Update Apollo GraphQL packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@apollo/datasource-rest	6.2.2 -> 6.3.0
@apollo/server (source)	4.10.0 -> 4.11.2
@apollo/subgraph (source)	2.7.0 -> 2.9.3

---

Release Notes

apollographql/datasource-rest (@​apollo/datasource-rest)

v6.3.0

Compare Source

Minor Changes

• #​332 8a4578d Thanks @​nmrj! - Allow cache to be skipped on RestDataSource HTTP requests

apollographql/apollo-server (@​apollo/server)

v4.11.2

Compare Source

(No change; there is a change to the @apollo/server-integration-testsuite used to test integrations, and the two packages always have matching versions.)

v4.11.1

Compare Source

Patch Changes

• #​7952 bb81b2c Thanks @​glasser! - Upgrade dependencies so that automated scans don't detect a vulnerability.

  @apollo/server depends on express which depends on cookie. Versions of express older than v4.21.1 depend on a version of cookie vulnerable to CVE-2024-47764. Users of older express versions who call res.cookie() or res.clearCookie() may be vulnerable to this issue.

  However, Apollo Server does not call this function directly, and it does not expose any object to user code that allows TypeScript users to call this function without an unsafe cast.

  The only way that this direct dependency can cause a vulnerability for users of Apollo Server is if you call startStandaloneServer with a context function that calls Express-specific methods such as res.cookie() or res.clearCookies() on the response object, which is a violation of the TypeScript types provided by startStandaloneServer (which only promise that the response object is a core Node.js http.ServerResponse rather than the Express-specific subclass). So this vulnerability can only affect Apollo Server users who use unsafe JavaScript or unsafe as typecasts in TypeScript.

  However, this upgrade will at least prevent vulnerability scanners from alerting you to this dependency, and we encourage all Express users to upgrade their project's own express dependency to v4.21.1 or newer.

v4.11.0

Compare Source

Minor Changes

• #​7916 4686454 Thanks @​andrewmcgivery! - Add hideSchemaDetailsFromClientErrors option to ApolloServer to allow hiding 'did you mean' suggestions from validation errors.

  Even with introspection disabled, it is possible to "fuzzy test" a graph manually or with automated tools to try to determine the shape of your schema. This is accomplished by taking advantage of the default behavior where a misspelt field in an operation
  will be met with a validation error that includes a helpful "did you mean" as part of the error text.

  For example, with this option set to true, an error would read Cannot query field "help" on type "Query". whereas with this option set to false it would read Cannot query field "help" on type "Query". Did you mean "hello"?.

  We recommend enabling this option in production to avoid leaking information about your schema to malicious actors.

  To enable, set this option to true in your ApolloServer options:

  const server = new ApolloServer({
    typeDefs,
    resolvers,
    hideSchemaDetailsFromClientErrors: true,
  });

v4.10.5

Compare Source

Patch Changes

• #​7821 b2e15e7 Thanks @​renovate! - Non-major dependency updates

• #​7900 86d7111 Thanks @​trevor-scheer! - Inline a small dependency that was causing build issues for ESM projects

v4.10.4

Compare Source

Patch Changes

• #​7871 18a3827 Thanks @​tninesling! - Subscription heartbeats are initialized prior to awaiting subscribe(). This allows long-running setup to happen in the returned Promise without the subscription being terminated prior to resolution.

v4.10.3

Compare Source

Patch Changes

• #​7866 5f335a5 Thanks @​tninesling! - Catch errors thrown by subscription generators, and gracefully clean up the subscription instead of crashing.

v4.10.2

Compare Source

Patch Changes

• #​7849 c7e514c Thanks @​TylerBloom! - In the subscription callback server plugin, terminating a subscription now immediately closes the internal async generator. This avoids that generator existing after termination and until the next message is received.

v4.10.1

Compare Source

Patch Changes

• #​7843 72f568e Thanks @​bscherlein! - Improves timing of the willResolveField end hook on fields which return Promises resolving to Arrays. This makes the use of the setCacheHint method more reliable.

apollographql/federation (@​apollo/subgraph)

v2.9.3

Compare Source

Patch Changes

• Updated dependencies [cc4573471696ef78d04fa00c4cf8e5c50314ba9f, 062572b3253e8640b60a0bf58b83945094b76b6f, df5eb3cb0e2b4802fcd425ab9c23714de2707db3, 1c99cb0dcc6c639ac351210932623ab0bd6907e4]:
  • @​apollo/federation-internals@​2.9.3

v2.9.2

Compare Source

Patch Changes

• Updated dependencies [2192f355f50db33fe0807d16153f357696b9f190, 5ac01b534318105e904c1e6598070f753add3bb1]:
  • @​apollo/federation-internals@​2.9.2

v2.9.1

Compare Source

Patch Changes

• Updated dependencies [b8e4ab5352a4dfd262af49493fdd42e86e5e3d99, e6c05b6c96023aa3dec79889431f8217fcb3806d]:
  • @​apollo/federation-internals@​2.9.1

v2.9.0

Compare Source

Patch Changes

• Updated dependencies [02c2a34a62c3717a4885449172e404f19ebf66c9, 0ccfd937d4b4a576f890665ceebbd7986fac5d0c, e0a5075c0d12a0e2f7ef303b246e3216a139d3e0]:
  • @​apollo/federation-internals@​2.9.0

v2.8.5

Compare Source

Patch Changes

• Updated dependencies []:
  • @​apollo/federation-internals@​2.8.5

v2.8.4

Compare Source

Patch Changes

• Add descriptions for federation directives (#​3095)

• Updated dependencies [5f4bb160d024678d6facd471c43c8ec61c86e701, 672aca7cbeb0a6a38586357a4e154f2dd91caa0c]:

  • @​apollo/federation-internals@​2.8.4

v2.8.3

Compare Source

Patch Changes

• Updated dependencies [50d648ccffb05591878de75dc5522914ed48698f, f753d55e9a49d11389ee4f8d7976533447e95ede, 3af790517d662f3bec9064c0bf243014c579e9cd]:
  • @​apollo/federation-internals@​2.8.3

v2.8.2

Compare Source

Patch Changes

• Updated dependencies [b2e5ab66f84688ec304cfcf2c6f749c86aded549]:
  • @​apollo/federation-internals@​2.8.2

v2.8.1

Compare Source

Patch Changes

• Updated dependencies []:
  • @​apollo/federation-internals@​2.8.1

v2.8.0

Compare Source

Patch Changes

• Various set context bugfixes (#​3017)

• Updated dependencies [c4744da360235d8bb8270ea048f0e0fa5d03be1e, 8a936d741a0c05835ff2533714cf330d18209179]:

  • @​apollo/federation-internals@​2.8.0

v2.7.8

Compare Source

Patch Changes

• Triggering a clean 2.7.8 release now that harmonizer build has been fixed. (#​3010)

• Updated dependencies [2ad72802044310a528e8944f4538efe519424504]:

  • @​apollo/federation-internals@​2.7.8

v2.7.7

Compare Source

Patch Changes

• No logical changes since 2.7.5 or 2.7.6, but we fixed a bug in the release process, so we need to publish a new patch version (2.7.7). (#​2999)

• Updated dependencies [bee0b0828b4fb6a1d3172ac330560e2ab6c046bb]:

  • @​apollo/federation-internals@​2.7.7

v2.7.6

Compare Source

Patch Changes

• Updated dependencies []:
  • @​apollo/federation-internals@​2.7.6

v2.7.5

Compare Source

Patch Changes

• Updated dependencies []:
  • @​apollo/federation-internals@​2.7.5

v2.7.4

Compare Source

Patch Changes

• Updated dependencies [d80b7f0ca1456567a0866a32d2b2abf940598f77]:
  • @​apollo/federation-internals@​2.7.4

v2.7.3

Compare Source

Patch Changes

• Updated dependencies [ec04c50b4fb832bfd281ecf9c0c2dd7656431b96, a494631918156f0431ceace74281c076cf1d5d51]:
  • @​apollo/federation-internals@​2.7.3

v2.7.2

Compare Source

Patch Changes

• Updated dependencies [33b937b18d3c7ca6af14b904696b536399e597d1, 09cd3e55e810ee513127b7440f5b11af7540c9b0, d7189a86c27891af408d3d0184db6133d3342967]:
  • @​apollo/federation-internals@​2.7.2

v2.7.1

Compare Source

Patch Changes

• Updated dependencies [493f5acd16ad92adf99c963659cd40dc5eac1219]:
  • @​apollo/federation-internals@​2.7.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.