Sourced from @​apollo/server's releases.

@​apollo/server-integration-testsuite@​5.4.0

Patch Changes

• Updated dependencies [d25a5bd]:
  • @​apollo/server@​5.4.0

@​apollo/server@​5.4.0

Minor Changes

• d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, we may tighten this restriction further to only allow UTF-8.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

Sourced from @​apollo/server's changelog.

5.4.0

Minor Changes

• d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, we may tighten this restriction further to only allow UTF-8.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

• ad45d15 Version Packages (#8179)
• d25a5bd Merge commit from fork
• See full diff in compare view

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​apollo/server since your current version.

Sourced from openai's releases.

v6.18.0

6.18.0 (2026-02-05)

Full Changelog: v6.17.0...v6.18.0

Features

• api: image generation actions for responses; ResponseFunctionCallArgumentsDoneEvent.name (d373c32)

Bug Fixes

• client: avoid memory leak with abort signals (b449f36)
• client: avoid removing abort listener too early (1c045f7)
• client: undo change to web search Find action (8259b45)
• client: update type for find_in_page action (9aa8d98)

Chores

• client: do not parse responses with empty content-length (4a118fa)
• client: restructure abort controller binding (a4d7151)
• internal: fix pagination internals not accepting option promises (6677905)

Sourced from openai's changelog.

6.18.0 (2026-02-05)

Full Changelog: v6.17.0...v6.18.0

Features

• api: image generation actions for responses; ResponseFunctionCallArgumentsDoneEvent.name (d373c32)

Bug Fixes

• client: avoid memory leak with abort signals (b449f36)
• client: avoid removing abort listener too early (1c045f7)
• client: undo change to web search Find action (8259b45)
• client: update type for find_in_page action (9aa8d98)

Chores

• client: do not parse responses with empty content-length (4a118fa)
• client: restructure abort controller binding (a4d7151)
• internal: fix pagination internals not accepting option promises (6677905)

• 69d2b01 release: 6.18.0
• bf5a096 chore(internal): fix pagination internals not accepting option promises
• aa24028 fix(client): avoid removing abort listener too early
• 6ae89c6 chore(client): restructure abort controller binding
• e70fa06 fix(client): undo change to web search Find action
• 3fd4d03 codegen metadata
• f4e6a09 codegen metadata
• 4391e45 fix(client): update type for find_in_page action
• a05e900 chore(client): do not parse responses with empty content-length
• 243f44d fix(client): avoid memory leak with abort signals
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions