Bump @apollo/server from 4.12.0 to 4.13.0

[dependabot]

Bumps @apollo/server from 4.12.0 to 4.13.0.

Release notes

Sourced from @​apollo/server's releases.

@​apollo/server-integration-testsuite@​4.13.0

Patch Changes

• Updated dependencies [e9d49d1]:
  • @​apollo/server@​4.13.0

@​apollo/server@​4.13.0

Minor Changes

• #8180 e9d49d1 Thanks @​github-actions! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Additionally, upstream libraries used by this version of Apollo Server may not support all of these encodings, so some requests may still fail even if they pass this check.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

  Also please note that Apollo Server 4.x is considered EOL as of January 26, 2026, and Apollo no longer commits to providing support or updates for it. Please prioritize migrating to Apollo Server 5.x for continued support and updates.

@​apollo/server-integration-testsuite@​4.12.2

Patch Changes

• #8070 0dee3c9 Thanks @​glasser! - Provide dual-build CJS and ESM for @apollo/server-integration-testsuite.

  We previously provided only a CJS build of this package, unlike @apollo/server itself and the other helper packages that come with it. We may make all of Apollo Server ESM-only in AS5; this is a step in that direction. Specifically, only providing this package for CJS makes it challenging to run the tests in ts-jest in some ESM-only setups, because the copy of @apollo/server fetched directly in your ESM-based test may differ from the copy fetched indirectly via @apollo/server-integration-testsuite, causing the "lockstep versioning" test to fail.

• Updated dependencies:

  • @​apollo/server@​4.12.2

@​apollo/server@​4.12.2

(No change; there is a change to the @apollo/server-integration-testsuite used to test integrations, and the two packages always have matching versions.)

@​apollo/server-integration-testsuite@​4.12.2-alpha.0

Patch Changes

• #8070 0dee3c9 Thanks @​glasser! - Provide dual-build CJS and ESM for @apollo/server-integration-testsuite.

  We previously provided only a CJS build of this package, unlike @apollo/server

... (truncated)

Changelog

Sourced from @​apollo/server's changelog.

4.13.0

Minor Changes

• #8180 e9d49d1 Thanks @​github-actions! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Additionally, upstream libraries used by this version of Apollo Server may not support all of these encodings, so some requests may still fail even if they pass this check.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server. For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

  Also please note that Apollo Server 4.x is considered EOL as of January 26, 2026, and Apollo no longer commits to providing support or updates for it. Please prioritize migrating to Apollo Server 5.x for continued support and updates.

4.12.2

(No change; there is a change to the @apollo/server-integration-testsuite used to test integrations, and the two packages always have matching versions.)

4.12.1

Patch Changes

• #8064 41f98d4 Thanks @​glasser! - Update README.md to recommend Express v5 integration now that Express v5 is released.

Commits

• d2f6f9f Version Packages (#8180)
• e4249bd adjust for error message in old node versions
• e9d49d1 Merge commit from fork
• 492a7b4 Version Packages (#8072)
• b477de2 Version Packages (alpha) (#8071)
• 079a973 Version Packages (#8065)
• 41f98d4 docs: support Express v5, recommend new separate Express packages (#8064)
• 047357a Switch from Volta to Mise for installing dependencies (#8058)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.