Bump the all-minor-patch group with 5 updates (#1576)

dependabot[bot] · github-actions[bot] · ardatan · web-flow · commit 458db4cb5396 · 2025-10-02T11:09:10.000Z
Signed-off-by: dependabot[bot] &lt;support@github.com&gt;
Co-authored-by: dependabot[bot] &lt;49699333+dependabot[bot]@users.noreply.github.com&gt;
Co-authored-by: github-actions[bot] &lt;github-actions[bot]@users.noreply.github.com&gt;
Co-authored-by: Arda TANRIKULU &lt;ardatanrikulu@gmail.com&gt;
diff --git a/.changeset/@graphql-hive_gateway-runtime-1576-dependencies.md b/.changeset/@graphql-hive_gateway-runtime-1576-dependencies.md
@@ -0,0 +1,7 @@
+---
+'@graphql-hive/gateway-runtime': patch
+---
+
+dependencies updates: 
+
+- Updated dependency [`@types/node@^24.6.1` ↗︎](https://www.npmjs.com/package/@types/node/v/24.6.1) (from `^24.6.0`, in `dependencies`)
diff --git a/.changeset/shy-planes-remain.md b/.changeset/shy-planes-remain.md
@@ -0,0 +1,7 @@
+---
+'@graphql-hive/gateway': patch
+---
+
+Update OpenSSL in Docker images to address security vulnerabilities;
+- https://avd.aquasec.com/nvd/cve-2025-9230
+- https://avd.aquasec.com/nvd/cve-2025-9231
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -86,3 +86,10 @@ updates:
           - 'major'
           - 'minor'
           - 'patch'
+      apollo:
+        patterns:
+          - '@apollo/*'
+        update-types:
+          - 'major'
+          - 'minor'
+          - 'patch'
diff --git a/e2e/cloudflare-workers/package.json b/e2e/cloudflare-workers/package.json
@@ -5,7 +5,7 @@
     "start": "wrangler dev src/index.ts"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20250927.0",
+    "@cloudflare/workers-types": "^4.20251001.0",
     "@graphql-hive/gateway-runtime": "workspace:*",
     "graphql": "^16.9.0",
     "wrangler": "^4.40.3"
diff --git a/e2e/nestjs/package.json b/e2e/nestjs/package.json
@@ -7,7 +7,7 @@
     "@graphql-hive/nestjs": "workspace:^",
     "@nestjs/common": "^11.1.6",
     "@nestjs/core": "^11.1.6",
-    "@nestjs/graphql": "^13.0.3",
+    "@nestjs/graphql": "^13.2.0",
     "@nestjs/platform-express": "^11.1.6",
     "file-type": "^21.0.0",
     "graphql": "^16.10.0",
diff --git a/internal/e2e/package.json b/internal/e2e/package.json
@@ -5,7 +5,7 @@
   "devDependencies": {
     "@apollo/gateway": "^2.11.2",
     "@types/dockerode": "^3.3.44",
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.6.1",
     "@whatwg-node/disposablestack": "^0.0.6",
     "@whatwg-node/fetch": "^0.10.11",
     "dockerode": "^4.0.9",
diff --git a/internal/examples/package.json b/internal/examples/package.json
@@ -7,7 +7,7 @@
     "start": "tsx ./src/bin.ts"
   },
   "devDependencies": {
-    "@apollo/rover": "^0.35.0",
+    "@apollo/rover": "0.35.0",
     "@babel/parser": "^7.28.4",
     "@types/jscodeshift": "^17.0.0",
     "@whatwg-node/disposablestack": "^0.0.6",
diff --git a/internal/heapsnapshot/package.json b/internal/heapsnapshot/package.json
@@ -21,7 +21,7 @@
   "devDependencies": {
     "@tsconfig/node18": "^18.2.4",
     "@tsconfig/recommended": "^1.0.8",
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.6.1",
     "pkgroll": "2.15.4",
     "typescript": "5.9.3"
   }
diff --git a/internal/testing/package.json b/internal/testing/package.json
@@ -14,7 +14,7 @@
     "@graphql-hive/pubsub": "workspace:*",
     "@graphql-mesh/types": "^0.104.13",
     "@graphql-tools/utils": "^10.9.1",
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.6.1",
     "@whatwg-node/disposablestack": "^0.0.6",
     "@whatwg-node/fetch": "^0.10.11",
     "@whatwg-node/promise-helpers": "^1.3.2",
diff --git a/package.json b/package.json
@@ -40,7 +40,7 @@
     "@changesets/cli": "patch:@changesets/cli@npm:2.27.9#~/.yarn/patches/@changesets-cli-npm-2.27.9-5df61a909e.patch",
     "@ianvs/prettier-plugin-sort-imports": "4.7.0",
     "@tsconfig/strictest": "2.0.6",
-    "@types/node": "24.6.0",
+    "@types/node": "24.6.1",
     "@yarnpkg/cli": "4.10.3",
     "@yarnpkg/core": "4.4.4",
     "@yarnpkg/plugin-pack": "4.0.3",
diff --git a/packages/gateway/bun.Dockerfile b/packages/gateway/bun.Dockerfile
@@ -19,13 +19,28 @@ RUN echo "deb http://ftp.debian.org/debian trixie main" >> /etc/apt/sources.list
 RUN apt-get dist-upgrade -y
 
 RUN apt-get install -y \
+  # for security updates
+  debian-security-support \
   # necessary for the gateway to run
   libc-bin \
   # for healthchecks
   wget curl \
   # for proper signal propagation
   dumb-init
 
+# Install specific security updates for openssl
+RUN wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/openssl_3.5.1-1+deb13u1_amd64.deb \
+  && dpkg -i openssl_3.5.1-1+deb13u1_amd64.deb \
+  && wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl3t64_3.5.1-1+deb13u1_amd64.deb \
+  && dpkg -i libssl3t64_3.5.1-1+deb13u1_amd64.deb \
+  && wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/openssl-provider-legacy_3.5.1-1+deb13u1_amd64.deb \
+  && dpkg -i openssl-provider-legacy_3.5.1-1+deb13u1_amd64.deb
+
+RUN echo "deb http://security.debian.org/debian-security bookworm-security main" >> /etc/apt/sources.list && \
+ apt-get update && \
+ apt-get install --only-upgrade -y openssl libssl3t64 openssl-provider-legacy && \
+ apt-get install -f -y
+
 # cleanup
 RUN apt-get autoremove -y && \
   apt-get clean && \
diff --git a/packages/gateway/node.Dockerfile b/packages/gateway/node.Dockerfile
@@ -19,11 +19,26 @@ RUN echo "deb http://ftp.debian.org/debian trixie main" >> /etc/apt/sources.list
 RUN apt-get dist-upgrade -y
 
 RUN apt-get install -y \
+  # for security updates
+  debian-security-support \
   # for healthchecks
   wget curl \
   # for proper signal propagation
   dumb-init
 
+# Install specific security updates for openssl
+RUN wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/openssl_3.5.1-1+deb13u1_amd64.deb \
+  && dpkg -i openssl_3.5.1-1+deb13u1_amd64.deb \
+  && wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl3t64_3.5.1-1+deb13u1_amd64.deb \
+  && dpkg -i libssl3t64_3.5.1-1+deb13u1_amd64.deb \
+  && wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/openssl-provider-legacy_3.5.1-1+deb13u1_amd64.deb \
+  && dpkg -i openssl-provider-legacy_3.5.1-1+deb13u1_amd64.deb
+
+RUN echo "deb http://security.debian.org/debian-security bookworm-security main" >> /etc/apt/sources.list && \
+ apt-get update && \
+ apt-get install --only-upgrade -y openssl libssl3t64 openssl-provider-legacy && \
+ apt-get install -f -y
+
 # cleanup
 RUN apt-get autoremove -y && \
   apt-get clean && \
diff --git a/packages/logger/package.json b/packages/logger/package.json
@@ -102,7 +102,7 @@
     "pino": "^9.12.0",
     "pkgroll": "2.15.4",
     "quick-format-unescaped": "^4.0.4",
-    "winston": "^3.18.1"
+    "winston": "^3.18.3"
   },
   "sideEffects": false,
   "dependencies.info": "all of the dependencies are in devDependencies which will bundle them into the package using pkgroll making pkgroll ultimately zero-dep with a smaller footprint because of tree-shaking"
diff --git a/packages/nestjs/package.json b/packages/nestjs/package.json
@@ -55,7 +55,7 @@
   "devDependencies": {
     "@nestjs/common": "11.1.6",
     "@nestjs/core": "11.1.6",
-    "@nestjs/graphql": "13.1.0",
+    "@nestjs/graphql": "13.2.0",
     "@nestjs/testing": "11.1.6",
     "@types/supertest": "6.0.3",
     "fastify": "5.6.1",
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
@@ -73,7 +73,7 @@
     "@graphql-yoga/plugin-csrf-prevention": "^3.16.0",
     "@graphql-yoga/plugin-defer-stream": "^3.16.0",
     "@graphql-yoga/plugin-persisted-operations": "^3.16.0",
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.6.1",
     "@whatwg-node/disposablestack": "^0.0.6",
     "@whatwg-node/promise-helpers": "^1.3.2",
     "@whatwg-node/server": "^0.10.12",
diff --git a/yarn.lock b/yarn.lock

Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@`
`21`	`21`	`"devDependencies": {`
`22`	`22`	`"@tsconfig/node18": "^18.2.4",`
`23`	`23`	`"@tsconfig/recommended": "^1.0.8",`
`24`		`- "@types/node": "^24.6.0",`
	`24`	`+ "@types/node": "^24.6.1",`
`25`	`25`	`"pkgroll": "2.15.4",`
`26`	`26`	`"typescript": "5.9.3"`
`27`	`27`	`}`