chore(deps): update all apollo server non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@apollo/server (source)	5.0.0 → 5.4.0
@types/node (source)	20.19.8 → 20.19.37
@types/node (source)	18.6.3 → 18.19.130
apollo-server (source)	3.12.0 → 3.13.0
apollo-server (source)	2.26.1 → 2.26.2
graphql	16.11.0 → 16.13.1
graphql	16.8.1 → 16.13.1
graphql	15.8.0 → 15.10.1
graphql	15.5.1 → 15.10.1
nodemon (source)	2.0.12 → 2.0.22
typescript (source)	5.8.3 → 5.9.3
typescript (source)	4.7.4 → 4.9.5

---

Release Notes

apollographql/apollo-server (@​apollo/server)

v5.4.0

Compare Source

Minor Changes

• d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
  Any other character set will be rejected with a 415 Unsupported Media Type error.
  Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8.
  Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now.
  In a future major release, we may tighten this restriction further to only allow UTF-8.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
  For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

v5.3.0

Compare Source

Minor Changes

• #​8062 8e54e58 Thanks @​cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

  const server = new ApolloServer({
    typeDefs,
    resolvers,
    executionOptions: {
      maxCoercionErrors: 50,
    },
  });

• #​8014 26320bc Thanks @​mo4islona! - Expose graphql validation options.

  const server = new ApolloServer({
    typeDefs,
    resolvers,
    validationOptions: {
      maxErrors: 10,
    },
  });

v5.2.0

Compare Source

Minor Changes

• #​8161 51acbeb Thanks @​jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.

  import { legacyExecuteIncrementally } from '@​yaacovcr/transform';
  
  const server = new ApolloServer({
    // ...
    legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
  });

  If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

v5.1.0

Compare Source

Minor Changes

• #​8148 80a1a1a Thanks @​jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with graphql@17.0.0-alpha.9. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.

  Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.

apollographql/apollo-server (apollo-server)

v3.13.0

Compare Source

v3.12.1

Compare Source

graphql/graphql-js (graphql)

v16.13.1

Compare Source

v16.13.1 (2026-03-04)

Docs 📝

• #​4433 docs: move
  migrate from express graphql guide to graphqlJS docs
  (@​sarahxsanders)

Internal 🏠

• #​4608 internal:
  backport new release flow from 17.x.x
  (@​yaacovCR)

Committers: 2

• Sarah Sanders(@​sarahxsanders)
• Yaacov Rydzinski (@​yaacovCR)

v16.13.0

Compare Source

v16.12.0: 16.12.0

Compare Source

v16.12.0 (2025-11-01)

New Feature 🚀

• #​4482 Implement changes for executable descriptions (@​JoviDeCroock)
• #​4493 Backport schema coordinates (@​JoviDeCroock)

Bug Fix 🐞

• #​4392 Catch unhandled exception in abstract resolution (@​JoviDeCroock)

Docs 📝

28 PRs were merged

• #​4374 docs: testing graphQL servers (@​sarahxsanders)
• #​4376 docs: type generation for graphql servers (@​sarahxsanders)
• #​4380 docs: add guides for custom scalars (@​sarahxsanders)
• #​4381 docs: anatomy of a resolver (@​sarahxsanders)
• #​4382 docs: understanding graphql errors (@​sarahxsanders)
• #​4383 docs: N+1 problem and DataLoader (@​sarahxsanders)
• #​4391 docs: cursor-based pagination guide (@​sarahxsanders)
• #​4393 docs: add page on abstract types (@​sarahxsanders)
• #​4394 docs: editorial on abstract types page (@​benjie)
• #​4395 docs: editorial for recent documentation updates (@​benjie)
• #​4396 docs: add page on authorization strategies (@​sarahxsanders)
• #​4398 docs: update "going to production" guide (@​sarahxsanders)
• #​4399 Update mutations-and-input-types.mdx (@​roman-lakhnov)
• #​4400 Remove CJS from docs (@​JoviDeCroock)
• #​4401 docs: add guide on directives (@​sarahxsanders)
• #​4402 docs: add guide for operation complexity controls (@​sarahxsanders)
• #​4405 docs: add guide on nullability (@​sarahxsanders)
• #​4406 docs: add guide on subscriptions (@​sarahxsanders)
• #​4411 docs: add guide on caching strategies (@​sarahxsanders)
• #​4414 docs: guide on scaling your API (@​sarahxsanders)
• #​4416 Editorial for #​4405 (nullability) (@​benjie)
• #​4417 Indicate that field arguments should always be preferred over directives (@​benjie)
• #​4418 docs: trusted documents (@​benjie)
• #​4419 docs: cleanup and fixes (@​sarahxsanders)
• #​4436 Suggestions for federation links (@​Urigo)
• #​4444 Fix navigation (@​JoviDeCroock)
• #​4452 fix(docs/mutations-and-input-types.mdx): root being inside of SDL (@​alesculek)
• #​4473 docs: remove fourth permutation of the visit API (@​janmeier)

Polish 💅

• #​4453 Remove oneof validation from values of correct type (@​JoviDeCroock)

Internal 🏠

3 PRs were merged

• #​4390 Add the version support policy (@​benjie)
• #​4412 internal: use empty merge commit to clean up git diff from 16.x.x (@​yaacovCR)
• #​4479 updated location of ModelSim gitignore file (@​magicmark)

Committers: 9

• Aleš Culek(@​alesculek)
• Benjie(@​benjie)
• Jan Aagaard Meier(@​janmeier)
• Jovi De Croock(@​JoviDeCroock)
• Mark Larah(@​magicmark)
• null(@​roman-lakhnov)
• Sarah Sanders(@​sarahxsanders)
• Uri Goldshtein(@​Urigo)
• Yaacov Rydzinski (@​yaacovCR)

remy/nodemon (nodemon)

v2.0.22

Compare Source

Bug Fixes

• remove ts mapping if loader present (f7816e4), closes #​2083

v2.0.21

Compare Source

Bug Fixes

• remove ts mapping if loader present (1468397), closes #​2083

v2.0.20

Compare Source

Bug Fixes

• remove postinstall script (e099e91)

v2.0.19

Compare Source

Bug Fixes

• Replace update notifier with simplified deps (#​2033) (176c4a6), closes #​1961 #​2028

v2.0.18

Compare Source

Bug Fixes

• revert update-notifier forcing esm (1b3bc8c)

v2.0.17

Compare Source

Bug Fixes

• bump update-notifier to v6.0.0 (#​2029) (0144e4f)
• update packge-lock (27e91c3)

v2.0.16

Compare Source

Bug Fixes

• support windows by using path.delimiter (e26aaa9)

v2.0.15

Compare Source

Bug Fixes

• bump prod dep versions (54784ab)

v2.0.14

Compare Source

Bug Fixes

• add windows signals SIGUSR2 & SIGUSR1 to terminate the process (#​1938) (61e7abd), closes #​1903 #​1915 #​1936 #​1937 #​1882 #​1893

v2.0.13

Compare Source

Bug Fixes

• bump update-notifier (90e7a3e), closes #​1919
• release process on main (9f82a48)

microsoft/TypeScript (typescript)

v5.9.3: TypeScript 5.9.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

• fixed issues query for Typescript 5.9.0 (Beta).
• fixed issues query for Typescript 5.9.1 (RC).
• No specific changes for TypeScript 5.9.2 (Stable)
• fixed issues query for Typescript 5.9.3 (Stable).

Downloads are available on:

• npm

v5.9.2: TypeScript 5.9

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

• fixed issues query for Typescript 5.9.0 (Beta).
• fixed issues query for Typescript 5.9.1 (RC).
• No specific changes for TypeScript 5.9.2 (Stable)

Downloads are available on:

• npm

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.