From a1901369b95277ecfcd06ca1a10b153d46bc4c08 Mon Sep 17 00:00:00 2001 From: celiac_microsoft Date: Thu, 18 Jun 2026 10:11:16 +0200 Subject: [PATCH 1/7] update of ws depndency --- website/yarn.lock | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/website/yarn.lock b/website/yarn.lock index 26bcf333a..ec8a05e26 100644 --- a/website/yarn.lock +++ b/website/yarn.lock @@ -9084,9 +9084,9 @@ shebang-regex@^3.0.0: integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A== shell-quote@^1.8.3: - version "1.8.4" - resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.4.tgz#2edd9a4dcefc96649e2e2cb12f637b1f1d92a190" - integrity sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ== + version "1.8.3" + resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.3.tgz#55e40ef33cf5c689902353a3d8cd1a6725f08b4b" + integrity sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw== side-channel-list@^1.0.0: version "1.0.0" @@ -10056,14 +10056,14 @@ write-file-atomic@^3.0.3: typedarray-to-buffer "^3.1.5" ws@^7.3.1: - version "7.5.10" - resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.10.tgz#58b5c20dc281633f6c19113f39b349bd8bd558d9" - integrity sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ== + version "7.5.11" + resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.11.tgz#9460daf1812bb81a423c5b9eac746941a86310fa" + integrity sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA== ws@^8.18.0: - version "8.19.0" - resolved "https://registry.yarnpkg.com/ws/-/ws-8.19.0.tgz#ddc2bdfa5b9ad860204f5a72a4863a8895fd8c8b" - integrity sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg== + version "8.21.0" + resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.0.tgz#012e413fc07429945121b0c153158c4343086951" + integrity sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g== wsl-utils@^0.1.0: version "0.1.0" From c31239c31b8348048a25bdc4a74f527dfeb18244 Mon Sep 17 00:00:00 2001 From: celiac_microsoft Date: Thu, 18 Jun 2026 10:51:34 +0200 Subject: [PATCH 2/7] getting the version of sell-quote from master --- website/yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/website/yarn.lock b/website/yarn.lock index ec8a05e26..f8c3f23c6 100644 --- a/website/yarn.lock +++ b/website/yarn.lock @@ -9084,9 +9084,9 @@ shebang-regex@^3.0.0: integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A== shell-quote@^1.8.3: - version "1.8.3" - resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.3.tgz#55e40ef33cf5c689902353a3d8cd1a6725f08b4b" - integrity sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw== + version "1.8.4" + resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.4.tgz#2edd9a4dcefc96649e2e2cb12f637b1f1d92a190" + integrity sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ== side-channel-list@^1.0.0: version "1.0.0" From 823990b0af7290fe948d8de467f19582929fbb12 Mon Sep 17 00:00:00 2001 From: celiac_microsoft Date: Tue, 30 Jun 2026 11:45:26 +0200 Subject: [PATCH 3/7] fix(website): upgrade lodash-es to ^4.18.0 to fix CVE-2021-23337 Add a resolutions override forcing lodash-es to ^4.18.0 so the vulnerable 4.17.23 pinned by chevrotain is replaced, and regenerate yarn.lock. --- website/package.json | 3 ++- website/yarn.lock | 7 +------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/website/package.json b/website/package.json index 334deebb3..caf66c017 100644 --- a/website/package.json +++ b/website/package.json @@ -44,7 +44,8 @@ "trim": "^1.0.1", "katex": "^0.16.22", "svgo": "^3.3.3", - "serialize-javascript": "^7.0.4" + "serialize-javascript": "^7.0.4", + "lodash-es": "^4.18.0" }, "browserslist": { "production": [ diff --git a/website/yarn.lock b/website/yarn.lock index f8c3f23c6..a90862804 100644 --- a/website/yarn.lock +++ b/website/yarn.lock @@ -6424,12 +6424,7 @@ locate-path@^7.1.0: dependencies: p-locate "^6.0.0" -lodash-es@4.17.23: - version "4.17.23" - resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.17.23.tgz#58c4360fd1b5d33afc6c0bbd3d1149349b1138e0" - integrity sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg== - -lodash-es@^4.17.21, lodash-es@^4.17.23: +lodash-es@4.17.23, lodash-es@^4.17.21, lodash-es@^4.17.23, lodash-es@^4.18.0: version "4.18.1" resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.18.1.tgz#b962eeb80d9d983a900bf342961fb7418ca10b1d" integrity sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A== From 4ca91863d7979ae51e090459ed7b324e0dbd1087 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 14 Jul 2026 08:15:11 +0000 Subject: [PATCH 4/7] fix: add --forceExit to compat jest CI command to fix hanging test process --- packages/apollo-forest-run/compat/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/apollo-forest-run/compat/package.json b/packages/apollo-forest-run/compat/package.json index dc84485ac..2ca3a0c54 100644 --- a/packages/apollo-forest-run/compat/package.json +++ b/packages/apollo-forest-run/compat/package.json @@ -42,7 +42,7 @@ "clean": "rimraf -r dist coverage lib temp", "ci:precheck": "node config/precheck.js", "test": "jest --config ./config/jest.config.js", - "test:ci": "jest --config ./config/jest.config.js --ci --maxWorkers=2", + "test:ci": "jest --config ./config/jest.config.js --ci --maxWorkers=2 --forceExit", "test:debug": "node --inspect-brk node_modules/.bin/jest --config ./config/jest.config.js --runInBand --testTimeout 99999", "test:ci_original": "npm run test:coverage && npm run test:memory", "test:watch": "jest --config ./config/jest.config.js --watch", From c73afd7c29579543650952478b05996402d05450 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 14 Jul 2026 09:48:52 +0000 Subject: [PATCH 5/7] fix: use fake timers in flaky batchLink tests to prevent race conditions --- .../compat/package-lock.json | 1 - .../src/link/batch/__tests__/batchLink.ts | 54 +++++++++++-------- 2 files changed, 31 insertions(+), 24 deletions(-) diff --git a/packages/apollo-forest-run/compat/package-lock.json b/packages/apollo-forest-run/compat/package-lock.json index 50b74f1fe..0a58927e3 100644 --- a/packages/apollo-forest-run/compat/package-lock.json +++ b/packages/apollo-forest-run/compat/package-lock.json @@ -30,7 +30,6 @@ "jest": "27.5.1", "jest-fetch-mock": "3.0.3", "jest-junit": "13.2.0", - "picomatch": "^2.3.2", "react-test-renderer": "17.0.2", "ts-jest": "27.1.5", "wait-for-observables": "1.0.3" diff --git a/packages/apollo-forest-run/compat/src/link/batch/__tests__/batchLink.ts b/packages/apollo-forest-run/compat/src/link/batch/__tests__/batchLink.ts index 175c34c91..97d64574d 100644 --- a/packages/apollo-forest-run/compat/src/link/batch/__tests__/batchLink.ts +++ b/packages/apollo-forest-run/compat/src/link/batch/__tests__/batchLink.ts @@ -520,6 +520,7 @@ describe('OperationBatcher', () => { }); itAsync('should correctly batch multiple queries', (resolve, reject) => { + jest.useFakeTimers(); const data = { lastName: 'Ever', firstName: 'Greatest', @@ -556,26 +557,28 @@ describe('OperationBatcher', () => { reject(e); } - setTimeout(() => { - // The batch shouldn't be fired yet, so we can add one more request. - batcher.enqueueRequest({ operation: operation3 }).subscribe({}); - try { - expect(batcher["batchesByKey"].get('')!.size).toBe(3); - } catch (e) { - reject(e); - } - }, 5); + // Advance 5ms — the batch timer (10ms) hasn't fired yet. + jest.advanceTimersByTime(5); - setTimeout( - terminatingCheck(resolve, reject, () => { - // The batch should've been fired by now. - expect(batcher["batchesByKey"].get('')).toBeUndefined(); - }), - 20, - ); + // The batch shouldn't be fired yet, so we can add one more request. + batcher.enqueueRequest({ operation: operation3 }).subscribe({}); + try { + expect(batcher["batchesByKey"].get('')!.size).toBe(3); + } catch (e) { + reject(e); + } + + // Advance 15ms more (20ms total) — the batch timer fires at 10ms. + jest.advanceTimersByTime(15); + + terminatingCheck(resolve, reject, () => { + // The batch should've been fired by now. + expect(batcher["batchesByKey"].get('')).toBeUndefined(); + })(); }); itAsync('should cancel multiple queries in queue when unsubscribing and let pass still subscribed one', (resolve, reject) => { + jest.useFakeTimers(); const data2 = { lastName: 'Hauser', firstName: 'Evans', @@ -618,14 +621,19 @@ describe('OperationBatcher', () => { sub1.unsubscribe(); expect(batcher["batchesByKey"].get('')!.size).toBe(1); - setTimeout(() => { - // The batch shouldn't be fired yet, so we can add one more request. - const sub3 = batcher.enqueueRequest({operation: operation3}).subscribe(() => reject('next should never be called')); - expect(batcher["batchesByKey"].get('')!.size).toBe(2); + // Advance 5ms — the batch timer (10ms) hasn't fired yet. + jest.advanceTimersByTime(5); - sub3.unsubscribe(); - expect(batcher["batchesByKey"].get('')!.size).toBe(1); - }, 5); + // The batch shouldn't be fired yet, so we can add one more request. + const sub3 = batcher.enqueueRequest({operation: operation3}).subscribe(() => reject('next should never be called')); + expect(batcher["batchesByKey"].get('')!.size).toBe(2); + + sub3.unsubscribe(); + expect(batcher["batchesByKey"].get('')!.size).toBe(1); + + // Advance 5ms more (10ms total) — the batch timer fires, delivering the + // result to operation2's subscriber which calls resolve(). + jest.advanceTimersByTime(5); }); itAsync('should reject the promise if there is a network error', (resolve, reject) => { From 0e2f711a8debb77ef9b7d71f4d65fd2fa7f64bf2 Mon Sep 17 00:00:00 2001 From: celiac_microsoft Date: Tue, 14 Jul 2026 12:07:46 +0200 Subject: [PATCH 6/7] Revert changes after 78b277b (revert flaky batchLink fake timers fix) --- .../compat/package-lock.json | 1 + .../src/link/batch/__tests__/batchLink.ts | 54 ++++++++----------- 2 files changed, 24 insertions(+), 31 deletions(-) diff --git a/packages/apollo-forest-run/compat/package-lock.json b/packages/apollo-forest-run/compat/package-lock.json index 0a58927e3..50b74f1fe 100644 --- a/packages/apollo-forest-run/compat/package-lock.json +++ b/packages/apollo-forest-run/compat/package-lock.json @@ -30,6 +30,7 @@ "jest": "27.5.1", "jest-fetch-mock": "3.0.3", "jest-junit": "13.2.0", + "picomatch": "^2.3.2", "react-test-renderer": "17.0.2", "ts-jest": "27.1.5", "wait-for-observables": "1.0.3" diff --git a/packages/apollo-forest-run/compat/src/link/batch/__tests__/batchLink.ts b/packages/apollo-forest-run/compat/src/link/batch/__tests__/batchLink.ts index 97d64574d..175c34c91 100644 --- a/packages/apollo-forest-run/compat/src/link/batch/__tests__/batchLink.ts +++ b/packages/apollo-forest-run/compat/src/link/batch/__tests__/batchLink.ts @@ -520,7 +520,6 @@ describe('OperationBatcher', () => { }); itAsync('should correctly batch multiple queries', (resolve, reject) => { - jest.useFakeTimers(); const data = { lastName: 'Ever', firstName: 'Greatest', @@ -557,28 +556,26 @@ describe('OperationBatcher', () => { reject(e); } - // Advance 5ms — the batch timer (10ms) hasn't fired yet. - jest.advanceTimersByTime(5); - - // The batch shouldn't be fired yet, so we can add one more request. - batcher.enqueueRequest({ operation: operation3 }).subscribe({}); - try { - expect(batcher["batchesByKey"].get('')!.size).toBe(3); - } catch (e) { - reject(e); - } - - // Advance 15ms more (20ms total) — the batch timer fires at 10ms. - jest.advanceTimersByTime(15); + setTimeout(() => { + // The batch shouldn't be fired yet, so we can add one more request. + batcher.enqueueRequest({ operation: operation3 }).subscribe({}); + try { + expect(batcher["batchesByKey"].get('')!.size).toBe(3); + } catch (e) { + reject(e); + } + }, 5); - terminatingCheck(resolve, reject, () => { - // The batch should've been fired by now. - expect(batcher["batchesByKey"].get('')).toBeUndefined(); - })(); + setTimeout( + terminatingCheck(resolve, reject, () => { + // The batch should've been fired by now. + expect(batcher["batchesByKey"].get('')).toBeUndefined(); + }), + 20, + ); }); itAsync('should cancel multiple queries in queue when unsubscribing and let pass still subscribed one', (resolve, reject) => { - jest.useFakeTimers(); const data2 = { lastName: 'Hauser', firstName: 'Evans', @@ -621,19 +618,14 @@ describe('OperationBatcher', () => { sub1.unsubscribe(); expect(batcher["batchesByKey"].get('')!.size).toBe(1); - // Advance 5ms — the batch timer (10ms) hasn't fired yet. - jest.advanceTimersByTime(5); - - // The batch shouldn't be fired yet, so we can add one more request. - const sub3 = batcher.enqueueRequest({operation: operation3}).subscribe(() => reject('next should never be called')); - expect(batcher["batchesByKey"].get('')!.size).toBe(2); - - sub3.unsubscribe(); - expect(batcher["batchesByKey"].get('')!.size).toBe(1); + setTimeout(() => { + // The batch shouldn't be fired yet, so we can add one more request. + const sub3 = batcher.enqueueRequest({operation: operation3}).subscribe(() => reject('next should never be called')); + expect(batcher["batchesByKey"].get('')!.size).toBe(2); - // Advance 5ms more (10ms total) — the batch timer fires, delivering the - // result to operation2's subscriber which calls resolve(). - jest.advanceTimersByTime(5); + sub3.unsubscribe(); + expect(batcher["batchesByKey"].get('')!.size).toBe(1); + }, 5); }); itAsync('should reject the promise if there is a network error', (resolve, reject) => { From 37aa5a0ca6084d3ce3c71c18f1808b295a7d0c68 Mon Sep 17 00:00:00 2001 From: celiac747 Date: Tue, 14 Jul 2026 12:12:26 +0200 Subject: [PATCH 7/7] revert: remove --forceExit from compat jest CI command --- packages/apollo-forest-run/compat/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/apollo-forest-run/compat/package.json b/packages/apollo-forest-run/compat/package.json index 2ca3a0c54..dc84485ac 100644 --- a/packages/apollo-forest-run/compat/package.json +++ b/packages/apollo-forest-run/compat/package.json @@ -42,7 +42,7 @@ "clean": "rimraf -r dist coverage lib temp", "ci:precheck": "node config/precheck.js", "test": "jest --config ./config/jest.config.js", - "test:ci": "jest --config ./config/jest.config.js --ci --maxWorkers=2 --forceExit", + "test:ci": "jest --config ./config/jest.config.js --ci --maxWorkers=2", "test:debug": "node --inspect-brk node_modules/.bin/jest --config ./config/jest.config.js --runInBand --testTimeout 99999", "test:ci_original": "npm run test:coverage && npm run test:memory", "test:watch": "jest --config ./config/jest.config.js --watch",