fix(deps): update apollo graphql packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@apollo/client (source)	3.13.8 → 3.14.0
@apollo/server (source)	4.12.2 → 4.13.0

---

Release Notes

apollographql/apollo-client (@​apollo/client)

v3.14.0

Compare Source

Minor Changes

• #​12752 8b779b4 Thanks @​jerelmiller! - Add deprecations and warnings to remaining APIs changed in Apollo Client 4.0.

• #​12746 0bcd2f4 Thanks @​jerelmiller! - Add warnings and deprecations for options and methods for all React APIs.

• #​12751 567cad8 Thanks @​jerelmiller! - Add @deprecated tags to all properties returned from any query API (e.g. client.query, observableQuery.refetch, etc.), client.mutate, and client.subscribe that are no longer available in Apollo Client 4.0.

• #​12746 0bcd2f4 Thanks @​jerelmiller! - Add preloadQuery.toPromise(queryRef) as a replacement for queryRef.toPromise(). queryRef.toPromise() has been removed in Apollo Client 4.0 in favor of preloadQuery.toPromise and is now considered deprecated.

• #​12736 ea89440 Thanks @​jerelmiller! - Add deprecations and deprecation warnings for ApolloClient options and methods.

• #​12763 5de6a3d Thanks @​jerelmiller! - Version bump only to release latest as rc.

• #​12459 1c5a031 Thanks @​jerelmiller! - Reset addTypenameTransform and fragments caches when calling cache.gc() only when resetResultCache is true.

• #​12743 92ad409 Thanks @​jerelmiller! - Add deprecations and warnings for addTypename in InMemoryCache and MockedProvider.

• #​12743 92ad409 Thanks @​jerelmiller! - Add deprecations and warnings for canonizeResults.

• #​12751 567cad8 Thanks @​jerelmiller! - Warn when using a standby fetch policy with client.query.

Patch Changes

• #​12750 ecf3de1 Thanks @​phryneas! - Prevent field policies from overwriting/merging into supertype field policies.

v3.13.9

Compare Source

Patch Changes

• #​12804 32c9aa9 Thanks @​phryneas! - Fix a possible race condition on queries that were reobserved before they were subscribed to the first time.

apollographql/apollo-server (@​apollo/server)

v4.13.0

Compare Source

Minor Changes

• #​8180 e9d49d1 Thanks @​github-actions! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
  Any other character set will be rejected with a 415 Unsupported Media Type error.
  Additionally, upstream libraries used by this version of Apollo Server may not support all of these encodings, so some requests may still fail even if they pass this check.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
  For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

  Also please note that Apollo Server 4.x is considered EOL as of January 26, 2026, and Apollo no longer commits to providing support or updates for it. Please prioritize migrating to Apollo Server 5.x for continued support and updates.

---

Configuration

📅 Schedule: Branch creation - "before 8am every weekday,every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}