Skip to content

Commit

Permalink
Rebase from main
Browse files Browse the repository at this point in the history
  • Loading branch information
smyrick committed Aug 19, 2022
1 parent a66e49d commit 6768111
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 5 deletions.
5 changes: 0 additions & 5 deletions .changeset/lemon-goats-happen.md

This file was deleted.

2 changes: 2 additions & 0 deletions CHANGELOG.md
Expand Up @@ -10,6 +10,8 @@ The version headers in this history reflect the versions of Apollo Server itself

## vNEXT

- [apollo-datasource-rest] Add option to disable GET cache [PR #6650](https://github.com/apollographql/apollo-server/pull/6650)

## v3.10.1

- ⚠️ **SECURITY**: The default landing page contained HTML to display a sample `curl` command which is made visible if the full landing page bundle could not be fetched from Apollo's CDN. The server's URL is directly interpolated into this command inside the browser from `window.location.href`. On some older browsers such as IE11, this value is not URI-encoded. On such browsers, opening a malicious URL pointing at an Apollo Router could cause execution of attacker-controlled JavaScript. In this release, the fallback page does not display a `curl` command. More details are available at the [security advisory](https://github.com/apollographql/apollo-server/security/advisories/GHSA-2fvv-qxrq-7jq6).
Expand Down

0 comments on commit 6768111

Please sign in to comment.