chore(deps): bump the apollo-and-graphql group across 1 directory with 6 updates

[dependabot]

Bumps the apollo-and-graphql group with 5 updates in the / directory:

Package	From	To
@apollo/client	3.10.4	4.3.0
@graphql-tools/load	7.7.0	8.1.17
@graphql-tools/url-loader	7.17.18	9.1.9
apollo-server-express	2.21.1	3.13.0
graphql	15.4.0	17.0.2

Updates @apollo/client from 3.10.4 to 4.3.0

Release notes

Sourced from @​apollo/client's releases.

@​apollo/client@​4.3.0

Minor Changes

• #13447 24133fe Thanks @​jerelmiller! - Field policies and inputObjects can now tell the cache whether a field is a list of scalars or a scalar whose value is an array. Previously all arrays were iterated and only the inner type was provided to the scalar parse/serialize functions.

  This required some breaking changes from previous prerelease versions:

  • The field policy scalar option and inputObjects type string now use GraphQL list syntax to mark a field as a list of scalars
  • The abstract cache.getScalarForField is now cache.getScalarTypeForField and is expected to return the string representing the scalar type rather than the Scalar instance

  new InMemoryCache({
    scalars: {
      DateTime: new Scalar(/*...*/),
    },
    inputObjects: {
      EventFilter: {
        fields: {
          // Previously only the scalar type was provided
          datesBefore: "DateTime",
      // List syntax now required
      datesAfter: "[DateTime]",
      dates2d: "[[DateTime]]",
    },
  },
  
  },
  typePolicies: {
  Event: {
  fields: {
  // Previously only the scalar type was provided
  datesBefore: {
  scalar: "DateTime",
  },
      // List syntax now required
      datesAfter: {
        scalar: "[DateTime]",
      },
      dates2d: {
        scalar: "[[DateTime]]",
      },
    },
  },
  
  },
  });

  Now it's possible to handle scalars that are represented by arrays:

... (truncated)

Changelog

Sourced from @​apollo/client's changelog.

4.3.0

Minor Changes

• #13447 24133fe Thanks @​jerelmiller! - Field policies and inputObjects can now tell the cache whether a field is a list of scalars or a scalar whose value is an array. Previously all arrays were iterated and only the inner type was provided to the scalar parse/serialize functions.

  This required some breaking changes from previous prerelease versions:

  • The field policy scalar option and inputObjects type string now use GraphQL list syntax to mark a field as a list of scalars
  • The abstract cache.getScalarForField is now cache.getScalarTypeForField and is expected to return the string representing the scalar type rather than the Scalar instance

  new InMemoryCache({
    scalars: {
      DateTime: new Scalar(/*...*/),
    },
    inputObjects: {
      EventFilter: {
        fields: {
          // Previously only the scalar type was provided
          datesBefore: "DateTime",
      // List syntax now required
      datesAfter: "[DateTime]",
      dates2d: "[[DateTime]]",
    },
  },
  
  },
  typePolicies: {
  Event: {
  fields: {
  // Previously only the scalar type was provided
  datesBefore: {
  scalar: "DateTime",
  },
      // List syntax now required
      datesAfter: {
        scalar: "[DateTime]",
      },
      dates2d: {
        scalar: "[[DateTime]]",
      },
    },
  },
  
  },
  });

  Now it's possible to handle scalars that are represented by arrays:

... (truncated)

Commits

• d4f8770 Version Packages (#13461)
• d3c455f Exit prerelease mode (#13460)
• 0c925a4 Release 4.3 (#13243)
• 4060465 Merge branch 'main' into release-4.3
• 9cd4118 Add custom scalars documentation (#13439)
• 766a86e Add documentation for the TypeScript changes in 4.3 (#13436)
• f342046 Version Packages (rc) (#13450)
• f1244b1 Fix release workflow (#13449)
• 77e1e35 Mark skip as deprecated in useQuery and useSubscription (#13448)
• c573e42 Version Packages (rc) (#13444)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​apollo/client since your current version.

Updates @graphql-tools/load from 7.7.0 to 8.1.17

Changelog

Sourced from @​graphql-tools/load's changelog.

8.1.17

Patch Changes

• #6660 12df2f5 Thanks @​eirikur-nc! - Load custom schema/document loaders with import() after createRequire, so ESM loader files and packages work with async load (including graphql-codegen). Closes #6656.

• #8370 1c1c5a0 Thanks @​ardatan! - Always include "Failed to find any GraphQL type definitions" context when loaders error, even if there is only one error. Fixes #7406.

• Updated dependencies [60db079, 57e316d, 1c1c5a0, 1c1c5a0, 0b9529f]:

  • @​graphql-tools/utils@​12.0.1
  • @​graphql-tools/schema@​10.1.1

8.1.16

Patch Changes

• Updated dependencies [2273c21]:
  • @​graphql-tools/schema@​10.1.0
  • @​graphql-tools/utils@​12.0.0

8.1.15

Patch Changes

• Updated dependencies [e90719b]:
  • @​graphql-tools/utils@​11.2.2
  • @​graphql-tools/schema@​10.0.38

8.1.14

Patch Changes

• Updated dependencies [615c1a2]:
  • @​graphql-tools/utils@​11.2.1
  • @​graphql-tools/schema@​10.0.37

8.1.13

Patch Changes

• Updated dependencies []:
  • @​graphql-tools/schema@​10.0.36

8.1.12

Patch Changes

• Updated dependencies

... (truncated)

Commits

• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 12df2f5 fix(load): support ESM custom loaders (#6660)
• 04e8159 fix(import): union interfaces, require: paths, comments, webpack esModule (#8...
• 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
• 1c1c5a0 fix: load errors, observable cleanup, descriptions, and import attributes (#8...
• 9feabd9 chore(release): update monorepo packages versions (#8327)
• 11f0a21 chore(release): update monorepo packages versions (#8303)
• 3c27f9a chore(release): update monorepo packages versions (#8284)
• 16096f7 build(deps): bump the actions-deps group across 1 directory with 23 updates (...
• 76b54da chore(release): update monorepo packages versions (#8264)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​graphql-tools/load since your current version.

Updates @graphql-tools/url-loader from 7.17.18 to 9.1.9

Changelog

Sourced from @​graphql-tools/url-loader's changelog.

9.1.9

Patch Changes

• #8426 3831a06 Thanks @​ardatan! - Security: Enable TLS certificate validation by default for legacy GraphQL WebSocket (graphql-ws protocol) connections over wss://.

  buildWSLegacyExecutor() previously hardcoded rejectUnauthorized: false, so Node.js clients accepted any certificate (including self-signed or attacker-controlled ones). Credentials in connectionParams / headers and subscription payloads could be exposed to a network MITM. This addresses GHSA-6fw5-9hq8-w87g (CWE-295).

  Corrected behavior

  • Default is now rejectUnauthorized: true (Node TLS verifies the peer certificate), matching secure-by-default expectations.
  • Connections to endpoints with untrusted/self-signed certificates will fail unless you opt out.

  Opt-out (trusted / local self-signed only)

  buildWSLegacyExecutor(url, WebSocket, {
    rejectUnauthorized: false,
    connectionParams: { /* ... */ },
  })

  Or via UrlLoader / LoadFromUrlOptions when subscriptionsProtocol is LEGACY_WS:

  {
    subscriptionsProtocol: SubscriptionProtocol.LEGACY_WS,
    rejectUnauthorized: false,
  }

  Browser WebSocket clients were never affected by this flag (browsers always validate certificates).

• Updated dependencies [3831a06]:

  • @​graphql-tools/executor-legacy-ws@​1.1.35

9.1.8

Patch Changes

• Updated dependencies [60db079, 57e316d, 1c1c5a0, 1c1c5a0, 0b9529f]:
  • @​graphql-tools/utils@​12.0.1
  • @​graphql-tools/executor-legacy-ws@​1.1.34

9.1.7

Patch Changes

• #8353 755d699 Thanks @​dependabot! - dependencies updates:
  • Updated dependency ws@^8.21.2 ↗︎ (from ^8.21.1,

... (truncated)

Commits

• 01167f3 chore(release): update monorepo packages versions (#8427)
• 3831a06 fix(executor-legacy-ws): enable TLS cert validation by default (GHSA-6fw5-9hq...
• 4efc4ef build(deps): bump the actions-deps group with 5 updates (#8424)
• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 5b8d428 build(deps-dev): bump the actions-deps group with 5 updates (#8416)
• b5d1c36 build(deps-dev): bump the actions-deps group across 1 directory with 4 update...
• c5d528a build(deps): bump the actions-deps group across 1 directory with 13 updates (...
• 2188f81 build(deps): bump the actions-deps group with 8 updates (#8393)
• 8121991 build(deps-dev): bump the actions-deps group with 2 updates (#8386)
• 3f98668 build(deps): bump the actions-deps group with 9 updates (#8380)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​graphql-tools/url-loader since your current version.

Updates apollo-server-express from 2.21.1 to 3.13.0

Commits

• f93284e Release
• ea2e2c3 Release
• fac578a Release
• 6247d96 Release
• 538151b Release
• 69be2f7 Merge pull request from GHSA-8r69-3cvp-wxc3
• f519e1d Release
• 985c079 Release
• 2bf7f66 chore(deps): update all non-major dependencies (main) (#6852)
• f6c5c9f Release
• Additional commits viewable in compare view

Updates graphql from 15.4.0 to 17.0.2

Release notes

Sourced from graphql's releases.

v17.0.2 (2026-07-03)

Bug Fix 🐞

• #4832 fix: detect default-value changes on input object fields (@​spokodev)

Polish 💅

• #4829 fix(mapSchemaConfig): fix context for schema argument mapper (@​yaacovCR)

Committers: 2

• null(@​spokodev)
• Yaacov Rydzinski (@​yaacovCR)

v17.0.1 (2026-06-16)

Bug Fix 🐞

• #4824 fix(diagnostics): emit asyncStart after promise settlement to match native tracePromise (@​logaretm)

Internal 🏠

• #4823 chore(npm): remove obsolete ESM-only package build (@​yaacovCR)
• #4825 chore(release): protect latest release channels (@​yaacovCR)

Committers: 2

• Abdelrahman Awad(@​logaretm)
• Yaacov Rydzinski (@​yaacovCR)

v17.0.0 (2026-06-15)

New Feature 🚀

• #4819 feat: graduate directives on directives (@​yaacovCR)

Bug Fix 🐞

• #4799 fix: raise request error on invalid fragment variables (@​yaacovCR)
• #4800 fix: apply directives when SDL contains type definitions and extensions with directives (@​yaacovCR)
• #4564 OneOf Inhabitability (@​jbellenger)
• #4814 fix(KnownDirectivesRule): locations for input field arguments in extensions (@​yaacovCR)
• #4726 feat(validation): reject directive definition cycles (@​yaacovCR)
• #4815 Revert "feat(validation): reject directive definition cycles (#4726)" (@​yaacovCR)

Docs 📝

• #4790 docs: minor diagnostics doc comment improvements (@​yaacovCR)
• #4791 fix: docs: polish diagnostics comments further (@​yaacovCR)
• #4793 docs: further improve general execution and tracing docs (@​yaacovCR)
• #4802 docs: correct extension field comments - v17 (@​yaacovCR)

... (truncated)

Commits

• 71606d7 chore(release): v17.0.2
• 101de34 fix: detect default-value changes on input object fields (#4832)
• 82da713 fix(mapSchemaConfig): fix context for schema argument mapper (#4829)
• 9617473 chore(release): v17.0.1
• 851bd6a chore(release): protect latest release channels (#4825)
• c471d36 fix(diagnostics): emit asyncStart after promise settlement to match native `t...
• 3f3895f chore(npm): remove obsolete ESM-only package build (#4823)
• c7e494a chore(release): v17.0.0
• d977f66 docs: post 17.rc-0 update (#4817)
• 39f865f docs: document @experimental_disableErrorPropagation (#4820)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for graphql since your current version.

Updates graphql-tag from 2.12.6 to 2.12.7

Release notes

Sourced from graphql-tag's releases.

v2.12.7

Patch Changes

• #823 bc285e5 Thanks @​phryneas! - add support for graphql 17

• #458 fd82f1c Thanks @​kidroca! - loader: allow a space between # and import word in gql files.

Changelog

Sourced from graphql-tag's changelog.

2.12.7

Patch Changes

• #823 bc285e5 Thanks @​phryneas! - add support for graphql 17

• #458 fd82f1c Thanks @​kidroca! - loader: allow a space between # and import word in gql files.

Commits

• 60464f3 ensure npm >= 11.15.0
• e9a2a55 adjust npm staged publishing shim
• 1d6ea01 Version Packages (#825)
• 2175303 add changesets for publishing (#824)
• bc285e5 add support for graphql 17 (#823)
• f463d87 Merge pull request #812 from apollographql/secops/202401/semgrep
• ca0fb16 feat: add semgrep job
• eeb670e Merge pull request #811 from apollographql/secops/202311/add-codeowners
• 27dbd7c add default CODEOWNERS
• f287273 Merge pull request #809 from apollographql/secops/add-gitleaks
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for graphql-tag since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Dependabot can't access a private package registry without explicit configuration. Because of this, Dependabot cannot update this pull request.