Merge remote-tracking branch 'origin/master' into release-3.0

Author: abernix

CHANGELOG.md

@@ -5,11 +5,11 @@ The version headers in this history reflect the versions of Apollo Server itself
 - [__CHANGELOG for `@apollo/gateway`__](https://github.com/apollographql/apollo-server/blob/master/packages/apollo-gateway/CHANGELOG.md)
 - [__CHANGELOG for `@apollo/federation`__](https://github.com/apollographql/apollo-server/blob/master/packages/apollo-federation/CHANGELOG.md)
 
-### vNEXT
+### v2.14.2
 
-> The changes noted within this `vNEXT` section have not been released yet.  New PRs and commits which introduce changes should include an entry in this `vNEXT` section as part of their development.  When a release is being prepared, a new header will be (manually) created below and the appropriate changes within that release will be moved into the new section.
+> **Note:** This release is is related to a GitHub Security Advisory published by the Apollo Server team.  Please read the attached advisory to understand the impact.
 
-- _Nothing yet! Stay tuned!_
+- ⚠️ **SECURITY:** Pass all schema validation rules to the subscription server, including validation rules that restrict introspection when introspection is meant to be disabled. **[Read the full GitHub Security Advisory for details](https://github.com/apollographql/apollo-server/security/advisories/GHSA-w42g-7vfc-xf37)**.
 
 ### v2.14.1
 

docs/package-lock.json

@@ -6,7 +6,7 @@
     "serve": "gatsby serve"
   },
   "dependencies": {
-    "gatsby": "2.22.9",
+    "gatsby": "2.23.1",
     "gatsby-theme-apollo-docs": "4.2.3",
     "react": "16.13.1",
     "react-dom": "16.13.1"

docs/package.json

@@ -140,7 +140,7 @@ new ApolloServer({
 
 * `engine`: <`EngineReportingOptions`> | boolean
 
-  Provided the `ENGINE_API_KEY` environment variable is set, the Graph Manager reporting agent will be started automatically. The API key can also be provided as the `apiKey` field in an object passed as the `engine` field. See the [EngineReportingOptions](#enginereportingoptions) section for a full description of how to configure the reporting agent, including how to include variable values and HTTP headers. When using the Engine proxy, this option should be set to `false`.
+  If the `APOLLO_KEY` environment variable is set, the Graph Manager reporting agent starts automatically. The API key can also be provided as the `apiKey` field in an object passed as the `engine` field. See [EngineReportingOptions](#enginereportingoptions) for a full description of how to configure the reporting agent, including how to include variable values and HTTP headers.
 
 * `persistedQueries`: <`Object`> | false
 
@@ -340,7 +340,7 @@ addMockFunctionsToSchema({
 
   API key for the service. Obtain an API key from
   [Graph Manager](https://engine.apollographql.com) by logging in and creating
-  a service. You can also specify an API key with the `ENGINE_API_KEY`
+  a service. You can also specify an API key with the `APOLLO_KEY`
   environment variable, although the `apiKey` option takes precedence.
 
 * `logger`: `Logger`

docs/source/api/apollo-server.md

@@ -68,9 +68,9 @@ Then, on the app detail page, there is a tab bar at the top, with a "Deploy" opt
 
 ## Configuring environment variables
 
-To enable the production mode of Apollo Server, you need to set the `NODE_ENV` variable to `production`. To ensure you have visibility into your GraphQL performance in Apollo Server, you'll want to add the `ENGINE_API_KEY` environment variable to Heroku. For the API key, log in to the [Graph Manager UI](https://engine.apollographql.com) and navigate to your service or create a new one.
+To enable the production mode of Apollo Server, you need to set the `NODE_ENV` variable to `production`. To ensure you have visibility into your GraphQL performance in Apollo Server, you'll want to add the `APOLLO_KEY` environment variable to Heroku. For the API key, log in to the [Graph Manager UI](https://engine.apollographql.com) and navigate to your service or create a new one.
 
-Under the “Settings” tab, click **Reveal Config Vars**. Next, set `NODE_ENV` to `production` and copy your key from the [Graph Manager UI](http://engine.apollographql.com/) as the value for `ENGINE_API_KEY`.
+Under the Settings tab, click **Reveal Config Vars**. Next, set `NODE_ENV` to `production` and copy your graph API key from the [Graph Manager UI](http://engine.apollographql.com/) as the value for `APOLLO_KEY`.
 
 ![Add Graph Manager API Key Screenshot](../images/deployment/heroku/add-env-vars.png)
 

docs/source/deployment/heroku.md

@@ -73,7 +73,7 @@ After signing in with GitHub, the [Now](https://zeit.co/now) GitHub app can be a
 The `graphql-server-example` project requires environment variables to enable reporting to Apollo Graph Manager. To deploy to Now with environment variables, the `-e` flag can be used followed by the variables like so:
 
 ```shell
-$ now -e ENGINE_API_KEY=xxxxxxxxx apollographql/graphql-server-example
+$ now -e APOLLO_KEY=xxxxxxxxx apollographql/graphql-server-example
 ```
 
 ![Deployed GraphQL Server](../images/deployment/zeit/zeit-apollo-server.png)

docs/source/deployment/now.md

@@ -16,7 +16,7 @@ The model of federated metrics is that implementing services report timing and e
 
 ## Turning it on
 
-Ensure that all dependencies on `apollo-server` are at version `2.7.0` or higher. Provide an API key to your gateway via the `ENGINE_API_KEY` environment variable for the gateway to report metrics to the default ingress. To ensure that implementing services do not report metrics as well, do not provide them with an `ENGINE_API_KEY` or set `{ engine: false }` in the constructor options to `ApolloServer`.
+Ensure that all dependencies on `apollo-server` are at version `2.7.0` or higher. Provide an API key to your gateway via the `APOLLO_KEY` environment variable for the gateway to report metrics to the default ingress. To ensure that implementing services do not report metrics as well, do not provide them with an `APOLLO_KEY` or set `{ engine: false }` in the constructor options to `ApolloServer`.
 
 These options will cause the Apollo gateway to collect tracing information from the underlying federated services and pass them on, along with the query plan, to the Apollo metrics ingress. Currently, only Apollo Server supports detailed metrics insights as an implementing service, but we would love to work with you to implement the protocol in other languages!
 

docs/source/federation/metrics.md

@@ -86,7 +86,7 @@ After you've registered your schemas, you can start exposing your implementing s
 
 We recommend setting up the Apollo Server gateway _alongside_ your existing schema-stitching gateway. Depending on your infrastructure, you might even want to run both in the same _process_ to support dynamically routing traffic through one gateway or the other.
 
-To enable managed configuration through Apollo Graph Manager, set the `ENGINE_API_KEY` and `ENGINE_SCHEMA_TAG` environment variables when you start up your Apollo Server gateway, and **do not provide the `serviceList` constructor option to `ApolloGateway`**. For details, see the [Graph Manager documentation](https://www.apollographql.com/docs/graph-manager/federation/#connecting-apollo-server-to-the-graph-manager).
+To enable managed configuration through Apollo Graph Manager, set the `APOLLO_KEY` and `APOLLO_GRAPH_VARIANT` environment variables when you start up your Apollo Server gateway, and **do not provide the `serviceList` constructor option to `ApolloGateway`**. For details, see the [Graph Manager documentation](https://www.apollographql.com/docs/graph-manager/federation/#connecting-apollo-server-to-the-graph-manager).
 
 After your gateway is set up, you can make direct queries to it that are routed to the correct implementing services.
 

docs/source/federation/migrating-from-stitching.md

@@ -7,7 +7,7 @@ Apollo Server provides reporting, persisted queries, and cache-control headers i
 
 ## Stand-alone Apollo Server
 
-Apollo Server 2 is able to replace all the metrics-reporting functionality which once required the Apollo Engine Proxy. To enable metrics reporting in Apollo Server 2, add `ENGINE_API_KEY` as an environment variable.  With this setting enabled, Apollo Server 2 will automatically send execution traces directly to Apollo Graph Manager. In addition, by default, Apollo Server supports [persisted queries](https://www.apollographql.com/docs/guides/performance/#automatic-persisted-queried) without needing the proxy's cache. Apollo Server also sets `Cache-Control` headers for consumption by a CDN.  Integrating a CDN provides an alternative to the full response caching inside of Engine proxy.
+Apollo Server 2 is able to replace all the metrics-reporting functionality which once required the Apollo Engine Proxy. To enable metrics reporting in Apollo Server 2, add `APOLLO_KEY` as an environment variable.  With this setting enabled, Apollo Server 2 will automatically send execution traces directly to Apollo Graph Manager. In addition, by default, Apollo Server supports [persisted queries](https://www.apollographql.com/docs/guides/performance/#automatic-persisted-queried) without needing the proxy's cache. Apollo Server also sets `Cache-Control` headers for consumption by a CDN.  Integrating a CDN provides an alternative to the full response caching inside of Engine proxy.
 
 ```js
 const { ApolloServer } = require('apollo-server');
@@ -26,7 +26,7 @@ server.listen().then(({ url }) => {
 
 ## Starting Engine Proxy
 
-Some infrastructure already contains the Engine proxy and requires it for full response caching, so it is necessary to run the proxy as a process alongside Apollo Server. If full response caching is not necessary, then the Engine proxy can be completely replaced by Apollo Server 2. The `apollo-engine` package provides integrations with many [node frameworks](https://www.apollographql.com/docs/engine/setup-node/#not-express), including [express](https://www.apollographql.com/docs/engine/setup-node/#setup-guide), and starts the Engine proxy alongside Apollo Server. The following code demonstrates how to start the proxy with Apollo Server 2. It assumes that the `ENGINE_API_KEY` environment variable is set to the api key of the service.
+Some infrastructure already contains the Engine proxy and requires it for full response caching, so it is necessary to run the proxy as a process alongside Apollo Server. If full response caching is not necessary, then the Engine proxy can be completely replaced by Apollo Server 2. The `apollo-engine` package provides integrations with many [node frameworks](https://www.apollographql.com/docs/engine/setup-node/#not-express), including [express](https://www.apollographql.com/docs/engine/setup-node/#setup-guide), and starts the Engine proxy alongside Apollo Server. The following code demonstrates how to start the proxy with Apollo Server 2. It assumes that the `APOLLO_KEY` environment variable is set to the api key of the service.
 
 ```js
 const { ApolloEngine } = require('apollo-engine');
@@ -46,7 +46,7 @@ const server = new ApolloServer({
 server.applyMiddleware({ app });
 
 const engine = new ApolloEngine({
-  apiKey: process.env.ENGINE_API_KEY,
+  apiKey: process.env.APOLLO_KEY,
 });
 
 engine.listen({

docs/source/migration-engine.md

@@ -13,10 +13,7 @@ Apollo Server integrates seamlessly with Apollo Graph Manager to help you monito
 
 ### Connecting to Graph Manager
 
-To connect Apollo Server to Graph Manager, first [visit the Graph Manager UI](https://engine.apollographql.com/) to get a Graph Manager API key. You can provide this API key to Apollo Server in one of the following ways:
-
-* Include the API key in the constructor options for `ApolloServer`.
-* Assign the API key to the `ENGINE_API_KEY` environment variable.
+To connect Apollo Server to Graph Manager, first [obtain a graph API key](https://www.apollographql.com/docs/graph-manager/setup-analytics/#pushing-traces-from-apollo-server). To provide this key to Apollo Server, assign it to the `APOLLO_KEY` environment variable in your server's environment.
 
 ### Providing an API key via the `ApolloServer` constructor
 
@@ -47,14 +44,14 @@ server.listen().then(({ url }) => {
 
 ### Providing an API key via environment variables
 
-You can provide your Graph Manager API key to Apollo Server via the `ENGINE_API_KEY` environment variable. Similarly, you can assign a particular [variant](https://www.apollographql.com/docs/platform/schema-registry/#managing-environments)
-to an Apollo Server instance via the `ENGINE_SCHEMA_TAG` environment variable.
+You can provide your Graph Manager API key to Apollo Server via the `APOLLO_KEY` environment variable. Similarly, you can assign a particular [variant](https://www.apollographql.com/docs/platform/schema-registry/#managing-environments)
+to an Apollo Server instance via the `APOLLO_GRAPH_VARIANT` environment variable.
 
 You can set environment variable values on the command line as seen below, or with the [`dotenv` npm package](https://www.npmjs.com/package/dotenv) (or similar).
 
 ```bash
 # Replace the example values below with values specific to your use case.
-ENGINE_API_KEY=YOUR_API_KEY ENGINE_SCHEMA_TAG=development node start-server.js
+APOLLO_KEY=YOUR_API_KEY APOLLO_GRAPH_VARIANT=development node start-server.js
 ```
 
 ### Debugging Graph Manager reporting

docs/source/monitoring/metrics.md

@@ -9,7 +9,7 @@ Before learning how to implement schema directives, [this section](/schema/direc
 
 Since the GraphQL specification does not discuss any specific implementation strategy for directives, it's up to each GraphQL server framework to expose an API for implementing new directives.
 
-If you're using Apollo Server, you are using the [`graphql-tools`](https://github.com/apollographql/graphql-tools) npm package, which provides a convenient yet powerful tool for implementing directive syntax: the [`SchemaDirectiveVisitor`](https://github.com/apollographql/graphql-tools/blob/wip-schema-directives/src/schemaVisitor.ts) class.
+If you're using Apollo Server, you are using the [`graphql-tools`](https://github.com/apollographql/graphql-tools) npm package, which provides a convenient yet powerful tool for implementing directive syntax: the [`SchemaDirectiveVisitor`](https://github.com/ardatan/graphql-tools/blob/master/packages/utils/src/SchemaDirectiveVisitor.ts) class.
 
 To implement a schema directive using `SchemaDirectiveVisitor`, simply create a subclass of `SchemaDirectiveVisitor` that overrides one or more of the following visitor methods: