fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…/utils v12 Clears GHSA-7mx3-vvmw-hjmv from the published packages' dependency trees now that @graphql-codegen/* and graphql-config have released with @graphql-tools/utils ^12.0.3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: 08edee6 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
1 task
…watcher builds @graphql-codegen/* and graphql-config versions with the GHSA-7mx3-vvmw-hjmv fix were published within pnpm's minimumReleaseAge window, so CI rejects the lockfile. Exclude them until they age out. @graphql-codegen/cli 7.4.5 adds @parcel/watcher, whose build script pnpm 11 requires an explicit decision on. Deny it: the package uses its prebuilt platform binaries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…elpers v7.4.2 plugin-helpers 7.4.2 types ComplexPluginOutput prepend/append as (string | null)[]. Array.prototype.join already renders null as an empty string, so the generated output is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eddeee888
commented
Oct 7, 2026
Comment on lines
+10
to
+19
| minimumReleaseAgeExclude: | ||
| - '@graphql-codegen/cli' | ||
| - '@graphql-codegen/client-preset' | ||
| - '@graphql-codegen/core' | ||
| - '@graphql-codegen/gql-tag-operations' | ||
| - '@graphql-codegen/plugin-helpers' | ||
| - '@graphql-codegen/schema-ast' | ||
| - '@graphql-codegen/typescript-resolvers' | ||
| - '@graphql-codegen/visitor-plugin-common' | ||
| - graphql-config |
Owner
Author
There was a problem hiding this comment.
Note: these are listed by package name rather than name@version, to match the most recent exclusion in #490. They're the 9 entries CI rejected for being under a day old.
Skill: cops:pr-note
Generated by Claude Code
| "devDependencies": { | ||
| "@eddeee888/gcg-operation-location-migration": "workspace:*", | ||
| "@graphql-codegen/typescript-operations": "6.1.5", | ||
| "@graphql-codegen/typescript-operations": "6.1.10", |
Owner
Author
There was a problem hiding this comment.
Note: bumped so the e2e project generates with the same plugin-helpers / visitor-plugin-common release line the published packages now require (6.1.10 needs ^7.4.1 / ^7.2.8), so e2e tests what ships.
Skill: cops:pr-note
Generated by Claude Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes GHSA-7mx3-vvmw-hjmv from the published packages' dependency trees. The advisory is a prototype pollution bug in
mergeDeepand affects@graphql-tools/utils<=12.0.0. Previously every version of@graphql-tools/utilsthe server preset allowed (^11.2.2) was affected.@graphql-codegen/*andgraphql-confighave now released with@graphql-tools/utils^12.0.3.Changes
@eddeee888/gcg-typescript-resolver-files(minor):@graphql-tools/utils^12.0.3,@graphql-tools/merge^9.2.6@graphql-codegen/add^7.1.1,plugin-helpers^7.4.2,schema-ast^6.1.1,typescript^6.1.1,typescript-resolvers^6.1.1@eddeee888/gcg-server-config(patch):@graphql-codegen/typescript^6.1.1,typescript-resolvers^6.1.1@eddeee888/gcg-operation-location-migration(patch):@graphql-codegen/add^7.1.1,plugin-helpers^7.4.2@graphql-codegen/cli7.4.5 andnear-operation-file-preset5.2.2.operation-location-migration-e2e:typescript-operations6.1.10.pnpm-workspace.yaml:minimumReleaseAgeExcludefor the 9@graphql-codegen/*/graphql-configreleases published within pnpm's release-age window. This is temporary, as in [server-preset] Update to latest codegen packages, apply contentComparison #490; a follow-up removes it once they age out, as Remove minimumReleaseAgeExclude for graphql-codegen packages #493 did.'@parcel/watcher': falseunderallowBuilds. It is new via@graphql-codegen/cli7.4.5, and pnpm 11 requires an explicit decision. This is the first deny entry and it is deliberate: the package loads from its prebuilt platform binaries without running the build script.Notes
@graphql-tools/utilsv12 depends on@whatwg-node/promise-helpersv2, which requires Node >=22.15.0. That's why the resolver-files changeset isminor.@graphql-tools/utils11.2.2 remains only through root dev-only tools.near-operation-file-preset5.2.2 (its latest release) still depends on^11, and thetypescript-react-apolloalpha pullsplugin-helpers/visitor-plugin-common6.3.0.@graphql-codegen/*/@graphql-tools/*/graphql-configentries. That also moved some unrelated transitive packages, such as@jest/*,@babel/runtime,@parcel/watcherandws, so the lockfile diff is larger than usual.Testing
CI=true pnpm install --frozen-lockfilepasses on a cleannode_modules.pnpm nx lint|test|buildpass fortypescript-resolver-files,server-configandoperation-location-migration.pnpm nx e2e typescript-resolver-files-e2eandoperation-location-migration-e2epass with no change to generated output.🤖 Generated with Claude Code