chore: update dependency graphql to v16.8.1 [security] - abandoned by renovate[bot] · Pull Request #66 · reearth/reearth-classic

renovate · 2025-05-21T07:04:00Z

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Change	Age	Confidence
graphql	`16.6.0` -> `16.8.1`

GitHub Vulnerability Alerts

CVE-2023-26144

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.

Note: It was not proven that this vulnerability can crash the process.

Release Notes

graphql/graphql-js (graphql)

`v16.8.1`

Compare Source

v16.8.1 (2023-09-19)

Bug Fix 🐞

#3967 OverlappingFieldsCanBeMergedRule: Fix performance degradation (@AaronMoat)

Committers: 1

Aaron Moat(@AaronMoat)

`v16.8.0`

Compare Source

v16.8.0 (2023-08-14)

New Feature 🚀

#3950 Support fourfold nested lists (@gschulze)

Committers: 1

Gunnar Schulze(@gschulze)

`v16.7.1`

Compare Source

v16.7.1 (2023-06-22)

📢 Big shout out to @phryneas, who managed to reproduce this issue and come up with this fix.

Bug Fix 🐞

#3923 instanceOf: workaround bundler issue with process.env (@IvanGoncharov)

Committers: 1

Ivan Goncharov(@IvanGoncharov)

`v16.7.0`

Compare Source

v16.7.0 (2023-06-21)

New Feature 🚀

#3887 check "globalThis.process" before accessing it (@kettanaito)

Bug Fix 🐞

#3707 Fix crash in node when mixing sync/async resolvers (backport of #3706) (@chrskrchr)
#3838 Fix/invalid error propagation custom scalars (backport for 16.x.x) (@stenreijers)

Committers: 3

Artem Zakharchenko(@kettanaito)
Chris Karcher(@chrskrchr)
Sten Reijers(@stenreijers)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2025-05-21T07:04:07Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Join our Discord community for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

netlify · 2025-05-21T07:04:10Z

✅ Deploy Preview for reearth-classic ready!

Name	Link
🔨 Latest commit	`deb8b04`
🔍 Latest deploy log	https://app.netlify.com/projects/reearth-classic/deploys/682d7ae3e3970f0008e919f0
😎 Deploy Preview	https://deploy-preview-66--reearth-classic.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2025-05-21T07:08:33Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 22.67%. Comparing base (9eea81c) to head (deb8b04).
Report is 10 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main      #66       +/-   ##
===========================================
- Coverage   32.40%   22.67%    -9.74%     
===========================================
  Files         389     1582     +1193     
  Lines       36236   168936   +132700     
  Branches        0     2846     +2846     
===========================================
+ Hits        11742    38302    +26560     
- Misses      23340   129480   +106140     
  Partials     1154     1154

Flag	Coverage Δ
web	`20.01% <ø> (?)`
web-beta	`20.01% <ø> (?)`
web-classic	`20.01% <ø> (?)`
web-utils	`20.01% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

see 1193 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The CI was using cached dependencies with old @types/react versions. Adding v2 suffix to cache key forces fresh dependency installation.

Cast uploadLink to ApolloLink to resolve type incompatibility between @types/apollo-upload-client's bundled @apollo/client types and the main @apollo/client package.

Add @cesium/engine and @zip.js/zip.js to inline deps in vitest config to fix module resolution errors during test runs in CI environment.

renovate · 2025-09-12T02:43:49Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: web/yarn.lock

warning @aws-amplify/ui-react > @aws-amplify/ui > style-dictionary > glob@7.2.3: Glob versions prior to v9 are no longer supported
warning @aws-amplify/ui-react > @aws-amplify/ui > style-dictionary > glob > inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
warning @types/escape-string-regexp@2.0.1: This is a stub types definition. escape-string-regexp provides its own type definitions, so you do not need this installed.
warning aws-amplify > @aws-amplify/pubsub > uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
warning aws-amplify > @aws-amplify/analytics > uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
warning aws-amplify > @aws-amplify/notifications > uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
warning aws-amplify > @aws-amplify/predictions > uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
warning aws-amplify > @aws-amplify/datastore > uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
warning aws-amplify > @aws-amplify/pubsub > url > querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
warning aws-amplify > @aws-amplify/api > @aws-amplify/api-graphql > uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
warning aws-amplify > @aws-amplify/analytics > @aws-sdk/client-firehose > @aws-sdk/middleware-retry > uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
warning aws-amplify > @aws-amplify/predictions > @aws-sdk/client-translate > uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
warning aws-amplify > @aws-amplify/predictions > @aws-sdk/client-comprehend > uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
warning parse-domain > node-fetch > fetch-blob > node-domexception@1.0.0: Use your platform's native DOMException instead
warning react-beautiful-dnd@13.1.1: react-beautiful-dnd is now deprecated. Context and options: https://github.com/atlassian/react-beautiful-dnd/issues/2672
warning @graphql-codegen/cli > @graphql-tools/prisma-loader > @types/json-stable-stringify@1.2.0: This is a stub types definition. json-stable-stringify provides its own type definitions, so you do not need this installed.
warning @graphql-codegen/typescript-react-apollo > @graphql-codegen/visitor-plugin-common > @graphql-tools/relay-operation-optimizer > @ardatan/relay-compiler > glob@7.2.3: Glob versions prior to v9 are no longer supported
warning @graphql-codegen/typescript-react-apollo > @graphql-codegen/visitor-plugin-common > @graphql-tools/relay-operation-optimizer > @ardatan/relay-compiler > babel-preset-fbjs > @babel/plugin-proposal-object-rest-spread@7.20.7: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.
warning @graphql-codegen/typescript-react-apollo > @graphql-codegen/visitor-plugin-common > @graphql-tools/relay-operation-optimizer > @ardatan/relay-compiler > babel-preset-fbjs > @babel/plugin-proposal-class-properties@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
warning @playwright/test@1.39.0: Please update to the latest version of Playwright to test up-to-date browsers.
warning @storybook/addon-essentials > @storybook/addon-docs > @jest/transform > babel-plugin-istanbul > test-exclude > glob@7.2.3: Glob versions prior to v9 are no longer supported
warning @storybook/addon-styling@1.3.7: This package has been split into @storybook/addon-styling-webpack and @storybook/addon-themes. More info: https://github.com/storybookjs/addon-styling
warning @storybook/react-vite > @joshwooding/vite-plugin-react-docgen-typescript > glob@7.2.3: Glob versions prior to v9 are no longer supported
warning @storybook/react-vite > @joshwooding/vite-plugin-react-docgen-typescript > glob-promise > @types/glob > @types/minimatch@6.0.0: This is a stub types definition. minimatch provides its own type definitions, so you do not need this installed.
warning @types/gapi.client.sheets@4.0.20201031: use @types/gapi.client.sheets-v4 instead; see https://github.com/Maxim-Mazurok/google-api-typings-generator/issues/652 for details
warning @types/react-ga@2.3.0: This is a stub types definition for react-ga (https://github.com/react-ga/react-ga). react-ga provides its own type definitions, so you don't need @types/react-ga installed!
warning del-cli > del > rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
warning del-cli > del > rimraf > glob@7.2.3: Glob versions prior to v9 are no longer supported
warning eslint@8.40.0: This version is no longer supported. Please see https://eslint.org/version-support for other options.
warning eslint > @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead
warning eslint > file-entry-cache > flat-cache > rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
warning eslint > @humanwhocodes/config-array > @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
warning i18next-parser > broccoli-plugin > rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
warning i18next-parser > broccoli-plugin > quick-temp > rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
warning i18next-parser > broccoli-plugin > quick-temp > rimraf > glob@7.2.3: Glob versions prior to v9 are no longer supported
warning jsdom > abab@2.0.6: Use your platform's native atob() and btoa() methods instead
warning jsdom > data-urls > abab@2.0.6: Use your platform's native atob() and btoa() methods instead
warning jsdom > domexception@4.0.0: Use your platform's native DOMException instead
warning read-env > @types/camelcase@5.2.0: This is a stub types definition. camelcase provides its own type definitions, so you do not need this installed.
warning storybook > @storybook/cli > jscodeshift > @babel/plugin-proposal-class-properties@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
warning storybook > @storybook/cli > tempy > del > rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
warning storybook > @storybook/cli > puppeteer-core > rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
warning storybook > @storybook/cli > jscodeshift > temp > rimraf@2.6.3: Rimraf versions prior to v4 are no longer supported
warning storybook > @storybook/cli > jscodeshift > temp > rimraf > glob@7.2.3: Glob versions prior to v9 are no longer supported
warning storybook > @storybook/cli > jscodeshift > @babel/plugin-proposal-nullish-coalescing-operator@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-nullish-coalescing-operator instead.
warning storybook > @storybook/cli > jscodeshift > @babel/plugin-proposal-optional-chaining@7.21.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-chaining instead.
warning typescript-styled-plugin@0.18.3: Deprecated in favor of https://github.com/styled-components/typescript-styled-plugin
warning typescript-styled-plugin > vscode-emmet-helper@2.6.4: This package has been renamed to @vscode/emmet-helper, please update to the new name
warning vite-plugin-cesium > rollup-plugin-external-globals > magic-string > sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead
warning autolinker@4.1.5: The engine "pnpm" appears to be invalid.
warning @zip.js/zip.js@2.8.2: The engine "deno" appears to be invalid.
warning @zip.js/zip.js@2.8.2: The engine "bun" appears to be invalid.
error cheerio@1.1.2: The engine "node" is incompatible with this module. Expected version ">=20.18.1". Got "20.11.0"
error Found incompatible module.

renovate · 2025-09-22T04:21:28Z

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

airslice · 2025-09-22T06:06:21Z

Handled on this: #98

renovate Bot requested a review from airslice as a code owner May 21, 2025 07:04

renovate Bot added the security label May 21, 2025

renovate Bot requested a review from mkumbobeaty as a code owner May 21, 2025 07:04

github-actions Bot added the web label May 21, 2025

renovate Bot force-pushed the renovate/npm-graphql-vulnerability branch from deb8b04 to 2ad946e Compare August 11, 2025 04:04

renovate Bot force-pushed the renovate/npm-graphql-vulnerability branch from 2ad946e to 8be9696 Compare September 1, 2025 11:05

pyshx and others added 7 commits September 11, 2025 12:48

chore(web): yarn install

4b4f694

fix(web): update @types/proj4 to version 2.5.5

81ed745

fix(web): update @types/react and @types/react-dom to latest versions

d3cb01a

fix(ci): invalidate yarn cache to fix TypeScript errors

a7a96e6

The CI was using cached dependencies with old @types/react versions. Adding v2 suffix to cache key forces fresh dependency installation.

fix(web): resolve apollo-upload-client type conflict

d298365

Cast uploadLink to ApolloLink to resolve type incompatibility between @types/apollo-upload-client's bundled @apollo/client types and the main @apollo/client package.

fix(web): resolve Cesium/zip.js module resolution issue in tests

4f8a05a

Add @cesium/engine and @zip.js/zip.js to inline deps in vitest config to fix module resolution errors during test runs in CI environment.

chore: update dependency graphql to v16.8.1 [security]

7a8341a

renovate Bot force-pushed the renovate/npm-graphql-vulnerability branch from 8be9696 to 7a8341a Compare September 12, 2025 02:43

pyshx force-pushed the main branch from 4f8a05a to c868761 Compare September 12, 2025 04:11

pyshx requested a review from rot1024 as a code owner September 12, 2025 04:11

renovate Bot changed the title ~~chore: update dependency graphql to v16.8.1 [security]~~ chore: update dependency graphql to v16.8.1 [security] - abandoned Sep 22, 2025

airslice closed this Sep 22, 2025

Navigation Menu

Uh oh!

chore: update dependency graphql to v16.8.1 [security] - abandoned - #66

chore: update dependency graphql to v16.8.1 [security] - abandoned#66
renovate[bot] wants to merge 7 commits into
mainfrom
renovate/npm-graphql-vulnerability

renovate Bot commented May 21, 2025 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 21, 2025

Review skipped

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

Uh oh!

netlify Bot commented May 21, 2025 •

edited

Loading

Uh oh!

codecov Bot commented May 21, 2025

Uh oh!

renovate Bot commented Sep 12, 2025

Uh oh!

renovate Bot commented Sep 22, 2025

Uh oh!

airslice commented Sep 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

renovate Bot commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2023-26144

Release Notes

v16.8.1

v16.8.1 (2023-09-19)

Bug Fix 🐞

Committers: 1

v16.8.0

v16.8.0 (2023-08-14)

New Feature 🚀

Committers: 1

v16.7.1

v16.7.1 (2023-06-22)

Bug Fix 🐞

Committers: 1

v16.7.0

v16.7.0 (2023-06-21)

New Feature 🚀

Bug Fix 🐞

Committers: 3

Configuration

Uh oh!

coderabbitai Bot commented May 21, 2025

Review skipped

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

netlify Bot commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for reearth-classic ready!

Uh oh!

codecov Bot commented May 21, 2025

Codecov Report

Uh oh!

renovate Bot commented Sep 12, 2025

⚠️ Artifact update problem

File name: web/yarn.lock

Uh oh!

renovate Bot commented Sep 22, 2025

Autoclosing Skipped

Uh oh!

airslice commented Sep 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate Bot commented May 21, 2025 •

edited

Loading

`v16.8.1`

`v16.8.0`

`v16.7.1`

`v16.7.0`

CodeRabbit Configuration File (`.coderabbit.yaml`)

netlify Bot commented May 21, 2025 •

edited

Loading