v1.43.2

🐛 Fixes

Security fix: update h2 dependency

References:

• https://rustsec.org/advisories/RUSTSEC-2024-0332
• https://seanmonstar.com/blog/hyper-http2-continuation-flood/
• https://www.kb.cert.org/vuls/id/421644

The router's performance could be degraded when receiving a flood of HTTP/2 CONTINUATION frames, when the Router is set up to terminate TLS for client connections.

By @Geal

v1.43.2-rc.0

1.43.2-rc.0

v1.43.1

🚀 Features

Logs can display trace and span IDs (PR #4823)

To enable correlation between traces and logs, trace_id and span_id can now be displayed in log messages.

For JSON logs, trace and span IDs are displayed by default:

{"timestamp":"2024-03-19T15:37:41.516453239Z","level":"INFO","trace_id":"54ac7e5f0e8ab90ae67b822e95ffcbb8","span_id":"9b3f88c602de0ceb","message":"Supergraph GraphQL response", ...}

For text logs, trace and span IDs aren't displayed by default:

2024-03-19T15:14:46.040435Z INFO trace_id: bbafc3f048b6137375dd78c10df18f50 span_id: 40ede28c5df1b5cc router{

To configure, set the display_span_id and display_trace_id options in the logging exporter configuration.

JSON (defaults to true):

telemetry:
  exporters:
    logging:
      stdout:
        format:
          json:
            display_span_id: true
            display_trace_id: true

Text (defaults to false):

telemetry:
  exporters:
    logging:
      stdout:
        format:
          text:
            display_span_id: false
            display_trace_id: false

By @BrynCooke in #4823

Count errors with apollo.router.graphql_error metrics (Issue #4749)

The router supports a new metric, apollo.router.graphql_error, that is a counter of GraphQL errors. It has a code attribute to differentiate counts of different error codes.

By @Geal in #4751

Expose operation signature to plugins (Issue #4558)

The router now exposes operation signatures to plugins with the context key apollo_operation_signature. The exposed operation signature is the string representation of the full signature.

By @Geal in #4864

Experimental logging of broken pipe errors (PR #4870)

The router can now emit a log message each time a client closes its connection early, which can help you debug issues with clients that close connections before the server can respond.

This feature is disabled by default but can be enabled by setting the experimental_log_broken_pipe option to true:

supergraph:
  experimental_log_on_broken_pipe: true

Note: users with internet-facing routers will likely not want to opt in to this log message, as they have no control over the clients.

By @Geal in #4770 and @BrynCooke in #4870

🐛 Fixes

Entity cache: fix support for Redis cluster (PR #4790)

In a Redis cluster, entities can be stored in different nodes, and a query to one node should only refer to the keys it manages. This is challenging for the Redis MGET operation, which requests multiple entities in the same request from the same node.

This fix splits the MGET query into multiple MGET calls, where the calls are grouped by key hash to ensure each one gets to the corresponding node, and then merges the responses in the correct order.

By @Geal in #4790

Give spans their proper parent in the plugin stack (Issue #4827)

Previously, spans in plugin stacks appeared incorrectly as siblings rather than being nested. This was problematic when displaying traces or accounting for time spent in Datadog.

This release fixes the issue, and plugin spans are now correctly nested within each other.

By @Geal in #4877

Fix(telemetry): keep consistency between tracing OTLP endpoint (Issue #4798)

Previously, when exporting tracing data using OTLP using only the base address of the OTLP endpoint, the router succeeded with gRPC but failed with HTTP due to this bug in opentelemetry-rust.

This release implements a workaround for the bug, where you must specify the correct HTTP path:

telemetry:
  exporters:
    tracing:
      otlp:
        enabled: true
        endpoint: "http://localhost:4318"
        protocol: http

By @bnjjj in #4801

Execute the entire request pipeline if the client closed the connection (Issue #4569), (Issue #4576), (Issue #4589), (Issue #4590), (Issue #4611)

The router now ensures that the entire request handling pipeline is executed when the client closes the connection early to allow telemetry, Rhai scripts, or coprocessors to complete their tasks before canceling.

Previously, when a client canceled a request, the entire execution was dropped, and parts of the router, including telemetry, couldn't run to completion. Now, the router executes up to the first response event (in the case of subscriptions or @defer usage), adds a 499 status code to the response, and skips the remaining subgraph requests.

Note that this change will report more requests to Studio and the configured telemetry, and it will appear like a sudden increase in errors because the failing requests were not previously reported.

You can keep the previous behavior of immediately dropping execution for canceled requests by setting the early_cancel option:

supergraph:
  early_cancel: true

By @Geal in #4770

null extensions incorrectly disallowed on request (Issue #4856)

Previously the router incorrectly rejected requests with null extensions, which are allowed according to the GraphQL over HTTP specification.

This issue has been fixed, and the router now allows requests with null extensions, like the following:

{
  "query": "{ topProducts { upc name reviews { id product { name } author { id name } } } }",
  "variables": {
    "date": "2022-01-01T00:00:00+00:00"
  },
  "extensions": null
}

By @BrynCooke in #4865

Fix external extensibility error log messages (PR #4869)

Previously, log messages for external extensibility errors from execution and supergraph responses were incorrectly logged as router responses. This issue has been fixed.

By @garypen in #4869

Remove invalid payload on graphql-ws Ping message (Issue #4852)

Previously, the router sent a string as a Ping payload, but that was incompatible with the graphql-ws specification, which specifies that the payload is optional and should be an object or null.

To ensure compatibility, the router now sends no payload for Ping messages.

By @IvanGoncharov in #4852

v1.43.1-rc.3

1.43.1-rc.3

v1.43.1-rc.1

1.43.1-rc.1

v1.43.1-rc.0

1.43.1-rc.0

1.20.1-alpha.0 nightly

v1.20.1-alpha.0

osx notarization tool update

v1.43.0

🚀 Features

Support configurable heartbeat for subscriptions using the WebSocket protocol (Issue #4621)

To support GraphQL Subscription WebSocket implementations such as DGS that drop idle connections by design, the router adds the ability to configure a heartbeat to keep active connections alive.

An example router configuration:

subscription:
  mode:
    passthrough:
      all:
        path: /graphql
        heartbeat_interval: enable # Optional

By @IvanGoncharov in #4802

Unix socket support for subgraphs (Issue #3504)

⚠️ This is an Enterprise feature of the Apollo Router. It requires an organization with a GraphOS Enterprise plan.

If your organization doesn't currently have an Enterprise plan, you can test out this functionality by signing up for a free Enterprise trial.

The router now supports Unix sockets for subgraph connections by specifying URLs in the unix:///path/to/router.sock format in the schema, in addition to coming a valid URL option within the existing override_subgraph_url configuration. The router uses Unix stream-oriented sockets (not datagram-oriented). It supports compression but not TLS.

Due to the lack of standardization of Unix socket URLs (and lack of support in the common URL types in Rust) a transformation is applied to to the socket path to parse it: the host is encoded in hexadecimal and stored in the authority part. This will have no consequence on the way the router functions, but subgraph services will receive URLs with the hex-encoded host.

By @Geal in #4757

Add an option to refresh expiration on Redis GET (Issue #4473)

This adds the option to refresh the time-to-live (TTL) on Redis entries when they are accessed. We want the query plan cache to act like an LRU cache (least-recently used), so if a TTL is set in its Redis configuration, it should reset every time it is accessed.

While the option is also available for APQ, it's disabled for entity caching because that cache manages TTL directly.

By @Geal in #4604

Helm: Support configuring ContainerResource on Horizontal Pod Autoscaler (HPA) targets (PR #4776)

The router supports configuration of the ContainerResource type metric on Horizontal Pod Autoscaler (HPA) targets in the Helm chart with Kubernetes v1.27 or later.

By @caugustus in #4776

🐛 Fixes

Fix chunk formatting in multipart protocol (Issue #4634)

Previously, when sending a stream of chunks for HTTP multipart, the router finished each chunk by appending it with \r\n.
Now, the router doesn't append \r\n to the current chunk but instead prepends it to the next chunk. This enables the router to close a stream with the correct final boundary by appending --\r\n directly to the last chunk.

This PR changes the way we're sending chunks in the stream. Instead of finishing the chunk with \r\n we don't send this at the end of our current chunk but instead at the beginning of the next one. For the end users nothing changes but it let us to close the stream with the right final boundary by appending --\r\n directly to the last chunk.

By @bnjjj in #4681

Zipkin service name not populated (Issue #4807)

The Zipkin trace exporter now respects service name configuration from YAML or environment variables.

For instance to set the service name to my-app, you can use the following configuration in your router.yaml file:

telemetry:
  exporters:
    tracing:
      common:
        service_name: my-app
      zipkin:
        enabled: true
        endpoint: default

By @BrynCooke in #4816

🛠 Maintenance

Preallocate response formatting output (PR #4775)

To improve runtime performance, an internal change to the router's format_response now preallocates the output object.

By @xuorig in #4775

v1.43.0-rc.1

1.43.0-rc.1

v1.43.0-rc.0

1.43.0-rc.0