Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 4, 2026

This PR contains the following updates:

Package Change Age Confidence
@apollo/server (source) 5.3.05.4.0 age confidence

Release Notes

apollographql/apollo-server (@​apollo/server)

v5.4.0

Compare Source

Minor Changes
  • d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

    The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

    In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
    Any other character set will be rejected with a 415 Unsupported Media Type error.
    Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8.
    Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now.
    In a future major release, we may tighten this restriction further to only allow UTF-8.

    If you were not using startStandaloneServer, you were not affected by this vulnerability.

    Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
    For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Feb 4, 2026
@coveralls
Copy link

coveralls commented Feb 4, 2026

Pull Request Test Coverage Report for Build 0c6063a0-b85e-4528-85f7-c02c968b546c

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 89.829%

Totals Coverage Status
Change from base Build de840762-4bfe-4770-992b-5e40c0894ecb: 0.0%
Covered Lines: 7463
Relevant Lines: 8308

💛 - Coveralls

@renovate renovate bot force-pushed the renovate/apollo-graphql-packages branch from 53968d7 to cd93b8d Compare February 4, 2026 18:09
@renovate renovate bot changed the title fix(deps): update dependency @apollo/server to v5.4.0 chore(deps): update dependency @apollo/server to v5.4.0 Feb 4, 2026
@renovate renovate bot force-pushed the renovate/apollo-graphql-packages branch from cd93b8d to fa9baa8 Compare February 4, 2026 22:40
@renovate renovate bot changed the title chore(deps): update dependency @apollo/server to v5.4.0 fix(deps): update dependency @apollo/server to v5.4.0 Feb 4, 2026
@kamilmysliwiec kamilmysliwiec merged commit 770c7ca into master Feb 5, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants