chore/fix: bump @graphql-tools to 8.x.x to resolve CVE#1069
chore/fix: bump @graphql-tools to 8.x.x to resolve CVE#1069itsmingjie merged 1 commit intomasterfrom
Conversation
|
Upgrade @graphql-tools packages from v6 to v8 to eliminate the vulnerable form-data@4.0.0 dependency. The v8 packages removed form-data entirely while maintaining API compatibility. This fixes CVE-2025-7783 (form-data Math.random boundary vulnerability). - @graphql-tools/url-loader: ^6.8.1 -> ^8.0.0 - @graphql-tools/load: ^6.2.7 -> ^8.0.0 - @graphql-tools/graphql-file-loader: ^6.2.7 -> ^8.0.0 All 606 SDK tests pass. No code changes required.
427a512 to
be5c105
Compare
sjdemartini
left a comment
There was a problem hiding this comment.
sounds good, thanks! Did you try running the CI steps or whatever depends on these packages to confirm it still works with identical output?
|
Did run the SDK regeneration (which is what this should affect) and it produced identical output 👌 |
Upgraded @graphql-tools packages from v6 to v8 to eliminate the vulnerable form-data@4.0.0 dependency. Realistically this probably doesn't have an impact on our usage since it's internal (in build script), but bumping for good measure to get rid of these high severity CVE alerts on the repo.
Verified: build scripts passed, tests passed
The v8 packages removed form-data entirely while maintaining API compatibility. No API shape changed so no code change required.