release: v1.31.0

.changesets/docs_garypen_fix_rhai_subgraph_docs.md

@@ -0,0 +1,5 @@
+### Rhai documentation: remove incorrect statement about request.subgraph fields ([PR #3808](https://github.com/apollographql/router/pull/3808))
+
+It is possible to modify `request.subgraph` fields from a `Rhai` script and so the documentation should reflect that.
+
+By [@garypen](https://github.com/garypen) in https://github.com/apollographql/router/pull/3808

.changesets/feat_bnjjj_fix_3621.md

@@ -0,0 +1,15 @@
+### feat(redis): add configuration to set the timeout ([Issue #3621](https://github.com/apollographql/router/issues/3621))
+
+It adds a configuration to set another timeout than the default one (2ms) for redis requests. It also change the default timeout to 2ms (previously set to 1ms)
+
+Example for APQ:
+```yaml
+apq:
+  router:
+    cache:
+      redis:
+        urls: ["redis://..."] 
+        timeout: 5ms
+```
+
+By [@bnjjj](https://github.com/bnjjj) in https://github.com/apollographql/router/pull/3817

.changesets/feat_bnjjj_fix_3767.md

@@ -0,0 +1,42 @@
+### feat(telemetry): add metrics for query plan warmup and schema load ([Issue #3767](https://github.com/apollographql/router/issues/3767))
+
+It adds histogram metrics for `apollo_router_query_planning_warmup_duration` and `apollo_router_schema_load_duration`.
+
+Example in Prometheus:
+
+```
+# HELP apollo_router_query_planning_warmup_duration apollo_router_query_planning_warmup_duration
+# TYPE apollo_router_query_planning_warmup_duration histogram
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="0.05"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="0.1"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="0.25"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="0.5"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="1"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="2.5"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="5"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="10"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="20"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="100"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="1000"} 1
+apollo_router_query_planning_warmup_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="+Inf"} 1
+apollo_router_query_planning_warmup_duration_sum{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version=""} 0.022390619
+apollo_router_query_planning_warmup_duration_count{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version=""} 1
+# HELP apollo_router_schema_load_duration apollo_router_schema_load_duration
+# TYPE apollo_router_schema_load_duration histogram
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="0.05"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="0.1"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="0.25"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="0.5"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="1"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="2.5"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="5"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="10"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="20"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="100"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="1000"} 8
+apollo_router_schema_load_duration_bucket{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version="",le="+Inf"} 8
+apollo_router_schema_load_duration_sum{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version=""} 0.023486205999999996
+apollo_router_schema_load_duration_count{service_name="apollo-router",otel_scope_name="apollo/router",otel_scope_version=""} 8
+```
+
+By [@bnjjj](https://github.com/bnjjj) in https://github.com/apollographql/router/pull/3807

.changesets/feat_garypen_one_shot_async_check.md

@@ -0,0 +1,11 @@
+### Introduce OneShotAsyncCheckpoint ([PR #3819](https://github.com/apollographql/router/pull/3819))
+
+The existing AsynCheckpoint requires `Clone` and thus introduces a need for Service Buffering which reduces the performance and resiliance of the router.
+
+This new set of Services, Layers and utility functions removes the requirement for `Clone` and thus the requirement for service buffering.
+
+Existing uses of AsyncCheckpoint within the router are replaced with OneShotAsyncCheckpoint along with the requirement to `buffer()` such services.
+
+If you have a custom plugin that makes use of `AsyncCheckpoint`, we encourage you to migrate to `OneShotAsyncCheckpoint` and thus reduce the requirement for service buffering from your router.
+
+By [@garypen](https://github.com/garypen) in https://github.com/apollographql/router/pull/3819

.changesets/feat_geal_h2c.md

@@ -0,0 +1,5 @@
+### HTTP/2 Cleartext protocol (h2c) support for subgraph connections ([Issue #3535](https://github.com/apollographql/router/issues/3535))
+
+The router can now connect to subgraphs over HTTP/2 Cleartext, which uses the HTTP/2 binary protocol directly over TCP without TLS. To activate it, set the `experimental_http2` option to `http2_only`.
+
+By [@Geal](https://github.com/Geal) in https://github.com/apollographql/router/pull/3852

.changesets/feat_geal_plan_cache_warmup_doc.md

@@ -0,0 +1,13 @@
+### Query plan cache warm-up improvements ([Issue #3704](https://github.com/apollographql/router/issues/3704))
+
+The `warm_up_queries` option enables quicker schema updates by precomputing query plans for your most used cached queries and your persisted queries. When a new schema is loaded, a precomputed query plan for it may already be in in-memory cache.
+
+We made a series of improvements to this feature to make it more usable:
+* It is now active by default and warms up the cache with the 30% most used queries of the previous cache. The amount is still configurable, and it can be deactivated by setting it to 0.
+* We added new metrics to track the time spent loading a new schema and planning queries in the warm-up phase. You can also measure the query plan cache usage, to know how many entries are used, and the cache hit rate, both for the in memory cache and the distributed cache.
+* The warm-up will now plan queries in random order, to make sure that the work can be shared by multiple router instances using distributed caching
+* Persisted queries are part of the warmed up queries.
+
+You can get more information about operating the query plan cache and its warm-up phase in the [documentation](https://www.apollographql.com/docs/router/configuration/in-memory-caching#cache-warm-up)
+
+By [@Geal](https://github.com/Geal) in https://github.com/apollographql/router/pull/3815 https://github.com/apollographql/router/pull/3801 https://github.com/apollographql/router/pull/3767 https://github.com/apollographql/router/pull/3769 https://github.com/apollographql/router/pull/3770

.changesets/feat_geal_reintroduce_rhai_json.md

@@ -0,0 +1,5 @@
+### JSON encoding and decoding in Rhai ([PR #3785](https://github.com/apollographql/router/pull/3785))
+
+It is now possible to encode or decode JSON from Rhai scripts using `json::encode` and `json::decode`
+
+By [@Geal](https://github.com/Geal) in https://github.com/apollographql/router/pull/3785

.changesets/feat_geal_subgraph_mtls.md

@@ -0,0 +1,21 @@
+### TLS client authentication for subgraph requests ([Issue #3414](https://github.com/apollographql/router/issues/3414))
+
+The router now supports TLS client authentication when connecting to subgraphs. It can be configured as follows:
+
+```yaml
+tls:
+  subgraph:
+    all:
+      client_authentication:
+        certificate_chain: ${file./path/to/certificate_chain.pem}
+        key: ${file./path/to/key.pem}
+    # if configuring for a specific subgraph:
+    subgraphs:
+      # subgraph name
+      products:
+        client_authentication:
+          certificate_chain: ${file./path/to/certificate_chain.pem}
+          key: ${file./path/to/key.pem}
+```
+
+By [@Geal](https://github.com/Geal) in https://github.com/apollographql/router/pull/3794

.changesets/feat_geal_supergraph_coprocessor2.md

@@ -0,0 +1,33 @@
+### Supergraph coprocessor implementation ([PR #3647](https://github.com/apollographql/router/pull/3647))
+
+Coprocessors now support supergraph service interception. 
+
+On the request side, the coprocessor payload can contain:
+- method
+- headers
+- body
+- context
+- sdl
+
+On the response side, the payload can contain:
+- status_code
+- headers
+- body
+- context
+- sdl
+
+The supergraph request body contains:
+* query
+* operation name
+* variables
+* extensions
+
+The supergraph response body contains:
+* label
+* data
+* errors
+* extensions
+
+When using `@defer` or subscriptions a supergraph response may contain multiple GraphQL responses, and the coprocessor will be called for each.
+
+By [@Geal](https://github.com/Geal) in https://github.com/apollographql/router/pull/3647

.changesets/feat_sm_add_awsxray_propagator.md

@@ -0,0 +1,5 @@
+Adds support for the OpenTelemetry AWS X-Ray tracing propagator.
+
+This propagator helps propagate tracing information from upstream services (such as AWS load balancers) to downstream services and handles conversion between the X-Ray trace id format and OpenTelemetry span contexts.
+
+By [@scottmace](https://github.com/scottmace) in https://github.com/apollographql/router/pull/3580

.changesets/fix_bnjjj_fix_otel_data_from_log.md

@@ -0,0 +1,5 @@
+### fix(telemetry): do not display otel bug if the trace is sampled ([PR #3832](https://github.com/apollographql/router/pull/3832))
+
+We changed the way we are sampling spans. If you had logs in an evicted span it displays that log `Unable to find OtelData in extensions; this is a bug` which is incorrect, it's not a bug, we just can't display the `trace_id` because there is no `trace_id` as the span has not been sampled.
+
+By [@bnjjj](https://github.com/bnjjj) in https://github.com/apollographql/router/pull/3832

.changesets/fix_garypen_3823_fix_diy.md

@@ -0,0 +1,7 @@
+### fix the diy build_docker_image.sh script ([Issue #3823](https://github.com/apollographql/router/issues/3823))
+
+The diy `build_docker_image.sh` script was broken by the latest `deno` update due to a new requirement to have `cmake` when compiling the router.
+
+This adds `cmake` to the build step for diy builds to fix the problem.
+
+By [@garypen](https://github.com/garypen) in https://github.com/apollographql/router/pull/3824

.changesets/fix_garypen_helm_extra_labels.md

@@ -0,0 +1,7 @@
+### Helm: If there are `extraLabels` add them to all resources ([PR #3622](https://github.com/apollographql/router/pull/3622))
+
+This extends the functionality of `extraLabels` so that, if they are defined, they will be templated for all resources created by the chart.
+
+Previously, they were only templated onto the `Deployment` resource.
+
+By [@garypen](https://github.com/garypen) and [@bjoernw](https://github.com/bjoernw) in https://github.com/apollographql/router/pull/3622

.changesets/fix_igni_coprocessors_discard_content_length.md

@@ -0,0 +1,6 @@
+### Coprocessors: Discard content-length sent by coprocessors. ([PR #3802](https://github.com/apollographql/router/pull/3802))
+
+The `content-length` of an HTTP response can only be computed when a router response is being sent.
+We now discard coprocessors `content-length` header to make sure the value is computed correctly.
+
+By [@o0Ignition0o](https://github.com/o0Ignition0o) in https://github.com/apollographql/router/pull/3802

.changesets/fix_persisted_queries_failover_and_error_handling.md

@@ -0,0 +1,5 @@
+### Improve multi-cloud failover and error handling for Persisted Queries
+
+Improves the resilience of the Persisted Queries feature to Uplink outages, and makes errors fetching Persisted Query Manifests from Uplink more visible.
+
+By [@glasser](https://github.com/glasser) in https://github.com/apollographql/router/pull/3863

.changesets/fix_renee_fix_large_ints.md

@@ -0,0 +1,22 @@
+### Fix error response on large numbers in query transformations ([PR #3820](https://github.com/apollographql/router/pull/3820))
+
+This bug caused the router to reject operations where a large hardcoded integer was used as input for a Float field:
+
+```graphql
+# Schema
+type Query {
+    field(argument: Float): Int!
+}
+# Operation
+{
+    field(argument: 123456789123)
+}
+```
+
+Now the number is correctly interpreted as a Float.
+This bug only affected hardcoded numbers, not numbers provided through variables.
+
+<!-- start metadata -->
+---
+
+By [@goto-bus-stop](https://github.com/goto-bus-stop) in https://github.com/apollographql/router/pull/3820

.changesets/fix_simon_large_id.md

@@ -0,0 +1,5 @@
+### Fix validation error with ID variable values overflowing i32 ([Issue #3873](https://github.com/apollographql/router/issues/3873))
+
+Input values for variables of type `ID` were previously validated as "either like a GraphQL `Int` or like a GraphQL `String`". GraphQL `Int` is specified as a signed 32-bit integer, such that values that overflow fail validation. Applying this range restriction to `ID` values was incorrect. Instead, validation for `ID` now accepts any JSON integer or JSON string value, so that IDs larger than 32 bits can be used.
+
+By [@SimonSapin](https://github.com/SimonSapin) in https://github.com/apollographql/router/pull/3896

.changesets/maint_bnjjj_fix_3740.md

@@ -0,0 +1,5 @@
+### Add integration test for subscription ([Issue #3740](https://github.com/apollographql/router/issues/3740))
+
+Add a regression test that ensures an unnamed subscription makes it through the request pipeline.
+
+By [@bnjjj](https://github.com/bnjjj) in https://github.com/apollographql/router/pull/3752

.changesets/maint_garypen_3663_no_overwrites.md

@@ -0,0 +1,5 @@
+### Check if docker images and helm charts exist before creating them ([Issue #3663](https://github.com/apollographql/router/issues/3663))
+
+This improves the resilience of our pipeline.
+
+By [@garypen](https://github.com/garypen) in https://github.com/apollographql/router/pull/3825

.circleci/config.yml

@@ -378,6 +378,9 @@ commands:
                 key: "<< pipeline.parameters.merge_version >>-lint"
                 paths:
                   - target
+  xtask_release_preverify:
+    steps:
+      - run: xtask release pre-verify
 
   xtask_check_helm:
     steps:
@@ -399,6 +402,10 @@ commands:
             # Use helm to template our chart against all kube versions
             TEMPLATE_DIR=$(mktemp -d)
             for kube_version in ${CURRENT_KUBE_VERSIONS}; do
+              # Skip 1.25.14, 1.26.9, 1.27.6 and 1.28.2 until supported by kubeconform
+              if [[ "${kube_version}" == "1.25.14" ]] || [[ "${kube_version}" == "1.26.9" ]] || [[ "${kube_version}" == "1.27.6" ]] || [[ "${kube_version}" == "1.28.2" ]]; then
+                continue
+              fi
               # Use helm to template our chart against kube_version
               helm template --kube-version "${kube_version}" router helm/chart/router --set autoscaling.enabled=true > "${TEMPLATE_DIR}/router-${kube_version}.yaml"
 
@@ -525,6 +532,18 @@ jobs:
             cargo fetch
       - xtask_test:
           variant: "updated"
+  pre_verify_release:
+    environment:
+      <<: *common_job_environment
+    parameters:
+      platform:
+        type: executor
+    executor: << parameters.platform >>
+    steps:
+      - checkout
+      - setup_environment:
+          platform: << parameters.platform >>
+      - xtask_release_preverify
 
   build_release:
     parameters:
@@ -761,6 +780,10 @@ jobs:
             docker buildx inspect --bootstrap
             # Note: GH Token owned by apollo-bot2, no expire
             echo ${GITHUB_OCI_TOKEN} | docker login ghcr.io -u apollo-bot2 --password-stdin
+            # To prevent overwrite, check to see if our images already exists
+            # If the manifest command succeeds, the images already exist
+            docker manifest inspect ${ROUTER_TAG}:${VERSION}  > /dev/null && exit 1
+            docker manifest inspect ${ROUTER_TAG}:${VERSION}-debug  > /dev/null && exit 1
             # Build and push debug image
             docker buildx build --platform linux/amd64,linux/arm64 --push --build-arg DEBUG_IMAGE="true" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION}-debug .
             # Build and push release image
@@ -776,6 +799,10 @@ jobs:
             CHART=$(ls -t router*.tgz| head -1)
             # Note: GH Token owned by apollo-bot2, no expire
             echo ${GITHUB_OCI_TOKEN} | helm registry login -u apollo-bot2 --password-stdin ghcr.io
+            # To prevent overwrite, check to see if our chart already exists
+            # If the show all command succeeds, the chart already exists
+            VERSION=$(basename ${CHART} .tgz)
+            helm show all oci://ghcr.io/apollographql/helm-charts/router --version ${VERSION} > /dev/null && exit 1
             # Push chart to repository
             helm push ${CHART} oci://ghcr.io/apollographql/helm-charts
 
@@ -831,7 +858,17 @@ workflows:
     when:
       not: << pipeline.parameters.nightly >>
     jobs:
+      - pre_verify_release:
+          matrix:
+            parameters:
+              platform: [ amd_linux_build ]
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /v.*/
       - build_release:
+          requires: [ pre_verify_release ]
           matrix:
             parameters:
               platform: