chore: bump vulnerable dependencies (#7847)

Author: n1ru4l

integration-tests/package.json

@@ -11,7 +11,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@apollo/gateway": "2.13.1",
+    "@apollo/gateway": "2.13.2",
     "@apollo/server": "5.4.0",
     "@aws-sdk/client-s3": "3.723.0",
     "@esm2cjs/execa": "6.1.1-cjs.1",

package.json

@@ -129,6 +129,7 @@
     "overrides.qs@<6.14.2": "address https://github.com/graphql-hive/console/security/dependabot/499",
     "overrides.dompurify@3.x.x": "address https://github.com/graphql-hive/console/security/dependabot/536",
     "overrides.ajv@8.x.x": "address https://github.com/graphql-hive/console/security/dependabot/507",
+    "overrides.yauzl@2.x.x": "address https://github.com/graphql-hive/console/security/dependabot/542",
     "overrides": {
       "esbuild": "0.25.9",
       "csstype": "3.1.2",
@@ -161,7 +162,8 @@
       "minimatch@4.x.x": "^4.2.4",
       "qs@<6.14.2": "^6.14.2",
       "dompurify@3.x.x": "^3.3.2",
-      "ajv@8.x.x": "^8.18.0"
+      "ajv@8.x.x": "^8.18.0",
+      "yauzl@2.x.x": "^3.2.1"
     },
     "patchedDependencies": {
       "mjml-core@4.14.0": "patches/mjml-core@4.14.0.patch",

packages/libraries/core/package.json

@@ -58,7 +58,7 @@
   },
   "devDependencies": {
     "@apollo/federation": "0.38.1",
-    "@apollo/subgraph": "2.13.1",
+    "@apollo/subgraph": "2.13.2",
     "@types/async-retry": "1.4.8",
     "@types/js-md5": "0.8.0",
     "@types/lodash.sortby": "4.7.9",

packages/libraries/external-composition/package.json

@@ -60,7 +60,7 @@
     "graphql": "^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0"
   },
   "devDependencies": {
-    "@apollo/composition": "2.10.4",
+    "@apollo/composition": "2.13.2",
     "@types/node": "22.10.5",
     "esbuild": "0.25.9",
     "fastify": "5.8.1",

packages/services/api/package.json

@@ -76,7 +76,7 @@
     "slonik": "30.4.4",
     "stripe": "17.5.0",
     "tslib": "2.8.1",
-    "undici": "7.18.2",
+    "undici": "7.24.0",
     "vitest": "4.0.9",
     "zod": "3.25.76",
     "zod-validation-error": "3.4.0"

packages/services/broker-worker/package.json

@@ -14,7 +14,7 @@
     "esbuild": "0.25.9",
     "itty-router": "4.2.2",
     "toucan-js": "4.1.0",
-    "undici": "7.18.2",
+    "undici": "7.24.0",
     "vitest": "4.0.9",
     "workers-loki-logger": "0.1.15",
     "zod": "3.25.76"

packages/services/cdn-worker/package.json

@@ -28,7 +28,7 @@
     "itty-router": "4.2.2",
     "itty-router-extras": "0.4.6",
     "toucan-js": "4.1.0",
-    "undici": "7.18.2",
+    "undici": "7.24.0",
     "zod": "3.25.76"
   }
 }

packages/services/demo/federation/package.json

@@ -6,7 +6,7 @@
     "deploy": "node --experimental-strip-types ./src/generate-supergraph.ts && wrangler deploy src/main.ts"
   },
   "dependencies": {
-    "@apollo/subgraph": "2.13.1",
+    "@apollo/subgraph": "2.13.2",
     "@theguild/federation-composition": "0.21.3",
     "graphql": "16.9.0",
     "graphql-yoga": "5.13.3"

packages/services/external-composition/federation-2/package.json

@@ -8,8 +8,8 @@
     "dev": "tsup-node --config ../../../configs/tsup/dev.config.node.ts src/dev.ts"
   },
   "devDependencies": {
-    "@apollo/composition": "2.10.4",
-    "@apollo/federation-internals": "2.9.3",
+    "@apollo/composition": "2.13.2",
+    "@apollo/federation-internals": "2.13.2",
     "@graphql-hive/external-composition": "workspace:*",
     "@whatwg-node/server": "0.10.17",
     "dotenv": "16.4.7",