fix(deps): update dependency graphql-upload to v17

[renovate[bot]]

This PR contains the following updates:

Package	Change	Age	Confidence
graphql-upload	^15.0.2 -> ^17.0.0

---

Release Notes

jaydenseric/graphql-upload (graphql-upload)

v17.0.0

Compare Source

Major

• Updated Node.js support to ^18.18.0 || ^20.9.0 || >=22.0.0.

• Updated dev dependencies, some of which require newer Node.js versions than previously supported.

• Use the TypeScript v5.5+ JSDoc tag @import to import types in modules.

• Removed JSDoc tag @typedef that were unintentionally re-exporting types; to migrate import TypeScript types from the correct module:

  - import type { GraphQLUpload } from "graphql-upload/Upload.mjs";
  + import type GraphQLUpload from "graphql-upload/GraphQLUpload.mjs";
  

  - import type { processRequest } from "graphql-upload/Upload.mjs";
  + import type processRequest from "graphql-upload/processRequest.mjs";
  

  - import type { GraphQLUpload } from "graphql-upload/processRequest.mjs";
  + import type GraphQLUpload from "graphql-upload/GraphQLUpload.mjs";
  

• Refactored tests to use the standard AbortController, fetch, File, and FormData APIs available in modern Node.js and removed the dev dependencies node-abort-controller and node-fetch.

• Replaced the test utility function streamToString with the function text from node:stream/consumers that’s available in modern Node.js.

• Use the Node.js test runner API and remove the dev dependency test-director.

Minor

• Support Express v5 by updating the optional peer dependency @types/express to 4.0.29 - 5 and the dev dependency express to v5, via #​389.

Patch

• Tweaked the package description.
• Updated the package.json field repository to conform to new npm requirements.
• Updated the package scripts:
  • Reordered the scripts.
  • Replaced npm run with node --run.
• Updated GitHub Actions CI config:
  • No longer run the workflow on pull request.
  • Enable manual workflow dispatching.
  • Run checks in seperate jobs.
  • Removed custom step names.
  • Replaced npm run with node --run.
  • Updated the tested Node.js versions to v18, v20, v22.
  • Updated actions/checkout to v4.
  • Updated actions/setup-node to v4.
• Migrated to the ESLint v9 CLI and “flat” config.
• Integrated a new dev dependency eslint-plugin-jsdoc and revised types.
• Removed the Node.js CLI option --unhandled-rejections=throw in the package script tests as it’s now the default for all supported Node.js versions.
• Avoid hardcoding a default value in the type FileUploadCreateReadStreamOptions property highWaterMark description and use the function getDefaultHighWaterMark from node:stream in tests.
• Replaced the test helper class Deferred with polyfilled Promise.withResolvers.
• Removed an unnecessary await in tests.
• Omit unused catch bindings in the function processRequest.
• Corrected the JSDoc type FileUploadCreateReadStreamOptions in the module processRequest.mjs.
• Avoid using return in the middleware.
• Added a new dev dependency async-listen to replace the test utility function listen.
• Enabled the TypeScript compiler options noUnusedLocals and noUnusedParameters and used the prefix _ for purposefully unused function parameters in tests.
• Updated the GitHub Markdown syntax for alerts in the readme.
• Tweaked wording in the readme and JSDoc descriptions.

v16.0.2

Compare Source

Patch

• Updated dev dependencies.
• Use the node: URL scheme for Node.js builtin module imports.
• Improved JSDoc in the module GraphQLUpload.mjs.
• Revamped the readme:
  • Removed the badges.
  • More detailed installation instructions.
  • Added information about TypeScript config and optimal JavaScript module design.

v16.0.1

Compare Source

Patch

• Support non latin1 characters in file names by setting the busboy option defParamCharset to utf8, fixing #​328.
• Removed a redundant @ts-ignore comment.

v16.0.0

Compare Source

Major

• Updated the fs-capacitor dependency to v8, fixing #​318.

• The type FileUploadCreateReadStreamOptions from the processRequest.mjs module now uses types from fs-capacitor that are slightly more specific.

• The API is now ESM in .mjs files instead of CJS in .js files, accessible via import but not require. To migrate imports:

  - import GraphQLUpload from "graphql-upload/GraphQLUpload.js";
  + import GraphQLUpload from "graphql-upload/GraphQLUpload.mjs";
  

  - import graphqlUploadExpress from "graphql-upload/graphqlUploadExpress.js";
  + import graphqlUploadExpress from "graphql-upload/graphqlUploadExpress.mjs";
  

  - import graphqlUploadKoa from "graphql-upload/graphqlUploadKoa.js";
  + import graphqlUploadKoa from "graphql-upload/graphqlUploadKoa.mjs";
  

  - import processRequest from "graphql-upload/processRequest.js";
  + import processRequest from "graphql-upload/processRequest.mjs";
  

  - import Upload from "graphql-upload/Upload.js";
  + import Upload from "graphql-upload/Upload.mjs";
  

Patch

• Updated dev dependencies.
• Updated examples in JSDoc comments.
• Updated the changelog entry for v14.0.0 to show how to migrate imports.

---

Configuration

📅 Schedule: Branch creation - "before 7am on Tuesday,before 7am on Wednesday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security[bot]]

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

[socket-security[bot]]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cookie-signature@​1.2.2
	lodash.debounce@​4.0.8
	pluralize@​8.0.0
	cors@​2.8.5
	tree-kill@​1.2.2
	prompts@​2.4.2
	fast-glob@​3.3.3
	decimal.js@​10.6.0
	bytes@​3.1.2
	classnames@​2.5.1
	enquirer@​2.4.1
	async-retry@​1.3.3
	chalk@​4.1.2
	cookie@​1.0.2
	react@​19.2.0
	ws@​8.18.3
	conf@​10.2.0
	prism-react-renderer@​2.4.1
	globby@​11.1.0
	typescript@​5.9.3
	dotenv@​16.6.1
	react-dom@​19.2.0
	graphql@​16.12.0
	prettier@​3.6.2
	playwright@​1.56.1

View full report