chore: update module github.com/vektah/gqlparser/v2 to v2.5.14 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/vektah/gqlparser/v2	v2.5.11 → v2.5.14

---

gqlparser denial of service vulnerability via the parserDirectives function

CVE-2023-49559 / GHSA-2hmf-46v7-v6fx

More information

Details

An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-49559
• https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1
• https://github.com/99designs/gqlgen/issues/3118
• https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977
• https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316
• https://github.com/advisories/GHSA-2hmf-46v7-v6fx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vektah/gqlparser (github.com/vektah/gqlparser/v2)

v2.5.14

Compare Source

What's Changed

• Add ParseQueryWithLimit by @​StevenACoffman in #​304

Full Changelog: vektah/gqlparser@v2.5.13...v2.5.14

v2.5.13

Compare Source

What's Changed

• Bump the actions-deps group in /validator/imported with 6 updates by @​dependabot in #​298
• Bump prettier from 3.2.5 to 3.3.0 in /validator/imported in the actions-deps group by @​dependabot in #​299
• Bump the actions-deps group in /validator/imported with 7 updates by @​dependabot in #​301
• Bump braces from 3.0.2 to 3.0.3 in /validator/imported by @​dependabot in #​302
• Token limit fix CVE-2023-49559 by @​uvzz in #​291

New Contributors

• @​uvzz made their first contribution in #​291

Full Changelog: vektah/gqlparser@v2.5.12...v2.5.13

v2.5.12

Compare Source

What's Changed

• Disallow empty parens (#​292). by @​yuchenshi in #​293
• WithBuiltin FormatterOption added by @​atzedus in #​294
• Redo github actions by @​StevenACoffman in #​295
• Bump github.com/stretchr/testify from 1.4.0 to 1.9.0 in the actions-deps group by @​dependabot in #​296
• Bump the actions-deps group in /validator/imported with 8 updates by @​dependabot in #​297

New Contributors

• @​yuchenshi made their first contribution in #​293

Full Changelog: vektah/gqlparser@v2.5.11...v2.5.12

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: server/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/stretchr/testify	v1.8.4 -> v1.9.0

[netlify]

✅ Deploy Preview for reearth-classic canceled.

Name	Link
🔨 Latest commit	ad87aab
🔍 Latest deploy log	https://app.netlify.com/projects/reearth-classic/deploys/682d7ab0375cdb000813d71f

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Explain this complex logic.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai explain this code block.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and explain its main purpose.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Join our Discord community for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 23.79%. Comparing base (703e022) to head (7ebb9ff).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #62      +/-   ##
==========================================
- Coverage   23.80%   23.79%   -0.01%     
==========================================
  Files        1587     1587              
  Lines      170092   170127      +35     
  Branches     2801     2801              
==========================================
  Hits        40486    40486              
- Misses     128439   128474      +35     
  Partials     1167     1167              

Flag	Coverage Δ
server	32.03% <ø> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[renovate]

ℹ️ Artifact update notice

File name: server/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/stretchr/testify	v1.8.4 -> v1.9.0