Skip to content

chore(deps): bump @apollo/server from 4.13.0 to 5.5.0#20275

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/apollo/server-5.5.0
Closed

chore(deps): bump @apollo/server from 4.13.0 to 5.5.0#20275
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/apollo/server-5.5.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 26, 2026 •
edited
Loading

Bumps @apollo/server from 4.13.0 to 5.5.0.

Release notes

Sourced from @​apollo/server's releases.

@​apollo/server-integration-testsuite@​5.5.0

Minor Changes

  • #8191 ada1200 - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

Patch Changes

  • Updated dependencies [ada1200]:
    • @​apollo/server@​5.5.0

@​apollo/server@​5.5.0

Minor Changes

  • #8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

@​apollo/server-integration-testsuite@​5.4.0

Patch Changes

  • Updated dependencies [d25a5bd]:
    • @​apollo/server@​5.4.0

@​apollo/server@​5.4.0

Minor Changes

... (truncated)

Changelog

Sourced from @​apollo/server's changelog.

5.5.0

Minor Changes

  • #8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

    Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

    (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

    This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

    If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

    This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

    See advisory GHSA-9q82-xgwf-vj6h for more details.

5.4.0

Minor Changes

  • d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

    The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

    In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, we may tighten this restriction further to only allow UTF-8.

    If you were not using startStandaloneServer, you were not affected by this vulnerability.

    Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

5.3.0

Minor Changes

  • #8062 8e54e58 Thanks @​cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

    const server = new ApolloServer({
  typeDefs,
  resolvers,
  executionOptions: {
    maxCoercionErrors: 50,
  },

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​apollo/server since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file maintenance labels Mar 26, 2026
@dependabot dependabot Bot requested a review from a team as a code owner March 26, 2026 23:05
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file maintenance labels Mar 26, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/apollo/server-5.5.0 branch from 2801909 to 1d29910 Compare March 27, 2026 17:00
dschom
dschom reviewed Apr 16, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@dschom dschom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot rebase

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 16, 2026

Dependabot can't resolve your JavaScript dependency files. Because of this, Dependabot cannot update this pull request.

@dschom
Copy link
Copy Markdown
Contributor

dschom commented Apr 16, 2026

@copilot resolve the merge conflicts in this pull request

@dependabot @dschom
chore(deps): bump @apollo/server from 4.13.0 to 5.5.0
08eb227 
Bumps [@apollo/server](https://github.com/apollographql/apollo-server/tree/HEAD/packages/server) from 4.13.0 to 5.5.0.
- [Release notes](https://github.com/apollographql/apollo-server/releases)
- [Changelog](https://github.com/apollographql/apollo-server/blob/main/packages/server/CHANGELOG.md)
- [Commits](https://github.com/apollographql/apollo-server/commits/@apollo/server@5.5.0/packages/server)

---
updated-dependencies:
- dependency-name: "@apollo/server"
  dependency-version: 5.5.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dschom dschom force-pushed the dependabot/npm_and_yarn/apollo/server-5.5.0 branch from 1d29910 to 08eb227 Compare April 16, 2026 20:09
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 16, 2026

Dependabot can't resolve your JavaScript dependency files. Because of this, Dependabot cannot update this pull request.

@dschom
Copy link
Copy Markdown
Contributor

dschom commented Apr 16, 2026

Admin server fails to build...

@vpomerleau vpomerleau mentioned this pull request Apr 23, 2026
Merged
5 tasks
@vpomerleau
Copy link
Copy Markdown
Contributor

vpomerleau commented Apr 23, 2026

Won't be needed after #20452

@vpomerleau vpomerleau closed this Apr 23, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 23, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/apollo/server-5.5.0 branch April 23, 2026 22:45
vpomerleau added a commit that referenced this pull request Apr 24, 2026
@vpomerleau
chore(sentry): remove unused @nestjs/apollo, @nestjs/graphql, @apollo…
0310876 
…/server

Because:
- fxa-graphql-api was retired and fxa-admin-server/admin-panel migrated
  from GraphQL to REST, so nothing in the monorepo reaches
  @nestjs/apollo, @nestjs/graphql, or @apollo/server at runtime.
- The only remaining surface was three stale Sentry integration files:
  a SentryPlugin class with zero importers and two dead `graphql`
  context branches in the reporting helpers.
- Dropping them shrinks the NestJS 11 lockstep upgrade scope
  (FXA-13358), obsoletes dependabot PR #20275 (@apollo/server 4 → 5),
  and eliminates five related advisories including GHSA-9q82-xgwf-vj6h.

This commit:
- Deletes libs/shared/sentry/src/lib/nest/sentry.plugin.ts and its
  barrel export.
- Strips @nestjs/graphql and @apollo/server imports, isApolloError,
  and processException from reporting.ts in both libs/shared/sentry
  and libs/shared/sentry-nest, and removes the isApolloError call
  from ignoreError.
- Removes the "should ignore apollo errors" test and GraphQLError
  import from both reporting.spec.ts files.
- Removes @apollo/server, @nestjs/apollo, and @nestjs/graphql from the
  root package.json and the corresponding yarn.lock entries.
- Drops '@nestjs/apollo' and '@nestjs/graphql' from the
  serverExternalPackages array in apps/payments/next/next.config.js
  since those packages no longer resolve.
- Pins @types/node-fetch ^2.6.12 as a direct root devDependency —
  @apollo/server was transitively providing it, and
  packages/fxa-admin-server/src/newsletters/basket.service.ts still
  imports from node-fetch.
- Migrates libs/vendored/jwtool/src/lib/jwtool.ts to Node 22's global
  fetch (typed via @types/node/globals.d.ts) so the vendored library
  no longer imports node-fetch.

Closes #FXA-13606
vpomerleau added a commit that referenced this pull request Apr 30, 2026
@vpomerleau
chore(sentry): remove unused @nestjs/apollo, @nestjs/graphql, @apollo…
9e41e38 
…/server

Because:
- fxa-graphql-api was retired and fxa-admin-server/admin-panel migrated
  from GraphQL to REST, so nothing in the monorepo reaches
  @nestjs/apollo, @nestjs/graphql, or @apollo/server at runtime.
- The only remaining surface was three stale Sentry integration files:
  a SentryPlugin class with zero importers and two dead `graphql`
  context branches in the reporting helpers.
- Dropping them shrinks the NestJS 11 lockstep upgrade scope
  (FXA-13358), obsoletes dependabot PR #20275 (@apollo/server 4 → 5),
  and eliminates five related advisories including GHSA-9q82-xgwf-vj6h.

This commit:
- Deletes libs/shared/sentry/src/lib/nest/sentry.plugin.ts and its
  barrel export.
- Strips @nestjs/graphql and @apollo/server imports, isApolloError,
  and processException from reporting.ts in both libs/shared/sentry
  and libs/shared/sentry-nest, and removes the isApolloError call
  from ignoreError.
- Removes the "should ignore apollo errors" test and GraphQLError
  import from both reporting.spec.ts files.
- Removes @apollo/server, @nestjs/apollo, and @nestjs/graphql from the
  root package.json and the corresponding yarn.lock entries.
- Drops '@nestjs/apollo' and '@nestjs/graphql' from the
  serverExternalPackages array in apps/payments/next/next.config.js
  since those packages no longer resolve.
- Pins @types/node-fetch ^2.6.12 as a direct root devDependency —
  @apollo/server was transitively providing it, and
  packages/fxa-admin-server/src/newsletters/basket.service.ts still
  imports from node-fetch.
- Migrates libs/vendored/jwtool/src/lib/jwtool.ts to Node 22's global
  fetch (typed via @types/node/globals.d.ts) so the vendored library
  no longer imports node-fetch.

Closes #FXA-13606
vpomerleau added a commit that referenced this pull request May 5, 2026
@vpomerleau
chore(sentry): remove unused @nestjs/apollo, @nestjs/graphql, @apollo…
92fdd63 
…/server

Because:
- fxa-graphql-api was retired and fxa-admin-server/admin-panel migrated
  from GraphQL to REST, so nothing in the monorepo reaches
  @nestjs/apollo, @nestjs/graphql, or @apollo/server at runtime.
- The only remaining surface was three stale Sentry integration files:
  a SentryPlugin class with zero importers and two dead `graphql`
  context branches in the reporting helpers.
- Dropping them shrinks the NestJS 11 lockstep upgrade scope
  (FXA-13358), obsoletes dependabot PR #20275 (@apollo/server 4 → 5),
  and eliminates five related advisories including GHSA-9q82-xgwf-vj6h.

This commit:
- Deletes libs/shared/sentry/src/lib/nest/sentry.plugin.ts and its
  barrel export.
- Strips @nestjs/graphql and @apollo/server imports, isApolloError,
  and processException from reporting.ts in both libs/shared/sentry
  and libs/shared/sentry-nest, and removes the isApolloError call
  from ignoreError.
- Removes the "should ignore apollo errors" test and GraphQLError
  import from both reporting.spec.ts files.
- Removes @apollo/server, @nestjs/apollo, and @nestjs/graphql from the
  root package.json and the corresponding yarn.lock entries.
- Drops '@nestjs/apollo' and '@nestjs/graphql' from the
  serverExternalPackages array in apps/payments/next/next.config.js
  since those packages no longer resolve.
- Pins @types/node-fetch ^2.6.12 as a direct root devDependency —
  @apollo/server was transitively providing it, and
  packages/fxa-admin-server/src/newsletters/basket.service.ts still
  imports from node-fetch.
- Migrates libs/vendored/jwtool/src/lib/jwtool.ts to Node 22's global
  fetch (typed via @types/node/globals.d.ts) so the vendored library
  no longer imports node-fetch.

Closes #FXA-13606
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dschom dschom dschom left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file maintenance

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dschom @vpomerleau