[Snyk-dev] Fix for 20 vulnerabilities

[gwnlng]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • src/HotChocolate/ApolloFederation/examples/AnnotationBased/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Information Exposure SNYK-JS-APOLLOSERVERCORE-5876618	Yes	No Known Exploit
	761/1000 Why? Mature exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DICER-2311764	Yes	Mature
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-OBJECTPATH-1017036	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-OBJECTPATH-1569453	Yes	Proof of Concept
	590/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-OBJECTPATH-1585658	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SSRI-1246392	Yes	Proof of Concept
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-XSS-1584355	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @apollo/gateway

The new version differs by 250 commits.

• 6dec2f2 Release
• d5fb1f8 Fix fragment expansion nuking @ defer and other minor @ defer updates (AddStitchedSchema function is not working in F# ChilliCream/graphql-platform#2093)
• 94f79ee docs: remove typo in inaccessible (Create and add Types on runtime ChilliCream/graphql-platform#2073)
• 9cf25c4 Merge descriptions for executable directives (Correct way of using string enumerations ChilliCream/graphql-platform#2090)
• 493dda9 chore(deps): update all non-major dependencies (Need away to set value of request.credentials for GraphQL Playground ChilliCream/graphql-platform#2101)
• a593ac8 Fix high memory usage when extracting subgraphs for some fed1 supergraphs (Proposal for dynamic query cache control ChilliCream/graphql-platform#2089)
• 7c06bfd Fix potential rogue expansion of fragments when deoptimizing (How to use the upcoming federation support? ChilliCream/graphql-platform#2098)
• 7f97f13 chore(deps): update dependency @ graphql-codegen/cli to v2.11.7 (Offset (skip-take) Paging. Out of the box support ChilliCream/graphql-platform#2094)
• 2a8ffe7 chore(deps): update all non-major dependencies (Fix stitching serialization invalid json #2024 #1972 on v10 ChilliCream/graphql-platform#2091)
• 3a2bb8e [docs] Add info about manual composition (Mutation Stitching doesn't map paths in the mutation tree. ChilliCream/graphql-platform#2087)
• 2946bdf Adding federation-spec entry for @ composeDirective (Bump gatsby-source-filesystem from 2.3.1 to 2.3.11 in /website ChilliCream/graphql-platform#2065)
• e450f93 Remove some of the adjectives about shared fields (Bump gatsby-transformer-remark from 2.8.7 to 2.8.15 in /website ChilliCream/graphql-platform#2068)
• baa77b5 Add type definitions to schema extensions (Added missing tests for ArgumentNode ChilliCream/graphql-platform#2081)
• b7e788e Fix issue when type is only reachable through a @ provides (Added In-Memory Subscription Support ChilliCream/graphql-platform#2083)
• efadf8e chore(deps): update dependency @ typescript-eslint/eslint-plugin to v5.34.0 (Fix stitching serialization invalid json #2024 #1972 ChilliCream/graphql-platform#2086)
• b5bd1e9 chore(deps): update dependency @ types/async-retry to v1.4.5 (Migrated Version 10 Subscription Features ChilliCream/graphql-platform#2084)
• 09e2b14 gateway: update to version of gateway interface package that explicitly supports AS2 (check if sonar catches this issue ChilliCream/graphql-platform#2079)
• 93e8ffd Ensures key fields needed post-@ require are fetched (Refined Build ChilliCream/graphql-platform#2075)
• 8e33177 chore(deps): update dependency npm to v8.18.0 (Added initial release pipeline ChilliCream/graphql-platform#2078)
• 2ba40d8 chore(deps): update all non-major dependencies (Added nuke for pull-request builds ChilliCream/graphql-platform#2071)
• 8d4b02b chore(deps): update all non-major dependencies (Migrated Execution Engine Integration Tests ChilliCream/graphql-platform#2070)
• 89d5168 chore(deps): update dependency ts-jest to v28.0.8 (Bump gatsby-remark-images from 3.3.2 to 3.3.10 in /website ChilliCream/graphql-platform#2067)
• 3dcedf6 Release (Bump gatsby-plugin-offline from 3.2.1 to 3.2.9 in /website ChilliCream/graphql-platform#2066)
• 3990af4 Don't apply `@ shareable` if it's already `@ shareable` (Bump gatsby-plugin-sharp from 2.6.0 to 2.6.10 in /website ChilliCream/graphql-platform#2043)

See the full diff

Package name: apollo-server

The new version differs by 250 commits.

• f93284e Release
• 02d882c update doc entry
• 4745ebe Rename option from disableValidation to dangerouslyDisableValidation
• 11f5981 Add disableValidation option to apollo-server-core
• ea2e2c3 Release
• 1dd45b8 get CI passing
• d38b43b Merge pull request from GHSA-j5g3-5c8r-7qfx
• 590ca13 Update v3 docs with new EOL
• 71b2c8a Apollo Server 3 docs typo: ctx.connectionParams not just connectionParams (Added a generic version of the ID descriptor method ChilliCream/graphql-platform#7503)
• fac578a Release
• 19f5167 Update changelog
• 8554050 Update protobuf (version-3) (Updated development dependencies ChilliCream/graphql-platform#7412)
• 5352a9f Docs: fix previous-versions link
• ef4f430 Add AS3 deprecation notices (Reworked the handling of async results within the resolver task ChilliCream/graphql-platform#7152)
• 6247d96 Release
• e366a58 Make newly-added GraphQLRequestContext.requestIsBatched field optional (Reduced Generated Type Extension Code ChilliCream/graphql-platform#7119)
• b5a8de6 update package-lock
• eac82dc Revert "update package-lock"
• 160be7e update package-lock
• 538151b Release
• 3e840fa update package-lock
• 69be2f7 Merge pull request from GHSA-8r69-3cvp-wxc3
• 40fcd3d Backport Fix ASP0019 warning ChilliCream/graphql-platform#7107 (docs: document new usage reporting option)
• f519e1d Release

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Arbitrary File Overwrite