@apollo/server@5.4.0

Minor Changes

• d25a5bd Thanks @phryneas! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
  Any other character set will be rejected with a 415 Unsupported Media Type error.
  Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8.
  Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now.
  In a future major release, we may tighten this restriction further to only allow UTF-8.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
  For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

@apollo/server@4.13.0

Minor Changes

• #8180 e9d49d1 Thanks @github-actions! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
  Any other character set will be rejected with a 415 Unsupported Media Type error.
  Additionally, upstream libraries used by this version of Apollo Server may not support all of these encodings, so some requests may still fail even if they pass this check.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
  For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

  Also please note that Apollo Server 4.x is considered EOL as of January 26, 2026, and Apollo no longer commits to providing support or updates for it. Please prioritize migrating to Apollo Server 5.x for continued support and updates.

@apollo/server-integration-testsuite@5.4.0

Patch Changes

• Updated dependencies [d25a5bd]:
  • @apollo/server@5.4.0

@apollo/server-integration-testsuite@4.13.0

Patch Changes

• Updated dependencies [e9d49d1]:
  • @apollo/server@4.13.0

@apollo/server@5.3.0

Minor Changes

• #8062 8e54e58 Thanks @cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

  const server = new ApolloServer({
    typeDefs,
    resolvers,
    executionOptions: {
      maxCoercionErrors: 50,
    },
  });

• #8014 26320bc Thanks @mo4islona! - Expose graphql validation options.

  const server = new ApolloServer({
    typeDefs,
    resolvers,
    validationOptions: {
      maxErrors: 10,
    },
  });

@apollo/server-integration-testsuite@5.3.0

Patch Changes

• Updated dependencies [8e54e58, 26320bc]:
  • @apollo/server@5.3.0

@apollo/server@5.2.0

Minor Changes

• #8161 51acbeb Thanks @jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.

  import { legacyExecuteIncrementally } from '@yaacovcr/transform';
  
  const server = new ApolloServer({
    // ...
    legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
  });

  If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

@apollo/server-integration-testsuite@5.2.0

Patch Changes

• Updated dependencies [51acbeb]:
  • @apollo/server@5.2.0

@apollo/server@5.1.0

Minor Changes

• #8148 80a1a1a Thanks @jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with graphql@17.0.0-alpha.9. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.

  Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.

  I use graphql@16 without incremental delivery

  Continue using graphql v16 with no additional changes. Incremental delivery won't be available.

  I use graphql@16 but would like to add support for incremental delivery

  Install graphql@17.0.0-alpha.9 and follow the "Incremental delivery" guide to add the @defer and @stream directives to your schema. Clients should send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2 to get multipart responses.

  I use graphql@17.0.0-alpha.2 and use incremental delivery

  You must upgrade to graphql@17.0.0-alpha.9 to continue using incremental delivery. If you'd like to continue providing support for the legacy incremental protocol, install the @yaacovcr/transform package. Apollo Server will attempt to load this module when the client specifies an Accept header with a value of multipart/mixed; deferSpec=20220824. If this package is not installed, an error is returned by the server.

  Because Apollo Server now supports multiple versions of the incremental delivery types, the existing incremental delivery types have been renamed with an Alpha2 suffix. If you import these types in your code, you will need to add the Alpha2 suffix.

  import type {
  - GraphQLExperimentalFormattedInitialIncrementalExecutionResult,
  + GraphQLExperimentalFormattedInitialIncrementalExecutionResultAlpha2,
  
  - GraphQLExperimentalFormattedSubsequentIncrementalExecutionResult,
  + GraphQLExperimentalFormattedSubsequentIncrementalExecutionResultAlpha2,
  
  - GraphQLExperimentalFormattedIncrementalResult,
  + GraphQLExperimentalFormattedIncrementalResultAlpha2,
  
  - GraphQLExperimentalFormattedIncrementalDeferResult,
  + GraphQLExperimentalFormattedIncrementalDeferResultAlpha2,
  
  - GraphQLExperimentalFormattedIncrementalStreamResult,
  + GraphQLExperimentalFormattedIncrementalStreamResultAlpha2,
  } from '@apollo/server';

  Incremental delivery types for the graphql@17.0.0-alpha.9 version are now available using the Alpha9 suffix:

  import type {
    GraphQLExperimentalFormattedInitialIncrementalExecutionResultAlpha9,
    GraphQLExperimentalFormattedSubsequentIncrementalExecutionResultAlpha9,
    GraphQLExperimentalFormattedIncrementalResultAlpha9,
    GraphQLExperimentalFormattedIncrementalDeferResultAlpha9,
    GraphQLExperimentalFormattedIncrementalStreamResultAlpha9,
    GraphQLExperimentalFormattedCompletedResultAlpha9,
    GraphQLExperimentalPendingResultAlpha9,
  } from '@apollo/server';

@apollo/server-integration-testsuite@5.1.0

Patch Changes

• Updated dependencies [80a1a1a]:
  • @apollo/server@5.1.0