chore(deps): Bump HotChocolate.AspNetCore and HotChocolate.Subscriptions.InMemory

[dependabot]

Updated HotChocolate.AspNetCore from 16.6.7 to 16.6.8.

Release notes

Sourced from HotChocolate.AspNetCore's releases.

16.6.8

What's Changed

• Dispatch GitHub Action, Homebrew and Azure Pipelines releases with only the version by @​tobias-tengler in Dispatch GitHub Action, Homebrew and Azure Pipelines releases with only the version ChilliCream/graphql-platform#10502
• Fix missing pipeline state answering 400 or 422 instead of 500 by @​glen-84 in Fix missing pipeline state answering 400 or 422 instead of 500 ChilliCream/graphql-platform#10430
• [OpenAPI] Fix MapOpenApiEndpoints not resolving a single named schema by @​tobias-tengler in [OpenAPI] Fix MapOpenApiEndpoints not resolving a single named schema ChilliCream/graphql-platform#10443
• Fix schema reloads disposing application services by @​tobias-tengler in Fix schema reloads disposing application services ChilliCream/graphql-platform#10450
• Fix the HTTP request span reporting named schemas as _Default by @​glen-84 in Fix the HTTP request span reporting named schemas as _Default ChilliCream/graphql-platform#10454
• Fix EventSource never receiving the SSE complete event by @​glen-84 in Fix EventSource never receiving the SSE complete event ChilliCream/graphql-platform#10462
• [Mocha] Fix the mediator throwing when a notification has no handlers by @​tobias-tengler in [Mocha] Fix the mediator throwing when a notification has no handlers ChilliCream/graphql-platform#10465
• [Mocha] Fix PostgreSQL outbox persistence connection lifetime by @​tobias-tengler in [Mocha] Fix PostgreSQL outbox persistence connection lifetime ChilliCream/graphql-platform#10478
• [Fusion] Fix subgraph errors being dropped on non-null fields and null list elements by @​michaelstaib in [Fusion] Fix subgraph errors being dropped on non-null fields and null list elements ChilliCream/graphql-platform#10464
• Record undeclared Postgres dispatch targets in the topology under explicit binding by @​PascalSenn in Record undeclared Postgres dispatch targets in the topology under explicit binding ChilliCream/graphql-platform#10491
• [Mocha] Fix the outbox worker missing messages written inside a TransactionScope by @​tobias-tengler in [Mocha] Fix the outbox worker missing messages written inside a TransactionScope ChilliCream/graphql-platform#10496
• Fix QueryContext<T> dropping sort fields after a nested object field by @​glen-84 in Fix QueryContext<T> dropping sort fields after a nested object field ChilliCream/graphql-platform#10501

Full Changelog: ChilliCream/graphql-platform@16.6.7...16.6.8

Commits viewable in compare view.

Updated HotChocolate.Subscriptions.InMemory from 16.6.7 to 16.6.8.

Release notes

Sourced from HotChocolate.Subscriptions.InMemory's releases.

16.6.8

What's Changed

• Dispatch GitHub Action, Homebrew and Azure Pipelines releases with only the version by @​tobias-tengler in Dispatch GitHub Action, Homebrew and Azure Pipelines releases with only the version ChilliCream/graphql-platform#10502
• Fix missing pipeline state answering 400 or 422 instead of 500 by @​glen-84 in Fix missing pipeline state answering 400 or 422 instead of 500 ChilliCream/graphql-platform#10430
• [OpenAPI] Fix MapOpenApiEndpoints not resolving a single named schema by @​tobias-tengler in [OpenAPI] Fix MapOpenApiEndpoints not resolving a single named schema ChilliCream/graphql-platform#10443
• Fix schema reloads disposing application services by @​tobias-tengler in Fix schema reloads disposing application services ChilliCream/graphql-platform#10450
• Fix the HTTP request span reporting named schemas as _Default by @​glen-84 in Fix the HTTP request span reporting named schemas as _Default ChilliCream/graphql-platform#10454
• Fix EventSource never receiving the SSE complete event by @​glen-84 in Fix EventSource never receiving the SSE complete event ChilliCream/graphql-platform#10462
• [Mocha] Fix the mediator throwing when a notification has no handlers by @​tobias-tengler in [Mocha] Fix the mediator throwing when a notification has no handlers ChilliCream/graphql-platform#10465
• [Mocha] Fix PostgreSQL outbox persistence connection lifetime by @​tobias-tengler in [Mocha] Fix PostgreSQL outbox persistence connection lifetime ChilliCream/graphql-platform#10478
• [Fusion] Fix subgraph errors being dropped on non-null fields and null list elements by @​michaelstaib in [Fusion] Fix subgraph errors being dropped on non-null fields and null list elements ChilliCream/graphql-platform#10464
• Record undeclared Postgres dispatch targets in the topology under explicit binding by @​PascalSenn in Record undeclared Postgres dispatch targets in the topology under explicit binding ChilliCream/graphql-platform#10491
• [Mocha] Fix the outbox worker missing messages written inside a TransactionScope by @​tobias-tengler in [Mocha] Fix the outbox worker missing messages written inside a TransactionScope ChilliCream/graphql-platform#10496
• Fix QueryContext<T> dropping sort fields after a nested object field by @​glen-84 in Fix QueryContext<T> dropping sort fields after a nested object field ChilliCream/graphql-platform#10501

Full Changelog: ChilliCream/graphql-platform@16.6.7...16.6.8

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Bowire PR report

Section	Status
API schema	🟢 identical
Tests	🟢 1 test passed
Security	🟠 1 error-level finding · not gated (fail-on-scan: never)
Perf	🟢 no regression

API schema: schema identical.

Tests: 1/1 passed, 0 failed.

Security

Security scan report — http://127.0.0.1:6000

Findings: 1 high, 1 low

By OWASP API Top 10

Entry	Risk	Findings
API8-2023-SECMISCONF	Security Misconfiguration	2

Findings

[high] Target serves plaintext http://

Rule: BWR-BUILTIN-TLS-001 · OWASP: API8-2023-SECMISCONF — Security Misconfiguration · CVSS: 7.4 · Target: http://127.0.0.1:6000
What to do: Enforce https:// at the load balancer / ingress. Add HSTS (Strict-Transport-Security: max-age=31536000) once https:// is reliable. Submit to the HSTS-preload list for browser-side enforcement.

[low] Version-disclosing header: Server

Rule: BWR-BUILTIN-BANNER-SERVER · OWASP: API8-2023-SECMISCONF — Security Misconfiguration · CVSS: 3.7 · Target: http://127.0.0.1:6000
What to do: Remove or anonymise the Server response header. ASP.NET Core: app.Use((ctx, next) => { ctx.Response.Headers.Remove("Server"); return next(); }). nginx: server_tokens off; (covers Server header). IIS: customize the runtime via web.config .

Perf

Perf: no test moved more than 20% across 1 compared test(s).

---

_{Generated by bowire — API / test / security / perf impact of this PR.}