Reconcile dev after merge to main for v1.43.2 (#4912)

Follow-up to the v1.43.2 being officially released, bringing version
bumps and changelog updates into the `dev` branch.

CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to Router will be documented in this file.
 
 This project adheres to [Semantic Versioning v2.0.0](https://semver.org/spec/v2.0.0.html).
 
+# [1.43.2] - 2024-04-03
+
+## 🐛 Fixes
+
+### Security fix: update h2 dependency
+
+References:
+- https://rustsec.org/advisories/RUSTSEC-2024-0332
+- https://seanmonstar.com/blog/hyper-http2-continuation-flood/
+- https://www.kb.cert.org/vuls/id/421644
+
+The router's performance could be degraded when receiving a flood of HTTP/2 CONTINUATION frames, when the Router is set up to terminate TLS for client connections.
+
+By [@geal](https://github.com/geal)
+
+
+
 # [1.43.1] - 2024-03-29
 
 ## 🚀 Features

Cargo.lock

@@ -250,7 +250,7 @@ dependencies = [
 
 [[package]]
 name = "apollo-router"
-version = "1.43.1"
+version = "1.43.2"
 dependencies = [
  "access-json",
  "anyhow",
@@ -410,7 +410,7 @@ dependencies = [
 
 [[package]]
 name = "apollo-router-benchmarks"
-version = "1.43.1"
+version = "1.43.2"
 dependencies = [
  "apollo-parser",
  "apollo-router",
@@ -426,7 +426,7 @@ dependencies = [
 
 [[package]]
 name = "apollo-router-scaffold"
-version = "1.43.1"
+version = "1.43.2"
 dependencies = [
  "anyhow",
  "cargo-scaffold",
@@ -3124,9 +3124,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.24"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
+checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
 dependencies = [
  "bytes",
  "fnv",
@@ -3422,7 +3422,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.5.5",
+ "socket2 0.4.9",
  "tokio",
  "tower-service",
  "tracing",

apollo-router-benchmarks/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "apollo-router-benchmarks"
-version = "1.43.1"
+version = "1.43.2"
 authors = ["Apollo Graph, Inc. <[email protected]>"]
 edition = "2021"
 license = "Elastic-2.0"

apollo-router-scaffold/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "apollo-router-scaffold"
-version = "1.43.1"
+version = "1.43.2"
 authors = ["Apollo Graph, Inc. <[email protected]>"]
 edition = "2021"
 license = "Elastic-2.0"

apollo-router-scaffold/templates/base/Cargo.toml

@@ -22,7 +22,7 @@ apollo-router = { path ="{{integration_test}}apollo-router" }
 apollo-router = { git="https://github.com/apollographql/router.git", branch="{{branch}}" }
 {{else}}
 # Note if you update these dependencies then also update xtask/Cargo.toml
-apollo-router = "1.43.1"
+apollo-router = "1.43.2"
 {{/if}}
 {{/if}}
 async-trait = "0.1.52"

apollo-router-scaffold/templates/base/xtask/Cargo.toml

@@ -13,7 +13,7 @@ apollo-router-scaffold = { path ="{{integration_test}}apollo-router-scaffold" }
 {{#if branch}}
 apollo-router-scaffold = { git="https://github.com/apollographql/router.git", branch="{{branch}}" }
 {{else}}
-apollo-router-scaffold = { git = "https://github.com/apollographql/router.git", tag = "v1.43.1" }
+apollo-router-scaffold = { git = "https://github.com/apollographql/router.git", tag = "v1.43.2" }
 {{/if}}
 {{/if}}
 anyhow = "1.0.58"

apollo-router/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "apollo-router"
-version = "1.43.1"
+version = "1.43.2"
 authors = ["Apollo Graph, Inc. <[email protected]>"]
 repository = "https://github.com/apollographql/router/"
 documentation = "https://docs.rs/apollo-router"

dockerfiles/tracing/docker-compose.datadog.yml

@@ -3,7 +3,7 @@ services:
 
   apollo-router:
     container_name: apollo-router
-    image: ghcr.io/apollographql/router:v1.43.1
+    image: ghcr.io/apollographql/router:v1.43.2
     volumes:
       - ./supergraph.graphql:/etc/config/supergraph.graphql
       - ./router/datadog.router.yaml:/etc/config/configuration.yaml

dockerfiles/tracing/docker-compose.jaeger.yml

@@ -4,7 +4,7 @@ services:
   apollo-router:
     container_name: apollo-router
     #build: ./router
-    image: ghcr.io/apollographql/router:v1.43.1
+    image: ghcr.io/apollographql/router:v1.43.2
     volumes:
       - ./supergraph.graphql:/etc/config/supergraph.graphql
       - ./router/jaeger.router.yaml:/etc/config/configuration.yaml

dockerfiles/tracing/docker-compose.zipkin.yml

@@ -4,7 +4,7 @@ services:
   apollo-router:
     container_name: apollo-router
     build: ./router
-    image: ghcr.io/apollographql/router:v1.43.1
+    image: ghcr.io/apollographql/router:v1.43.2
     volumes:
       - ./supergraph.graphql:/etc/config/supergraph.graphql
       - ./router/zipkin.router.yaml:/etc/config/configuration.yaml

helm/chart/router/Chart.yaml

@@ -20,10 +20,10 @@ type: application
 # so it matches the shape of our release process and release automation.
 # By proxy of that decision, this version uses SemVer 2.0.0, though the prefix
 # of "v" is not included.
-version: 1.43.1
+version: 1.43.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.43.1"
+appVersion: "v1.43.2"

helm/chart/router/README.md

@@ -2,7 +2,7 @@
 
 [router](https://github.com/apollographql/router) Rust Graph Routing runtime for Apollo Federation
 
-![Version: 1.43.1](https://img.shields.io/badge/Version-1.43.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.43.1](https://img.shields.io/badge/AppVersion-v1.43.1-informational?style=flat-square)
+![Version: 1.43.2](https://img.shields.io/badge/Version-1.43.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.43.2](https://img.shields.io/badge/AppVersion-v1.43.2-informational?style=flat-square)
 
 ## Prerequisites
 
@@ -11,15 +11,15 @@
 ## Get Repo Info
 
 ```console
-helm pull oci://ghcr.io/apollographql/helm-charts/router --version 1.43.1
+helm pull oci://ghcr.io/apollographql/helm-charts/router --version 1.43.2
 ```
 
 ## Install Chart
 
 **Important:** only helm3 is supported
 
 ```console
-helm upgrade --install [RELEASE_NAME] oci://ghcr.io/apollographql/helm-charts/router --version 1.43.1 --values my-values.yaml
+helm upgrade --install [RELEASE_NAME] oci://ghcr.io/apollographql/helm-charts/router --version 1.43.2 --values my-values.yaml
 ```
 
 _See [configuration](#configuration) below._
@@ -95,4 +95,4 @@ helm show values oci://ghcr.io/apollographql/helm-charts/router
 | virtualservice.enabled | bool | `false` |  |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
+Autogenerated from chart metadata using [helm-docs v1.13.1](https://github.com/norwoodj/helm-docs/releases/v1.13.1)

licenses.html

@@ -44,7 +44,7 @@ <h1>Third Party Licenses</h1>
 
         <h2>Overview of licenses:</h2>
         <ul class="licenses-overview">
-            <li><a href="#Apache-2.0">Apache License 2.0</a> (487)</li>
+            <li><a href="#Apache-2.0">Apache License 2.0</a> (489)</li>
             <li><a href="#MIT">MIT License</a> (155)</li>
             <li><a href="#BSD-3-Clause">BSD 3-Clause &quot;New&quot; or &quot;Revised&quot; License</a> (12)</li>
             <li><a href="#ISC">ISC License</a> (11)</li>
@@ -65,6 +65,7 @@ <h4>Used by:</h4>
                     <li><a href=" https://github.com/smithy-lang/smithy-rs ">aws-config</a></li>
                     <li><a href=" https://github.com/smithy-lang/smithy-rs ">aws-credential-types</a></li>
                     <li><a href=" https://github.com/smithy-lang/smithy-rs ">aws-runtime</a></li>
+                    <li><a href=" https://github.com/smithy-lang/smithy-rs ">aws-sigv4</a></li>
                     <li><a href=" https://github.com/smithy-lang/smithy-rs ">aws-smithy-async</a></li>
                     <li><a href=" https://github.com/smithy-lang/smithy-rs ">aws-smithy-http</a></li>
                     <li><a href=" https://github.com/smithy-lang/smithy-rs ">aws-smithy-json</a></li>
@@ -8149,6 +8150,7 @@ <h4>Used by:</h4>
                     <li><a href=" https://github.com/mitsuhiko/similar ">similar</a></li>
                     <li><a href=" https://github.com/servo/rust-smallvec ">smallvec</a></li>
                     <li><a href=" https://github.com/rust-lang/socket2 ">socket2</a></li>
+                    <li><a href=" https://github.com/rust-lang/socket2 ">socket2</a></li>
                     <li><a href=" https://github.com/storyyeller/stable_deref_trait ">stable_deref_trait</a></li>
                     <li><a href=" https://github.com/dtolnay/syn ">syn</a></li>
                     <li><a href=" https://github.com/dtolnay/syn ">syn</a></li>
@@ -11331,7 +11333,9 @@ <h4>Used by:</h4>
                 <h3 id="Apache-2.0">Apache License 2.0</h3>
                 <h4>Used by:</h4>
                 <ul class="license-used-by">
+                    <li><a href=" https://github.com/apollographql/apollo-rs ">apollo-compiler</a></li>
                     <li><a href=" https://github.com/apollographql/apollo-rs ">apollo-encoder</a></li>
+                    <li><a href=" https://github.com/apollographql/apollo-rs ">apollo-parser</a></li>
                     <li><a href=" https://github.com/apollographql/apollo-rs ">apollo-smith</a></li>
                 </ul>
                 <pre class="license-text">../../LICENSE-APACHE</pre>
@@ -11983,8 +11987,6 @@ <h4>Used by:</h4>
                 <h3 id="Apache-2.0">Apache License 2.0</h3>
                 <h4>Used by:</h4>
                 <ul class="license-used-by">
-                    <li><a href=" https://github.com/apollographql/apollo-rs ">apollo-compiler</a></li>
-                    <li><a href=" https://github.com/apollographql/apollo-rs ">apollo-parser</a></li>
                     <li><a href=" https://github.com/dalek-cryptography/curve25519-dalek ">curve25519-dalek-derive</a></li>
                     <li><a href=" https://github.com/bikeshedder/deadpool ">deadpool-runtime</a></li>
                     <li><a href=" https://github.com/nrc/proc-macro-rules ">deno-proc-macro-rules</a></li>
@@ -12959,111 +12961,6 @@ <h3 id="Elastic-2.0">Elastic License 2.0</h3>
                 <h4>Used by:</h4>
                 <ul class="license-used-by">
                     <li><a href=" https://github.com/apollographql/federation-next ">apollo-federation</a></li>
-                </ul>
-                <pre class="license-text">Copyright 2021 Apollo Graph, Inc.
-
-Source code in this repository is covered by (i) the Elastic License 2.0 or (ii) an MIT compatible license, in each case, as designated by a licensing file in a subdirectory or file header. The default throughout the repository is a license under the Elastic License 2.0, unless a file header or a licensing file in a subdirectory specifies another license.
-
---------------------------------------------------------------------------------
-
-Elastic License 2.0
-
-## Acceptance
-
-By using the software, you agree to all of the terms and conditions below.
-
-## Copyright License
-
-The licensor grants you a non-exclusive, royalty-free, worldwide,
-non-sublicensable, non-transferable license to use, copy, distribute, make
-available, and prepare derivative works of the software, in each case subject to
-the limitations and conditions below.
-
-## Limitations
-
-You may not provide the software to third parties as a hosted or managed
-service, where the service provides users with access to any substantial set of
-the features or functionality of the software.
-
-You may not move, change, disable, or circumvent the license key functionality
-in the software, and you may not remove or obscure any functionality in the
-software that is protected by the license key.
-
-You may not alter, remove, or obscure any licensing, copyright, or other notices
-of the licensor in the software. Any use of the licensor’s trademarks is subject
-to applicable law.
-
-## Patents
-
-The licensor grants you a license, under any patent claims the licensor can
-license, or becomes able to license, to make, have made, use, sell, offer for
-sale, import and have imported the software, in each case subject to the
-limitations and conditions in this license. This license does not cover any
-patent claims that you cause to be infringed by modifications or additions to
-the software. If you or your company make any written claim that the software
-infringes or contributes to infringement of any patent, your patent license for
-the software granted under these terms ends immediately. If your company makes
-such a claim, your patent license ends immediately for work on behalf of your
-company.
-
-## Notices
-
-You must ensure that anyone who gets a copy of any part of the software from you
-also gets a copy of these terms.
-
-If you modify the software, you must include in any modified copies of the
-software prominent notices stating that you have modified the software.
-
-## No Other Rights
-
-These terms do not imply any licenses other than those expressly granted in
-these terms.
-
-## Termination
-
-If you use the software in violation of these terms, such use is not licensed,
-and your licenses will automatically terminate. If the licensor provides you
-with a notice of your violation, and you cease all violation of this license no
-later than 30 days after you receive that notice, your licenses will be
-reinstated retroactively. However, if you violate these terms after such
-reinstatement, any additional violation of these terms will cause your licenses
-to terminate automatically and permanently.
-
-## No Liability
-
-*As far as the law allows, the software comes as is, without any warranty or
-condition, and the licensor will not be liable to you for any damages arising
-out of these terms or the use or nature of the software, under any kind of
-legal claim.*
-
-## Definitions
-
-The **licensor** is the entity offering these terms, and the **software** is the
-software the licensor makes available under these terms, including any portion
-of it.
-
-**you** refers to the individual or entity agreeing to these terms.
-
-**your company** is any legal entity, sole proprietorship, or other kind of
-organization that you work for, plus all organizations that have control over,
-are under the control of, or are under common control with that
-organization. **control** means ownership of substantially all the assets of an
-entity, or the power to direct its management and policies by vote, contract, or
-otherwise. Control can be direct or indirect.
-
-**your licenses** are all the licenses granted to you for the software under
-these terms.
-
-**use** means anything you do with the software requiring one of your licenses.
-
-**trademark** means trademarks, service marks, and similar rights.
-
---------------------------------------------------------------------------------</pre>
-            </li>
-            <li class="license">
-                <h3 id="Elastic-2.0">Elastic License 2.0</h3>
-                <h4>Used by:</h4>
-                <ul class="license-used-by">
                     <li><a href=" https://github.com/apollographql/federation/ ">router-bridge</a></li>
                 </ul>
                 <pre class="license-text">Elastic License 2.0

scripts/install.sh

@@ -11,7 +11,7 @@ BINARY_DOWNLOAD_PREFIX="https://github.com/apollographql/router/releases/downloa
 
 # Router version defined in apollo-router's Cargo.toml
 # Note: Change this line manually during the release steps.
-PACKAGE_VERSION="v1.43.1"
+PACKAGE_VERSION="v1.43.2"
 
 download_binary() {
     downloader --check