Skip to content

fix: Security upgrade @apollo/server from 4.12.1 to 4.13.0#10082

Merged
mtrezza merged 5 commits intoparse-community:release-8.x.xfrom
rjcodedev:release-8.x.x
Mar 31, 2026
Merged

fix: Security upgrade @apollo/server from 4.12.1 to 4.13.0#10082
mtrezza merged 5 commits intoparse-community:release-8.x.xfrom
rjcodedev:release-8.x.x

Conversation

@rjcodedev
Copy link
Copy Markdown

@rjcodedev rjcodedev commented Feb 28, 2026

Pull Request

Issue

@apollo/server  4.2.0 - 4.12.2
Severity: high
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer` - https://github.com/advisories/GHSA-mp6q-xf9x-fwf7
fix available via `npm audit fix --force`
Will install parse-server@9.2.0, which is a breaking change
node_modules/@apollo/server
  parse-server  2.2.14 - 9.2.0-alpha.2
  Depends on vulnerable versions of @apollo/server
  Depends on vulnerable versions of lodash
  node_modules/parse-server

Closes: 10037

Summary by CodeRabbit

  • Chores
    • Released patch version update (8.6.3 → 8.6.4)
    • Updated server dependency to latest compatible version

Signed-off-by: Prafull <87638003+rjcodedev@users.noreply.github.com>
Signed-off-by: Prafull <87638003+rjcodedev@users.noreply.github.com>
@parse-github-assistant
Copy link
Copy Markdown

🚀 Thanks for opening this pull request!

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Feb 28, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 08f08026-f152-455c-b6b0-b105ed896862

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@parseplatformorg
Copy link
Copy Markdown
Contributor

parseplatformorg commented Feb 28, 2026

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

coderabbitai[bot]
coderabbitai bot previously approved these changes Feb 28, 2026
Signed-off-by: Prafull <87638003+rjcodedev@users.noreply.github.com>
Signed-off-by: Prafull <87638003+rjcodedev@users.noreply.github.com>
@rjcodedev
Copy link
Copy Markdown
Author

Hey @mtrezza ,

Please check now.

@codecov
Copy link
Copy Markdown

codecov bot commented Feb 28, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.44%. Comparing base (053109b) to head (1766966).
⚠️ Report is 3 commits behind head on release-8.x.x.

Additional details and impacted files
@@              Coverage Diff               @@
##           release-8.x.x   #10082   +/-   ##
==============================================
  Coverage          92.44%   92.44%           
==============================================
  Files                192      192           
  Lines              16120    16120           
  Branches             226      226           
==============================================
  Hits               14902    14902           
  Misses              1196     1196           
  Partials              22       22           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mtrezza mtrezza merged commit 18a1560 into parse-community:release-8.x.x Mar 31, 2026
25 of 28 checks passed
parseplatformorg pushed a commit that referenced this pull request Mar 31, 2026
## [8.6.72](8.6.71...8.6.72) (2026-03-31)

### Bug Fixes

* Security upgrade @apollo/server from 4.12.1 to 4.13.0 ([#10082](#10082)) ([18a1560](18a1560))
@parseplatformorg
Copy link
Copy Markdown
Contributor

🎉 This change has been released in version 8.6.72

@parseplatformorg parseplatformorg added the state:released-8.x.x Released as LTS version label Mar 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

state:released-8.x.x Released as LTS version

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants