fix(deps): update apollo graphql packages to v5 (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@apollo/server (source)	^4.3.0 -> ^4.3.0 || ^5.0.0
@apollo/server (source)	4.11.2 -> 5.1.0
@apollo/server (source)	^4.3.0 -> ^5.0.0
@apollo/server-integration-testsuite (source)	4.11.2 -> 5.1.0

---

Release Notes

apollographql/apollo-server (@​apollo/server)

v5.1.0

Compare Source

Minor Changes

• #​8148 80a1a1a Thanks @​jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with [email protected]. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.

  Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.

I use graphql@16 without incremental delivery

Continue using `graphql` v16 with no additional changes. Incremental delivery won't be available.

I use graphql@16 but would like to add support for incremental delivery

Install `[email protected]` and follow the ["Incremental delivery" guide](https://www.apollographql.com/docs/apollo-server/workflow/requests#incremental-delivery-experimental) to add the `@defer` and `@stream` directives to your schema. Clients should send the `Accept` header with a value of `multipart/mixed; incrementalSpec=v0.2` to get multipart responses.

I use [email protected] and use incremental delivery

You must upgrade to `[email protected]` to continue using incremental delivery. If you'd like to continue providing support for the legacy incremental protocol, install the [`@yaacovcr/transform`](https://redirect.github.com/yaacovCR/transform) package. Apollo Server will attempt to load this module when the client specifies an `Accept` header with a value of `multipart/mixed; deferSpec=20220824`. If this package is not installed, an error is returned by the server.

Because Apollo Server now supports multiple versions of the incremental delivery types, the existing incremental delivery types have been renamed with an `Alpha2` suffix. If you import these types in your code, you will need to add the `Alpha2` suffix.

```diff
import type {
- GraphQLExperimentalFormattedInitialIncrementalExecutionResult,
+ GraphQLExperimentalFormattedInitialIncrementalExecutionResultAlpha2,

- GraphQLExperimentalFormattedSubsequentIncrementalExecutionResult,
+ GraphQLExperimentalFormattedSubsequentIncrementalExecutionResultAlpha2,

- GraphQLExperimentalFormattedIncrementalResult,
+ GraphQLExperimentalFormattedIncrementalResultAlpha2,

- GraphQLExperimentalFormattedIncrementalDeferResult,
+ GraphQLExperimentalFormattedIncrementalDeferResultAlpha2,

- GraphQLExperimentalFormattedIncrementalStreamResult,
+ GraphQLExperimentalFormattedIncrementalStreamResultAlpha2,
} from '@​apollo/server';
```

Incremental delivery types for the `[email protected]` version are now available using the `Alpha9` suffix:

```ts
import type {
  GraphQLExperimentalFormattedInitialIncrementalExecutionResultAlpha9,
  GraphQLExperimentalFormattedSubsequentIncrementalExecutionResultAlpha9,
  GraphQLExperimentalFormattedIncrementalResultAlpha9,
  GraphQLExperimentalFormattedIncrementalDeferResultAlpha9,
  GraphQLExperimentalFormattedIncrementalStreamResultAlpha9,
  GraphQLExperimentalFormattedCompletedResultAlpha9,
  GraphQLExperimentalPendingResultAlpha9,
} from '@​apollo/server';
```

v5.0.0

Compare Source

BREAKING CHANGES

Apollo Server v5 has very few breaking API changes. It is a small upgrade focused largely on adjusting which versions of Node.js and Express are supported.

Read our migration guide for more details on how to update your app.

• Dropped support for Node.js v14, v16, and v18, which are no longer under long-term support from the Node.js Foundation. Apollo Server 5 supports Node.js v20 and later; v24 is recommended. Ensure you are on a non-EOL version of Node.js before upgrading Apollo Server.
• Dropped support for versions of the graphql library older than v16.11.0. (Apollo Server 4 supports graphql v16.6.0 or later.) Upgrade graphql before upgrading Apollo Server.
• Express integration requires a separate package. In Apollo Server 4, you could import the Express 4 middleware from @apollo/server/express4, or you could import it from the separate package @as-integrations/express4. In Apollo Server 5, you must import it from the separate package. You can migrate your server to the new package before upgrading to Apollo Server 5. (You can also use @as-integrations/express5 for a middleware that works with Express 5.)
• Usage Reporting, Schema Reporting, and Subscription Callback plugins now use the Node.js built-in fetch implementation for HTTP requests by default, instead of the node-fetch npm package. If your server uses an HTTP proxy to make HTTP requests, you need to configure it in a slightly different way. See the migration guide for details.
• The server started with startStandaloneServer no longer uses Express. This is mostly invisible, but it does set slightly fewer headers. If you rely on the fact that this server is based on Express, you should explicitly use the Express middleware.
• The experimental support for incremental delivery directives @defer and @stream (which requires using a pre-release version of graphql v17) now explicitly only works with version 17.0.0-alpha.2 of graphql. Note that this supports the same incremental delivery protocol implemented by Apollo Server 4, which is not the same protocol in the latest alpha version of graphql. As this support is experimental, we may switch over from "only alpha.2 is supported" to "only a newer alpha or final release is supported, with a different protocol" during the lifetime of Apollo Server 5.
• Apollo Server is now compiled by the TypeScript compiler targeting the ES2023 standard rather than the ES2020 standard.
• Apollo Server 5 responds to requests with variable coercion errors (eg, if a number is passed in the variables map for a variable declared in the operation as a String) with a 400 status code, indicating a client error. This is also the behavior of Apollo Server 3. Apollo Server 4 mistakenly responds to these requests with a 200 status code by default; we recommended the use of the status400ForVariableCoercionErrors: true option to restore the intended behavior. That option now defaults to true.
• The unsafe precomputedNonce option to landing page plugins (which was only non-deprecated for 8 days) has been removed.

Patch Changes

There are a few other small changes in v5:

• #​8076 5b26558 Thanks @​valters! - Fix some error logs to properly call logger.error or logger.warn with this set. This fixes errors or crashes from logger implementations that expect this to be set properly in their methods.

• #​7515 100233a Thanks @​trevor-scheer! - ApolloServerPluginSubscriptionCallback now takes a fetcher argument, like the usage and schema reporting plugins. The default value is Node's built-in fetch.

• Updated dependencies [100233a]:

  • @​apollo/server-gateway-interface@​2.0.0

v4.12.2

Compare Source

(No change; there is a change to the @apollo/server-integration-testsuite used to test integrations, and the two packages always have matching versions.)

v4.12.1

Compare Source

Patch Changes

• #​8064 41f98d4 Thanks @​glasser! - Update README.md to recommend Express v5 integration now that Express v5 is released.

v4.12.0

Compare Source

Minor Changes

• #​8054 89e3f84 Thanks @​clenfest! - Adds a new graphql-js validation rule to reject operations that recursively request selections above a specified maximum, which is disabled by default. Use configuration option maxRecursiveSelections=true to enable with a maximum of 10,000,000, or maxRecursiveSelections=<number> for a custom maximum. Enabling this validation can help avoid performance issues with configured validation rules or plugins.

Patch Changes

• #​8031 2550d9f Thanks @​slagiewka! - Add return after sending 400 response in doubly escaped JSON parser middleware

v4.11.3

Compare Source

Patch Changes

• #​8010 f4228e8 Thanks @​glasser! - Compatibility with Next.js Turbopack. Fixes #​8004.

apollographql/apollo-server (@​apollo/server-integration-testsuite)

v5.1.0

Compare Source

Patch Changes

• Updated dependencies [80a1a1a]:
  • @​apollo/server@​5.1.0

v5.0.0

Compare Source

Major Changes

• Drop support for Node.JS v14, v16, and v20.

• The integration test suite no longer uses lib: ["dom"] to tell TypeScript to assume DOM-related symbols are in the global namespace. If your integration library's test suite relied on this behavior, you may need to add lib: ["dom"] to the compilerOptions section of your test suite's tsconfig.json.

Patch Changes

• #​8078 dabe7ba Thanks @​renovate! - Support Jest v30 as well as Jest v29.

• Updated dependencies [5b26558, 100233a, 100233a, 100233a, 100233a]:

  • @​apollo/server@​5.0.0

v4.12.2

Compare Source

Patch Changes

• #​8070 0dee3c9 Thanks @​glasser! - Provide dual-build CJS and ESM for @apollo/server-integration-testsuite.

  We previously provided only a CJS build of this package, unlike @apollo/server
  itself and the other helper packages that come with it. We may make all of
  Apollo Server ESM-only in AS5; this is a step in that direction. Specifically,
  only providing this package for CJS makes it challenging to run the tests in
  ts-jest in some ESM-only setups, because the copy of @apollo/server fetched
  directly in your ESM-based test may differ from the copy fetched indirectly via
  @apollo/server-integration-testsuite, causing the "lockstep versioning" test
  to fail.

• Updated dependencies:

  • @​apollo/server@​4.12.2

v4.12.1

Compare Source

Patch Changes

• Updated dependencies [41f98d4]:
  • @​apollo/server@​4.12.1

v4.12.0

Compare Source

Patch Changes

• Updated dependencies [89e3f84, 2550d9f]:
  • @​apollo/server@​4.12.0

v4.11.3

Compare Source

Patch Changes

• #​8010 f4228e8 Thanks @​glasser! - Compatibility with Next.js Turbopack. Fixes #​8004.

• Updated dependencies [f4228e8, 70eecce]:

  • @​apollo/server@​4.11.3

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm error code EBADENGINE
npm error engine Unsupported engine
npm error engine Not compatible with your version of node/npm: [email protected]
npm error notsup Not compatible with your version of node/npm: [email protected]
npm error notsup Required: {"node":">=16 <=22"}
npm error notsup Actual:   {"npm":"10.9.1","node":"v24.10.0"}
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2025-10-28T17_55_33_543Z-debug-0.log