chore: update auto merge on patch or minor

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@apollo/server (source)	^5.3.0 → ^5.5.0			peerDependencies	minor
knip (source)	6.0.4 → 6.0.5			devDependencies	patch
node (source)	24.14.0 → 24.14.1				patch

---

Release Notes

apollographql/apollo-server (@​apollo/server)

v5.5.0

Compare Source

Minor Changes

• #​8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

  Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

  (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

  This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

  If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

  This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

  See advisory GHSA-9q82-xgwf-vj6h for more details.

webpro-nl/knip (knip)

v6.0.5: Release 6.0.5

Compare Source

• Fix up ecosystem pipeline, add sanity (a338b21)
• Fix broken links in Writing a Plugin docs (#​1640) (963f206) - thanks @​skoeva!
• Minor alignment edits to MCP texts.js (714089f)
• Merge JSDoc tags across function overload signatures (resolve #​1639) (6269ec3)
• Housekeep tag matching (b15bc7e)
• Housekeep reference type matching (d9c8731)
• fix(nx): fall back to workspace cwd when run-commands target has no cwd (#​1638) (cf2dc7d) - thanks @​liorp!
• Release knip@​6.0.5 (289bd9a)

nodejs/node (node)

v24.14.1

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7bf624f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR