refactor: Bump graphql-upload from 15.0.2 to 17.0.0

[dependabot]

Bumps graphql-upload from 15.0.2 to 17.0.0.

Release notes

Sourced from graphql-upload's releases.

Version 17.0.0

Major

• Updated Node.js support to ^18.18.0 || ^20.9.0 || >=22.0.0.

• Updated dev dependencies, some of which require newer Node.js versions than previously supported.

• Use the TypeScript v5.5+ JSDoc tag @import to import types in modules.

• Removed JSDoc tag @typedef that were unintentionally re-exporting types; to migrate import TypeScript types from the correct module:

  - import type { GraphQLUpload } from "graphql-upload/Upload.mjs";
  + import type GraphQLUpload from "graphql-upload/GraphQLUpload.mjs";

  - import type { processRequest } from "graphql-upload/Upload.mjs";
  + import type processRequest from "graphql-upload/processRequest.mjs";

  - import type { GraphQLUpload } from "graphql-upload/processRequest.mjs";
  + import type GraphQLUpload from "graphql-upload/GraphQLUpload.mjs";

• Refactored tests to use the standard AbortController, fetch, File, and FormData APIs available in modern Node.js and removed the dev dependencies node-abort-controller and node-fetch.

• Replaced the test utility function streamToString with the function text from node:stream/consumers that’s available in modern Node.js.

• Use the Node.js test runner API and remove the dev dependency test-director.

Minor

• Support Express v5 by updating the optional peer dependency @types/express to 4.0.29 - 5 and the dev dependency express to v5, via #389.

Patch

• Tweaked the package description.
• Updated the package.json field repository to conform to new npm requirements.
• Updated the package scripts:
  • Reordered the scripts.
  • Replaced npm run with node --run.
• Updated GitHub Actions CI config:
  • No longer run the workflow on pull request.
  • Enable manual workflow dispatching.
  • Run checks in seperate jobs.
  • Removed custom step names.
  • Replaced npm run with node --run.
  • Updated the tested Node.js versions to v18, v20, v22.
  • Updated actions/checkout to v4.
  • Updated actions/setup-node to v4.
• Migrated to the ESLint v9 CLI and “flat” config.
• Integrated a new dev dependency eslint-plugin-jsdoc and revised types.
• Removed the Node.js CLI option --unhandled-rejections=throw in the package script tests as it’s now the default for all supported Node.js versions.

... (truncated)

Changelog

Sourced from graphql-upload's changelog.

17.0.0

Major

• Updated Node.js support to ^18.18.0 || ^20.9.0 || >=22.0.0.

• Updated dev dependencies, some of which require newer Node.js versions than previously supported.

• Use the TypeScript v5.5+ JSDoc tag @import to import types in modules.

• Removed JSDoc tag @typedef that were unintentionally re-exporting types; to migrate import TypeScript types from the correct module:

  - import type { GraphQLUpload } from "graphql-upload/Upload.mjs";
  + import type GraphQLUpload from "graphql-upload/GraphQLUpload.mjs";

  - import type { processRequest } from "graphql-upload/Upload.mjs";
  + import type processRequest from "graphql-upload/processRequest.mjs";

  - import type { GraphQLUpload } from "graphql-upload/processRequest.mjs";
  + import type GraphQLUpload from "graphql-upload/GraphQLUpload.mjs";

• Refactored tests to use the standard AbortController, fetch, File, and FormData APIs available in modern Node.js and removed the dev dependencies node-abort-controller and node-fetch.

• Replaced the test utility function streamToString with the function text from node:stream/consumers that’s available in modern Node.js.

• Use the Node.js test runner API and remove the dev dependency test-director.

Minor

• Support Express v5 by updating the optional peer dependency @types/express to 4.0.29 - 5 and the dev dependency express to v5, via #389.

Patch

• Tweaked the package description.
• Updated the package.json field repository to conform to new npm requirements.
• Updated the package scripts:
  • Reordered the scripts.
  • Replaced npm run with node --run.
• Updated GitHub Actions CI config:
  • No longer run the workflow on pull request.
  • Enable manual workflow dispatching.
  • Run checks in seperate jobs.
  • Removed custom step names.
  • Replaced npm run with node --run.
  • Updated the tested Node.js versions to v18, v20, v22.
  • Updated actions/checkout to v4.
  • Updated actions/setup-node to v4.
• Migrated to the ESLint v9 CLI and “flat” config.
• Integrated a new dev dependency eslint-plugin-jsdoc and revised types.

... (truncated)

Commits

• 421707f Version 17.0.0.
• db00563 Update the GitHub Actions CI workflow.
• 218bc95 Replace npm run with node --run.
• 352f3fe Reorder the package scripts.
• 284410c Update the GitHub Action CI workflow.
• 1cf3d56 Tweak wording.
• 3ddf628 Update the GitHub Markdown syntax for alerts in the readme.
• e7a051c Remove an unnecessary await in tests.
• 1135035 Replace the test helper class Deferred with polyfilled `Promise.withResolve...
• 1bc03b9 Account for different Node.js version default stream high water mark values.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[mtrezza]

@Moumouls would you want to take on this GraphQL challenge?

[Moumouls]

Hi @mtrezza ! hope you are doing well !

Yes, i need to dedicate some time to parse, during next weeks, my team really needed me and i struggled to find some time, but i've also some simple PRs ideas

I'll keep you updated !

[mtrezza]

@Moumouls Always great to hear from you! Appreciate your efforts, curious to hear what you have in mind...

[Moumouls]

Okay i investigated here, the issue is caused by the graphql-upload lib breaking change using ESM.

ESM is quite a mess to use currently in CommonJS, and current code will need a weird and huge refactor with potential breaking change for current user if we opt out to use try to use this lib as ESM.

Here i can suggest to just wait since Node is currently testing to support by default ESM via require https://nodejs.org/dist/latest/docs/api/modules.html#loading-ecmascript-modules-using-require

Implemented in node 23 and will be LTS in node 24.

I tested, Node 23 currently fix the issue without special tricks

Node 23 is currenly fixing a huge headache in the ecosystem.

[mtrezza]

So let's wait until Node 24 which will be released around April 2025 I guess.

[Moumouls]

I think it's the current best approach for packages in ESM where the ESM trick with await import is not easy and may introduce a too big refactor.

In the case of graphql-upload the package is safe for now with just 1 old CVE: https://security.snyk.io/package/npm/graphql-upload

[mtrezza]

Also, graphql-upload requires at least node 18.18.0, so we couldn't merge this before Parse Server 8 anyway.