refactor: Security upgrade @apollo/server from 4.12.1 to 5.0.0 #9830
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-FORMDATA-10841150
|
I will reformat the title to use the proper commit message syntax. |
parse-github-assistant
bot
changed the title
|
🚀 Thanks for opening this pull request! |
📝 WalkthroughWalkthroughThe version of the "@apollo/server" dependency in the package.json file was updated from "4.12.1" to "5.0.0". No other dependencies or parts of the file were changed. Changes
Estimated code review effort1 (~2 minutes) Possibly related PRs
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
🎉 Snyk checks have passed. No issues have been found so far.✅ security/snyk check is complete. No issues have been found. (View Details) |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
package.json (1)
23-23: Consider loosening the pin to receive patch releasesLocking to exactly
5.0.0prevents automatic adoption of security/bug-fix patch versions (5.0.x). Using a caret (^5.0.0) or at least5.0.1(latest) is safer unless strict reproducibility is required.- "@apollo/server": "5.0.0", + "@apollo/server": "^5.0.0",
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
package.json(1 hunks)
| "dependencies": { | ||
| "@apollo/server": "4.12.1", | ||
| "@apollo/server": "5.0.0", | ||
| "@babel/eslint-parser": "7.27.1", |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Double-check compatibility & breaking changes introduced in @apollo/server 5.x
Upgrading from 4.x → 5.x is a major bump that removes or renames several APIs (e.g. expressMiddleware, ApolloServerPluginDrainHttpServer, built-in file-upload handling) and drops support for subscriptions-transport-ws. Given Parse Server’s existing GraphQL stack (graphql-upload, subscriptions-transport-ws, etc.), this may introduce runtime failures.
Run the quick scan below to locate potential 4.x-specific usages that now need migration:
If matches are found, refer to Apollo Server 5 migration docs and update the affected code before merging.
🏁 Script executed:
#!/bin/bash
# Search for deprecated/renamed 4.x APIs that were removed in 5.x
rg -n --glob '!node_modules' $'expressMiddleware|ApolloServerPluginDrainHttpServer|ApolloServerPluginLandingPage*|addPlugin' -A2Length of output: 605
🏁 Script executed:
#!/bin/bash
# Inspect ApolloServer instantiation to see if `start()` is called
rg -n "new ApolloServer" -A5 src/GraphQL/ParseGraphQLServer.js
# Check for any calls to `start()` on the ApolloServer instance
rg -n "start(" -A5 src/GraphQL/ParseGraphQLServer.js
# Look for usages of the deprecated `subscriptions-transport-ws` package
rg -n --glob '!node_modules' "subscriptions-transport-ws" -A2Length of output: 3632
Update GraphQL Server for Apollo Server 5.x Compatibility
Upgrading from @apollo/server 4.x → 5.x is a major bump that:
- Renames/removes
expressMiddleware(now requires callingawait server.start()and usingserver.getMiddleware()). - Drops built-in file‐upload handling and
subscriptions-transport-wssupport.
Before merging, update or replace these usages:
• src/GraphQL/ParseGraphQLServer.js
– Line 4: import { expressMiddleware } from '@apollo/server/express4';
– Lines 112–114: calls to expressMiddleware(apollo, { … })
• Change to the new pattern:
js await apollo.start(); const graphqlHandler = apollo.getMiddleware({ context }); app.use('/graphql', graphqlHandler);
• Subscription setup in src/GraphQL/ParseGraphQLServer.js
– Lines 8–9: importing/using SubscriptionServer from subscriptions-transport-ws
• Migrate to graphql-ws (see Apollo docs: https://www.apollographql.com/docs/apollo-server/data/subscriptions/#switching-from-subscriptions-transport-ws).
• Tests in spec/ParseGraphQLServer.spec.js
– Lines 13–15: SubscriptionClient from subscriptions-transport-ws
• Update to use an in-memory or graphql-ws test client and async/await patterns.
Refer to Apollo Server 5 migration guide for full list of breaking changes and examples:
https://www.apollographql.com/docs/apollo-server/migration/#apollo-server-5x-migration-guide
🤖 Prompt for AI Agents
In package.json around lines 22 to 24, the dependency upgrade to @apollo/server
5.0.0 requires code changes for compatibility. Update
src/GraphQL/ParseGraphQLServer.js by removing the import of expressMiddleware
from '@apollo/server/express4' and replace calls to expressMiddleware with the
new pattern: call await apollo.start(), then get the middleware via
apollo.getMiddleware({ context }), and use app.use('/graphql', graphqlHandler).
Also, replace the subscription setup that uses subscriptions-transport-ws with
graphql-ws as per Apollo Server 5 migration guide. Similarly, update tests in
spec/ParseGraphQLServer.spec.js to replace SubscriptionClient from
subscriptions-transport-ws with a graphql-ws based test client using
async/await. Follow the Apollo Server 5 migration guide for detailed steps.
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonpackage-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-FORMDATA-10841150
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.
Summary by CodeRabbit