Update external major (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/checkout	action	major	v2 -> v4
actions/setup-node	action	major	v1 -> v4
adobe/aio-apps-action	action	major	2.0.1 -> 3.4.0
axios (source)	devDependencies	major	^0.27.2 -> ^1.0.0
chai (source)	devDependencies	major	4.3.5 -> 5.1.2
chalk	devDependencies	major	^4.1.2 -> ^5.0.0
circleci/node	docker	major	10.16.3 -> 14.18.2
codecov	orb	major	1.2.5 -> 5.0.3
dataloader	dependencies	major	1.4.0 -> 2.2.2
eslint (source)	devDependencies	major	7.32.0 -> 9.14.0
graphiql (source)	dependencies	major	1.5.16 -> 3.7.2
graphql	dependencies	major	14.7.0 -> 16.9.0
graphql-tools (source)	dependencies	major	3.1.1 -> 9.0.2
inquirer (source)	devDependencies	major	^8.2.0 -> ^12.0.0
mocha (source)	devDependencies	major	8.4.0 -> 10.8.2
mocha-junit-reporter	devDependencies	major	1.23.3 -> 2.2.1
node (source)	engines	major	^10 || ^12 || ^14 -> ^10 || ^12 || ^14 || ^22.0.0
nyc (source)	devDependencies	major	15.1.0 -> 17.1.0
react (source)	dependencies	major	17.0.2 -> 18.3.1
react-dom (source)	dependencies	major	17.0.2 -> 18.3.1
sinon (source)	devDependencies	major	7.5.0 -> 19.0.2

---

Release Notes

actions/checkout (actions/checkout)

v4

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in https://github.com/actions/checkout/pull/1924

v3

Compare Source

• Fix: Mark test scripts with Bash'isms to be run via Bash
• Add option to fetch tags even if fetch-depth > 0

actions/setup-node (actions/setup-node)

v4

Compare Source

v3

Compare Source

v2

Compare Source

adobe/aio-apps-action (adobe/aio-apps-action)

v3.4.0

Compare Source

What's Changed

• feat: add forceDeploy flag by @​yahor-mikheyenka-wttech in https://github.com/adobe/aio-apps-action/pull/68

New Contributors

• @​yahor-mikheyenka-wttech made their first contribution in https://github.com/adobe/aio-apps-action/pull/68

Full Changelog: adobe/aio-apps-action@3.3.1...3.4.0

v3.3.1

Compare Source

What's Changed

• fix: inherit secrets in nodejs ci workflow by @​MichaelGoberling in https://github.com/adobe/aio-apps-action/pull/62
• fix: validation errors when no scopes configured by @​MichaelGoberling in https://github.com/adobe/aio-apps-action/pull/66

Full Changelog: adobe/aio-apps-action@3.3.0...3.3.1

v3.3.0

Compare Source

What's Changed

• build(deps-dev): bump @​adobe/eslint-config-aio-lib-config from 2.0.2 to 3.0.0 by @​dependabot in https://github.com/adobe/aio-apps-action/pull/52
• fix: input warnings by @​MichaelGoberling in https://github.com/adobe/aio-apps-action/pull/54
• chore: update to node 20 by @​MichaelGoberling in https://github.com/adobe/aio-apps-action/pull/53
• docs: update versions in README examples by @​MichaelGoberling in https://github.com/adobe/aio-apps-action/pull/55

Full Changelog: adobe/aio-apps-action@3.2.0...3.3.0

v3.2.0

Compare Source

What's Changed

• fix: add unit tests by @​shazron in https://github.com/adobe/aio-apps-action/pull/48
• feat: validate oauth scope format by @​MichaelGoberling in https://github.com/adobe/aio-apps-action/pull/51
• feat: default oauth scopes by @​MichaelGoberling in https://github.com/adobe/aio-apps-action/pull/50

Full Changelog: adobe/aio-apps-action@3.1.0...3.2.0

v3.1.0

Compare Source

What's Changed

• Bump @​adobe/aio-lib-ims from 6.5.0 to 7.0.0 by @​dependabot in https://github.com/adobe/aio-apps-action/pull/46
• feat: add default scopes, make scope configuration optional (jwt only) by @​MichaelGoberling in https://github.com/adobe/aio-apps-action/pull/44

Full Changelog: adobe/aio-apps-action@3.0.0...3.1.0

v3.0.0

Compare Source

Support for OAuth Server to Server Authentication.

v2.0.2

Compare Source

What's Changed

• Update README.md by @​meryllblanchet in https://github.com/adobe/aio-apps-action/pull/12
• Doc update by @​sandeep-paliwal in https://github.com/adobe/aio-apps-action/pull/14
• fix: update --skip-build (deprecated) to use --no-build by @​shazron in https://github.com/adobe/aio-apps-action/pull/15

New Contributors

• @​meryllblanchet made their first contribution in https://github.com/adobe/aio-apps-action/pull/12
• @​shazron made their first contribution in https://github.com/adobe/aio-apps-action/pull/15

Full Changelog: adobe/aio-apps-action@v2.0.1...2.0.2

axios/axios (axios)

v1.7.7

Compare Source

Bug Fixes

• fetch: fix stream handling in Safari by fallback to using a stream reader instead of an async iterator; (#​6584) (d198085)
• http: fixed support for IPv6 literal strings in url (#​5731) (364993f)

Contributors to this release

• Rishi556
• Dmitriy Mozgovoy

v1.7.6

Compare Source

Bug Fixes

• fetch: fix content length calculation for FormData payload; (#​6524) (085f568)
• fetch: optimize signals composing logic; (#​6582) (df9889b)

Contributors to this release

• Dmitriy Mozgovoy
• Jacques Germishuys
• kuroino721

v1.7.5

Compare Source

Bug Fixes

• adapter: fix undefined reference to hasBrowserEnv (#​6572) (7004707)
• core: add the missed implementation of AxiosError#status property; (#​6573) (6700a8a)
• core: fix ReferenceError: navigator is not defined for custom environments; (#​6567) (fed1a4b)
• fetch: fix credentials handling in Cloudflare workers (#​6533) (550d885)

Contributors to this release

• Dmitriy Mozgovoy
• Antonin Bas
• Hans Otto Wirtz

v1.7.4

Compare Source

Bug Fixes

• sec: CVE-2024-39338 (#​6539) (#​6543) (6b6b605)
• sec: disregard protocol-relative URL to remediate SSRF (#​6539) (07a661a)

Contributors to this release

• Lev Pachmanov
• Đỗ Trọng Hải

v1.7.3

Compare Source

Bug Fixes

• adapter: fix progress event emitting; (#​6518) (e3c76fc)
• fetch: fix withCredentials request config (#​6505) (85d4d0e)
• xhr: return original config on errors from XHR adapter (#​6515) (8966ee7)

Contributors to this release

• Dmitriy Mozgovoy
• Valerii Sidorenko
• prianYu

v1.7.2

Compare Source

Bug Fixes

• fetch: enhance fetch API detection; (#​6413) (4f79aef)

Contributors to this release

• Dmitriy Mozgovoy

v1.7.1

Compare Source

Bug Fixes

• fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#​6410) (733f15f)

Contributors to this release

• Dmitriy Mozgovoy

v1.7.0

Compare Source

Features

• adapter: add fetch adapter; (#​6371) (a3ff99b)

Bug Fixes

• core/axios: handle un-writable error stack (#​6362) (81e0455)

Contributors to this release

• Dmitriy Mozgovoy
• Jay
• Alexandre ABRIOUX

v1.6.8

Compare Source

Bug Fixes

• AxiosHeaders: fix AxiosHeaders conversion to an object during config merging (#​6243) (2656612)
• import: use named export for EventEmitter; (7320430)
• vulnerability: update follow-redirects to 1.15.6 (#​6300) (8786e0f)

Contributors to this release

• Jay
• Dmitriy Mozgovoy
• Mitchell
• Emmanuel
• Lucas Keller
• Aditya Mogili
• Miroslav Petrov

v1.6.7

Compare Source

Bug Fixes

• capture async stack only for rejections with native error objects; (#​6203) (1a08f90)

Contributors to this release

• Dmitriy Mozgovoy
• zhoulixiang

v1.6.6

Compare Source

Bug Fixes

• fixed missed dispatchBeforeRedirect argument (#​5778) (a1938ff)
• wrap errors to improve async stack trace (#​5987) (123f354)

Contributors to this release

• Ilya Priven
• Zao Soula

v1.6.5

Compare Source

Bug Fixes

• ci: refactor notify action as a job of publish action; (#​6176) (0736f95)
• dns: fixed lookup error handling; (#​6175) (f4f2b03)

Contributors to this release

• Dmitriy Mozgovoy
• Jay

v1.6.4

Compare Source

Bug Fixes

• security: fixed formToJSON prototype pollution vulnerability; (#​6167) (3c0c11c)
• security: fixed security vulnerability in follow-redirects (#​6163) (75af1cd)

Contributors to this release

• Jay
• Dmitriy Mozgovoy
• Guy Nesher

v1.6.3

Compare Source

Bug Fixes

• Regular Expression Denial of Service (ReDoS) (#​6132) (5e7ad38)

Contributors to this release

• Jay
• Willian Agostini
• Dmitriy Mozgovoy

v1.6.2

Compare Source

Features

• withXSRFToken: added withXSRFToken option as a workaround to achieve the old withCredentials behavior; (#​6046) (cff9967)

PRs

• feat(withXSRFToken): added withXSRFToken option as a workaround to achieve the old `withCredentials` behavior; ( #​6046 )

📢 This PR added 'withXSRFToken' option as a replacement for old withCredentials behaviour. 
You should now use withXSRFToken along with withCredential to get the old behavior.
This functionality is considered as a fix.

Contributors to this release

• Dmitriy Mozgovoy
• Ng Choon Khon (CK)
• Muhammad Noman

v1.6.1

Compare Source

Bug Fixes

• formdata: fixed content-type header normalization for non-standard browser environments; (#​6056) (dd465ab)
• platform: fixed emulated browser detection in node.js environment; (#​6055) (3dc8369)

Contributors to this release

• Dmitriy Mozgovoy
• Fabian Meyer

v1.6.0

Compare Source

Bug Fixes

• CSRF: fixed CSRF vulnerability CVE-2023-45857 (#​6028) (96ee232)
• dns: fixed lookup function decorator to work properly in node v20; (#​6011) (5aaff53)
• types: fix AxiosHeaders types; (#​5931) (a1c8ad0)

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

Contributors to this release

• Dmitriy Mozgovoy
• Valentin Panov
• Rinku Chaudhari

1.5.1 (2023-09-26)

Bug Fixes

• adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
• formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
• headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
• types: removed duplicated code (9e62056)

Contributors to this release

• Dmitriy Mozgovoy
• David Dallas
• Sean Sattler
• Mustafa Ateş Uzun
• Przemyslaw Motacki
• Michael Di Prisco

PRs

• CVE 2023 45857 ( #​6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

v1.5.1

Compare Source

Bug Fixes

• adapters: improved adapters loading logic to have clear error messages; (#​5919) (e410779)
• formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#​5917) (bc9af51)
• headers: allow content-encoding header to handle case-insensitive values (#​5890) (#​5892) (4c89f25)
• types: removed duplicated code (9e62056)

Contributors to this release

• Dmitriy Mozgovoy
• David Dallas
• Sean Sattler
• Mustafa Ateş Uzun
• Przemyslaw Motacki
• Michael Di Prisco

v1.5.0

Compare Source

Bug Fixes

• adapter: make adapter loading error more clear by using platform-specific adapters explicitly (#​5837) (9a414bb)
• dns: fixed cacheable-lookup integration; (#​5836) (b3e327d)
• headers: added support for setting header names that overlap with class methods; (#​5831) (d8b4ca0)
• headers: fixed common Content-Type header merging; (#​5832) (8fda276)

Features

• export getAdapter function (#​5324) (ca73eb8)
• export: export adapters without unsafe prefix (#​5839) (1601f4a)

Contributors to this release

• Dmitriy Mozgovoy
• 夜葬
• Jonathan Budiman
• Michael Di Prisco

v1.4.0

Compare Source

Bug Fixes

• formdata: add multipart/form-data content type for FormData payload on custom client environments; (#​5678) (bbb61e7)
• package: export package internals with unsafe path prefix; (#​5677) (df38c94)

Features

• dns: added support for a custom lookup function; (#​5339) (2701911)
• types: export AxiosHeaderValue type. (#​5525) (726f1c8)

Performance Improvements

• merge-config: optimize mergeConfig performance by avoiding duplicate key visits; (#​5679) (e6f7053)

Contributors to this release

• Dmitriy Mozgovoy
• Arthur Fiorette
• PIYUSH NEGI

1.3.6 (2023-04-19)

Bug Fixes

• types: added transport to RawAxiosRequestConfig (#​5445) (6f360a2)
• utils: make isFormData detection logic stricter to avoid unnecessary calling of the toString method on the target; (#​5661) (aa372f7)

Contributors to this release

• Dmitriy Mozgovoy
• Michael Di Prisco

1.3.5 (2023-04-05)

Bug Fixes

• headers: fixed isValidHeaderName to support full list of allowed characters; (#​5584) (e7decef)
• params: re-added the ability to set the function as paramsSerializer config; (#​5633) (a56c866)

Contributors to this release

• Dmitriy Mozgovoy

1.3.4 (2023-02-22)

Bug Fixes

• blob: added a check to make sure the Blob class is available in the browser's global scope; (#​5548) (3772c8f)
• http: fixed regression bug when handling synchronous errors inside the adapter; (#​5564) (a3b246c)

Contributors to this release

• Dmitriy Mozgovoy
• lcysgsg
• Michael Di Prisco

1.3.3 (2023-02-13)

Bug Fixes

• formdata: added a check to make sure the FormData class is available in the browser's global scope; (#​5545) ([a6dfa72](https://redirect.github.com

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.