Update dependency graphql-upload to v16

[renovate[bot]]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
graphql-upload	^13.0.0 -> ^16.0.1

---

Release Notes

jaydenseric/graphql-upload

v16.0.1

Compare Source

Patch

• Support non latin1 characters in file names by setting the busboy option defParamCharset to utf8, fixing #​328.
• Removed a redundant @ts-ignore comment.

v16.0.0

Compare Source

Major

• Updated the fs-capacitor dependency to v8, fixing #​318.

• The type FileUploadCreateReadStreamOptions from the processRequest.mjs module now uses types from fs-capacitor that are slightly more specific.

• The API is now ESM in .mjs files instead of CJS in .js files, accessible via import but not require. To migrate imports:

  - import GraphQLUpload from "graphql-upload/GraphQLUpload.js";
  + import GraphQLUpload from "graphql-upload/GraphQLUpload.mjs";
  

  - import graphqlUploadExpress from "graphql-upload/graphqlUploadExpress.js";
  + import graphqlUploadExpress from "graphql-upload/graphqlUploadExpress.mjs";
  

  - import graphqlUploadKoa from "graphql-upload/graphqlUploadKoa.js";
  + import graphqlUploadKoa from "graphql-upload/graphqlUploadKoa.mjs";
  

  - import processRequest from "graphql-upload/processRequest.js";
  + import processRequest from "graphql-upload/processRequest.mjs";
  

  - import Upload from "graphql-upload/Upload.js";
  + import Upload from "graphql-upload/Upload.mjs";
  

Patch

• Updated dev dependencies.
• Updated examples in JSDoc comments.
• Updated the changelog entry for v14.0.0 to show how to migrate imports.

v15.0.2

Compare Source

Patch

• Updated dev dependencies.
• Corrected the TypeScript type for the Koa context ctx parameter for the Koa middleware created by the function graphqlUploadKoa, from import("koa").Context to import("koa").ParameterizedContext.

v15.0.1

Compare Source

Patch

• Don’t import and link types from the middlware modules graphqlUploadExpress.js and graphqlUploadKoa.js within the module processRequest.js, fixing #​314.

v15.0.0

Compare Source

Major

• Updated the busboy dependency to v1, fixing #​311.
  • This important update addresses the vulnerability CVE-2022-24434 (GHSA-wm7h-9275-46v2).
  • Some error messages have changed.
  • Temporarily until mscdex/busboy#​297 is fixed upstream, for the function processRequest and the middleware graphqlUploadExpress and graphqlUploadKoa the option maxFileSize is actually 1 byte less than the amount specified.

Patch

• Updated the typescript dev dependency.
• In the function processRequest use the on method instead of once to listen for error events on the busboy parser, as in edge cases the same parser could have multiple error events and all must be handled to prevent the Node.js process exiting with an error.
• Simplified error handling within the function processRequest.
• Added a test for the function processRequest with a maliciously malformed multipart request.

v14.0.0

Compare Source

Major

• Updated Node.js support to ^14.17.0 || ^16.0.0 || >= 18.0.0.

• Updated the graphql peer dependency to ^16.3.0.

• Updated the http-errors dependency to v2.

• Public modules are now individually listed in the package files and exports fields.

• Removed the package main index module; deep imports must be used. To migrate imports:

  - import { GraphQLUpload } from "graphql-upload";
  + import GraphQLUpload from "graphql-upload/GraphQLUpload.js";
  

  - import { graphqlUploadExpress } from "graphql-upload";
  + import graphqlUploadExpress from "graphql-upload/graphqlUploadExpress.js";
  

  - import { graphqlUploadKoa } from "graphql-upload";
  + import graphqlUploadKoa from "graphql-upload/graphqlUploadKoa.js";
  

  - import { processRequest } from "graphql-upload";
  + import processRequest from "graphql-upload/processRequest.js";
  

  - import { Upload } from "graphql-upload";
  + import Upload from "graphql-upload/Upload.js";
  

• Shortened public module deep import paths, removing the /public/. To migrate imports:

  - import GraphQLUpload from "graphql-upload/public/GraphQLUpload.js";
  + import GraphQLUpload from "graphql-upload/GraphQLUpload.js";
  

  - import graphqlUploadExpress from "graphql-upload/public/graphqlUploadExpress.js";
  + import graphqlUploadExpress from "graphql-upload/graphqlUploadExpress.js";
  

  - import graphqlUploadKoa from "graphql-upload/public/graphqlUploadKoa.js";
  + import graphqlUploadKoa from "graphql-upload/graphqlUploadKoa.js";
  

  - import processRequest from "graphql-upload/public/processRequest.js";
  + import processRequest from "graphql-upload/processRequest.js";
  

  - import Upload from "graphql-upload/public/Upload.js";
  + import Upload from "graphql-upload/Upload.js";
  

• Implemented TypeScript types via JSDoc comments, closing #​282.

• The GraphQLUpload scalar no longer uses deprecated GraphQLError constructor parameters.

Patch

• Updated dev dependencies.
• Simplified dev dependencies and config for ESLint.
• Check TypeScript types via a new package types script.
• Removed the jsdoc-md dev dependency and the related package scripts, replacing the readme “API” section with a manually written “Exports” section.
• Removed the hard-rejection dev dependency. Instead, tests are run with the Node.js CLI flag --unhandled-rejections=throw to make Node.js v14 behave like newer versions.
• Removed the formdata-node dev dependency. Instead, File and FormData are imported from node-fetch.
• Updated GitHub Actions CI config:
  • Run tests with Node.js v14, v16, v18.
  • Updated actions/checkout to v3.
  • Updated actions/setup-node to v3.
• Reorganized the test file structure.
• Use the .js file extension in require paths.
• Use the Node.js Readable property readableEncoding instead of _readableState.encoding in tests.
• Use substring instead of the deprecated string method substr in tests.
• Fixed a typo in a code comment.
• Updated documentation.
• Added a license.md MIT License file, closing #​86.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate[bot]]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Found file in cache: /tmp/renovate-cache/buildpack/7576b42decc67f70b61585f41c5074bea75c260886346e567578ea0e0dc2d571/node-v16.17.0-linux-x64.tar.xz

[vercel[bot]]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated
gqty	❌ Failed (Inspect)		Aug 24, 2022 at 8:38AM (UTC)

[vicary]

@PabloSzx you may wanna take a look at this

[renovate[bot]]

Renovate Ignore Notification

As this PR has been closed unmerged, Renovate will ignore this upgrade and you will not receive PRs for any future 16.x releases. However, if you upgrade to 16.x manually then Renovate will reenable minor and patch updates automatically.

If this PR was closed by mistake or you changed your mind, you can simply rename this PR and you will soon get a fresh replacement PR opened.