Skip to content

Commit

Permalink
Version Packages (#7712)
Browse files Browse the repository at this point in the history
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @apollo/server-integration-testsuite@4.9.3

### Patch Changes

- Updated dependencies
\[[`a1c725eaf`](a1c725e)]:
    -   @apollo/server@4.9.3

## @apollo/server@4.9.3

### Patch Changes

-
[`a1c725eaf`](a1c725e)
Thanks [@trevor-scheer](https://github.com/trevor-scheer)! - Ensure API
keys are valid header values on startup

Apollo Server previously performed no sanitization or validation of API
keys on startup. In the case that an API key was provided which
contained characters that are invalid as header values, Apollo Server
could inadvertently log the API key in cleartext.

    This only affected users who:

- Provide an API key with characters that are invalid as header values
    -   Use either schema or usage reporting
- Use the default fetcher provided by Apollo Server or configure their
own `node-fetch` fetcher

Apollo Server now trims whitespace from API keys and validates that they
are valid header values. If an invalid API key is provided, Apollo
Server will throw an error on startup.

    For more details, see the security advisory:

<GHSA-j5g3-5c8r-7qfx>

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
  • Loading branch information
github-actions[bot] and github-actions[bot] committed Aug 30, 2023
1 parent b0693aa commit a9d288a
Show file tree
Hide file tree
Showing 6 changed files with 33 additions and 24 deletions.
17 changes: 0 additions & 17 deletions .changeset/proud-buckets-kneel.md

This file was deleted.

8 changes: 4 additions & 4 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 7 additions & 0 deletions packages/integration-testsuite/CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,12 @@
# @apollo/server-integration-testsuite

## 4.9.3

### Patch Changes

- Updated dependencies [[`a1c725eaf`](https://github.com/apollographql/apollo-server/commit/a1c725eaf53c901e32a15057211bcb3eb6a6109b)]:
- @apollo/server@4.9.3

## 4.9.2

### Patch Changes
Expand Down
4 changes: 2 additions & 2 deletions packages/integration-testsuite/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@apollo/server-integration-testsuite",
"version": "4.9.2",
"version": "4.9.3",
"description": "Test suite for Apollo Server integrations",
"main": "dist/index.js",
"types": "dist/index.d.ts",
Expand Down Expand Up @@ -28,7 +28,7 @@
"dependencies": {
"@apollo/cache-control-types": "^1.0.3",
"@apollo/client": "^3.6.9",
"@apollo/server": "4.9.2",
"@apollo/server": "4.9.3",
"@apollo/utils.keyvaluecache": "^2.1.0",
"@apollo/utils.createhash": "^2.0.0",
"@apollo/usage-reporting-protobuf": "^4.1.1",
Expand Down
19 changes: 19 additions & 0 deletions packages/server/CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,24 @@
# @apollo/server

## 4.9.3

### Patch Changes

- [`a1c725eaf`](https://github.com/apollographql/apollo-server/commit/a1c725eaf53c901e32a15057211bcb3eb6a6109b) Thanks [@trevor-scheer](https://github.com/trevor-scheer)! - Ensure API keys are valid header values on startup

Apollo Server previously performed no sanitization or validation of API keys on startup. In the case that an API key was provided which contained characters that are invalid as header values, Apollo Server could inadvertently log the API key in cleartext.

This only affected users who:

- Provide an API key with characters that are invalid as header values
- Use either schema or usage reporting
- Use the default fetcher provided by Apollo Server or configure their own `node-fetch` fetcher

Apollo Server now trims whitespace from API keys and validates that they are valid header values. If an invalid API key is provided, Apollo Server will throw an error on startup.

For more details, see the security advisory:
https://github.com/apollographql/apollo-server/security/advisories/GHSA-j5g3-5c8r-7qfx

## 4.9.2

### Patch Changes
Expand Down
2 changes: 1 addition & 1 deletion packages/server/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@apollo/server",
"version": "4.9.2",
"version": "4.9.3",
"description": "Core engine for Apollo GraphQL server",
"type": "module",
"main": "dist/cjs/index.js",
Expand Down

0 comments on commit a9d288a

Please sign in to comment.