Skip to content

chore(deps): bump the web-frameworks group across 1 directory with 3 updates - #10092

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/web-frameworks-f85b47b707
Closed

chore(deps): bump the web-frameworks group across 1 directory with 3 updates#10092
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/web-frameworks-f85b47b707

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the web-frameworks group with 3 updates in the /packages/dd-trace/test/plugins/versions directory: @apollo/subgraph, ldapjs-promise and multer.

Updates @apollo/subgraph from 2.14.4 to 2.15.0

Release notes

Sourced from @​apollo/subgraph's releases.

@​apollo/subgraph@​2.15.0

This release is a generic reimplementation of @apollo/subgraph that can be used with any graphql-js compatible subgraphs. Unless otherwise noted, behavior is intended to stay compatible with the previous implementation.

Changed

  • Use graphql-js functionality over custom logic. All logic is now re-implemented using graphql-js functionality. @apollo/federation-internals is no longer a dependency.
  • printSubgraphSchema now prints the complete schema, federation directives, types, and root fields included. NOTE: It is just a thin wrapper around @graphql-tools/utils's printSchemaWithDirectives.

Removed

  • LegacySchemaModule input shape. buildSubgraphSchema no longer accepts Apollo Server's old { typeDefs, resolvers } object shape. Pass an array of { typeDefs, resolvers } modules (or a bare DocumentNode) instead:

    - buildSubgraphSchema({ typeDefs, resolvers })
+ buildSubgraphSchema([{ typeDefs, resolvers }])

@​apollo/subgraph@​2.15.0-alpha.0

Changelog

15.0.0-alpha.1

Minor Changes

  • #3 ce5c255 Thanks @​dariuszkuc! - Reimplement @apollo/subgraph directly using graphql-js instead of @apollo/federation-internals, making it usable with any graphql-js compatible subgraph. Unless otherwise noted, behavior is intended to stay compatible with the previous implementation.

    • Use graphql-js functionality over custom logic. All logic is now re-implemented using graphql-js functionality. @apollo/federation-internals is no longer a dependency.

    • printSubgraphSchema now prints the complete schema, federation directives, types, and root fields included. NOTE: It is just a thin wrapper around @graphql-tools/utils's printSchemaWithDirectives.

    • BREAKING: LegacySchemaModule input shape removed. buildSubgraphSchema no longer accepts Apollo Server's old { typeDefs, resolvers } object shape. Pass an array of { typeDefs, resolvers } modules (or a bare DocumentNode) instead:

      - buildSubgraphSchema({ typeDefs, resolvers })
+ buildSubgraphSchema([{ typeDefs, resolvers }])

All notable changes to this project are documented in this file.

2.15.0

This release is a generic reimplementation of @apollo/subgraph that can be used with any graphql-js compatible subgraphs. Unless

... (truncated)

Changelog

Sourced from @​apollo/subgraph's changelog.

2.15.0

This release is a generic reimplementation of @apollo/subgraph that can be used with any graphql-js compatible subgraphs. Unless otherwise noted, behavior is intended to stay compatible with the previous implementation.

Changed

  • Use graphql-js functionality over custom logic. All logic is now re-implemented using graphql-js functionality. @apollo/federation-internals is no longer a dependency.
  • printSubgraphSchema now prints the complete schema, federation directives, types, and root fields included. NOTE: It is just a thin wrapper around @graphql-tools/utils's printSchemaWithDirectives.

Removed

  • LegacySchemaModule input shape. buildSubgraphSchema no longer accepts Apollo Server's old { typeDefs, resolvers } object shape. Pass an array of { typeDefs, resolvers } modules (or a bare DocumentNode) instead:

    - buildSubgraphSchema({ typeDefs, resolvers })
+ buildSubgraphSchema([{ typeDefs, resolvers }])
Commits

Updates ldapjs-promise from 3.0.9 to 3.0.10

Release notes

Sourced from ldapjs-promise's releases.

3.0.10

What's Changed

  • chore: fixing returning results.

Full Changelog: wslyhbb/node-ldapjs-promise@v3.0.9...v3.0.10

Commits

Updates multer from 2.2.0 to 2.3.0

Release notes

Sourced from multer's releases.

v2.3.0

Important

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from multer's changelog.

2.3.0

Commits
  • 4e8edf5 2.3.0 (#1455)
  • 87a584e fix: reject invalid field names instead of crashing on append-field errors
  • ab6aeae fix: enforce file size limit with async fileFilter
  • eef7444 fix: destroy disk write stream on aborted uploads to prevent fd leak
  • 25ec9bb docs: refresh all README translations (#1462)
  • 73c1759 feat: add an opt-in fieldArrayIndexLimit (#1438)
  • ece6735 Update 'README-zh-cn.md' up to now (#1264)
  • 3278e1b docs: add Japanese translation to README (#1354)
  • 3c0bc5e test: accept files exactly at fileSize limit (#1382)
  • b6d84b0 docs: add Indonesian translation for README (#1431)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.

@dependabot dependabot Bot added dependabot dependencies javascript Pull requests that update javascript code semver-patch labels Sep 1, 2026
@dependabot
dependabot Bot requested review from a team as code owners September 1, 2026 00:59
@dependabot dependabot Bot added dependencies javascript Pull requests that update javascript code labels Sep 1, 2026
@dependabot
dependabot Bot requested a review from tlhunter September 1, 2026 00:59
@dependabot dependabot Bot added the dependabot label Sep 1, 2026
@dd-octo-sts
dd-octo-sts Bot enabled auto-merge (squash) September 1, 2026 00:59
@dd-octo-sts

dd-octo-sts Bot commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Overall package size

Self size: 8.74 MB
Deduped: 9.41 MB
No deduping: 9.41 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.4.0 | 127.33 kB | 447.04 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Sep 1, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 471bc7c6e0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread packages/dd-trace/test/plugins/versions/package.json
"@apollo/gateway": "2.14.4",
"@apollo/server": "5.5.1",
"@apollo/subgraph": "2.14.4",
"@apollo/subgraph": "2.15.0",

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Adapt Apollo fixtures before selecting subgraph 2.15

When the Apollo plugin job resolves the unversioned @apollo/subgraph dependency to this pin, setupGateway() passes each fixture directly to buildSubgraphSchema (packages/datadog-plugin-apollo/test/index.spec.js:43-48). These fixtures use the legacy { typeDefs, resolvers } module shape, which 2.15.0 removes in favor of an array of modules or a DocumentNode; consequently the suite's before hook will fail before any Apollo tests run. Update the fixture invocation (for example, by passing the module in an array) together with this bump.

Useful? React with 👍 / 👎.

@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented Sep 1, 2026 •
edited by datadog-prod-us1-3 Bot
Loading

Copy link
Copy Markdown

Pipelines  Tests

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

APM Integrations | apollo — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

TypeError: doc.definitions is not iterable at concatAST (/home/runner/work/dd-trace-js/dd-trace-js/versions/node_modules/graphql/utilities/concatAST.js:32:17) while running tests in index.spec.js.

All Green | all-green

View more details · View in GitHub Actions

No coverage reports found under coverage-results/.

📋 Copy fix prompt 
CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/master HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/web-frameworks-f85b47b707

APM Integrations | apollo
Commit: 7ba52ff4d6fdac602f82c62d8a613ae6327ce351
Error (code / test):
TypeError: doc.definitions is not iterable at concatAST (/home/runner/work/dd-trace-js/dd-trace-js/versions/node_modules/graphql/utilities/concatAST.js:32:17) while running tests in index.spec.js.
CI job: https://github.com/DataDog/dd-trace-js/actions/runs/33701421926/job/100482868459

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 7cc959d | Docs | View more details | Give us feedback!

@pr-commenter

pr-commenter Bot commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-09-03 01:05:21

Comparing candidate commit 7cc959d in PR branch dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/web-frameworks-f85b47b707 with baseline commit 6e65a91 in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2316 metrics, 12 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

  • unstable max_rss_usage [-36.164MB; +68.882MB] or [-12.290%; +23.409%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

  • unstable max_rss_usage [-24.903MB; +15.082MB] or [-10.617%; +6.430%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-24

  • unstable max_rss_usage [-38.781MB; +5.847MB] or [-11.391%; +1.717%]

scenario:appsec-iast-with-vulnerability-iast-enabled-default-config-20

  • unstable max_rss_usage [-15.981MB; +29.965MB] or [-4.399%; +8.249%]

scenario:dogstatsd-with-tags-20

  • unstable cpu_user_time [-490.926ms; +161.888ms] or [-9.922%; +3.272%]
  • unstable execution_time [-486.599ms; +160.976ms] or [-9.684%; +3.204%]
  • unstable throughput [-55340.025op/s; +161937.029op/s] or [-3.313%; +9.696%]

scenario:encoders-0.4-immediate-flush-20

  • unstable max_rss_usage [-6.081MB; +11.540MB] or [-7.958%; +15.102%]

scenario:llmobs-encode-unicode-mixed-20

  • unstable max_rss_usage [-12.075MB; +5.659MB] or [-15.177%; +7.112%]

scenario:plugin-graphql-long-with-depth-off-20

  • unstable max_rss_usage [-9139.356KB; +8382.125KB] or [-7.325%; +6.718%]

scenario:plugin-graphql-long-with-depth-on-max-20

  • unstable max_rss_usage [-6.931MB; +14.677MB] or [-4.771%; +10.104%]

scenario:test-optimization-large-suite-20

  • unstable max_rss_usage [-4385.236KB; +6128.236KB] or [-5.459%; +7.629%]

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/web-frameworks-f85b47b707 branch from 471bc7c to 969eff8 Compare September 1, 2026 09:14
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/web-frameworks-f85b47b707 branch from 969eff8 to 6e27cdf Compare September 1, 2026 09:31
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/web-frameworks-f85b47b707 branch from 6e27cdf to f8f2f63 Compare September 2, 2026 00:54
@dependabot
chore(deps): bump the web-frameworks group across 1 directory with 3 …
7cc959d 
…updates

Bumps the web-frameworks group with 3 updates in the /packages/dd-trace/test/plugins/versions directory: [@apollo/subgraph](https://github.com/apollographql/subgraph-js), [ldapjs-promise](https://github.com/wslyhbb/node-ldapjs-promise) and [multer](https://github.com/expressjs/multer).


Updates `@apollo/subgraph` from 2.14.4 to 2.15.0
- [Release notes](https://github.com/apollographql/subgraph-js/releases)
- [Changelog](https://github.com/apollographql/subgraph-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/apollographql/subgraph-js/commits/@apollo/subgraph@2.15.0)

Updates `ldapjs-promise` from 3.0.9 to 3.0.10
- [Release notes](https://github.com/wslyhbb/node-ldapjs-promise/releases)
- [Commits](wslyhbb/node-ldapjs-promise@v3.0.9...v3.0.10)

Updates `multer` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.2.0...v2.3.0)

---
updated-dependencies:
- dependency-name: "@apollo/subgraph"
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-frameworks
- dependency-name: ldapjs-promise
  dependency-version: 3.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-frameworks
- dependency-name: multer
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-frameworks
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/web-frameworks-f85b47b707 branch from f8f2f63 to 7cc959d Compare September 3, 2026 00:53
@BridgeAR BridgeAR mentioned this pull request Sep 3, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 4, 2026
auto-merge was automatically disabled September 4, 2026 00:53

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/web-frameworks-f85b47b707 branch September 4, 2026 00:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@dd-octo-sts dd-octo-sts[bot] dd-octo-sts[bot] approved these changes
@tlhunter tlhunter Awaiting requested review from tlhunter tlhunter is a code owner automatically assigned from DataDog/apm-idm-js

Assignees

No one assigned

Labels

dependabot dependencies javascript Pull requests that update javascript code semver-patch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants