prep release: v1.34.1

[abernix]

Note

When approved, this PR will merge into the 1.34.1 branch which will — upon being approved itself — merge into main.

Things to review in this PR:

• Changelog correctness (There is a preview below, but it is not necessarily the most up to date. See the Files Changed for the true reality.)
• Version bumps
• That it targets the right release branch (1.34.1 in this case!).

---

🐛 Fixes

Authorization: Filtered fragments remove corresponding fragment spreads (Issue #4060)

When fragments have been removed because they do not meet the authorization requirements to be queried, or in the case that their conditions cannot be fulfilled, any related fragment spreads which remain will be now be removed from the operation before execution. Additionally, fragment error paths are now applied at the point that the fragment use.

By @Geal in #4155

Authorization: Maintain a special case for __typename (PR #3821)

When evaluating authorization directives on fields returning interfaces, the special GraphQL __typename field will be maintained as an exception since it must work for all implementors

By @Geal in #3821

Enforce JWT expiration for subscriptions (Issue #3947)

If a JWT expires whilst a subscription is executing, the subscription should be terminated. This also applies to deferred responses.

By @garypen in #4166

Improved channel bounding via conversion of futures channels into tokio channels (Issue #4103, Issue #4109, Issue #4110, Issue #4117)

The use of futures channels have been converted to tokio channels which should ensure that channel bounds are observed correctly. We hope this brings some additional stability and predictability to the memory footprint.

By @garypen in #4111, #4118, #4138

Reduce recursion in GraphQL parsing via apollo-parser improvements (Issue #4142)

Improvements to apollo-parser are brought in which remove unnecessary recursion when parsing repeated syntax elements, such as enum values and union members, in type definitions. Some documents that used to hit the parser’s recursion limit will now successfully parse.

By @lrlna in #4167

Maintain query ordering within a batch (Issue #4143)

A bug in batch manipulation meant that the last element in a batch was treated as the first element. Ordering should be maintained and there is now an updated unit test to ensure this.

By @garypen in #4144

Port to apollo-compiler usage to 1.0-beta (PR #4038)

Version 1.0 of apollo-compiler is a near-complete rewrite and introducing it in the Router unblocks a lot of upcoming work, including our Rust-ification of the query planner.

As an immediate benefit, some serialization-related bugs — including Issue #3541 — are fixed. Additionally, the representation of GraphQL documents within apollo-compiler is now mutable. This means that when modifying a query (such as to remove @authenticated fields from an unauthenticated request) the Router no longer needs to construct a new data structure (with apollo-encoder), serialize it, and reparse it.

By @SimonSapin in #4038

Propagate multi-value headers to subgraphs (Issue #4153)

Use HeaderMap.append instead of insert to avoid erasing previous values when using multiple headers with the same name.

By @nmoutschen in #4154

📃 Configuration

Authentication: Allow customizing a poll_interval for the JWKS endpoint configuration (Issue #4185)

In order to compensate for variances in rate-limiting requirements for JWKS endpoints, a new poll_interval configuration option exists to adjust the polling interval for each JWKS URL. When not specified for a URL, the polling interval will remain as the default of 60 seconds.

The configuration option accepts a human-readable duration (e.g., 60s or 1minute 30s). For example, the following configuration snippet sets the polling interval for a single JWKS URL to be every 30 seconds:

authentication:
  router:
    jwt:
      jwks:
        - url: https://dev-zzp5enui.us.auth0.com/.well-known/jwks.json
          poll_interval: 30s

By @lleadbet in #4212

Allow customization of the health check endpoint path (Issue #2938)

Adds a configuration option for custom health check endpoints, health_check.path, with /health as the default value.

By @aaronArinder in #4145

📚 Documentation

Coprocessors: Clarify capabilities of RouterRequest and RouterResponse's control responses (PR #4189)

The coprocessor RouterRequest and RouterResponse stages already fully support control: { break: 500 }, but the response body must be a string. The documentation has been improved to provides examples in the Terminating a client request section.

By @lennyburdette in #4189

🧪 Experimental

Support time-to-live (TTL) expiration for distributed cache entries (Issue #4163)

It is now possible to use configuration to set an expiration (time-to-live or TTL) for distributed caching (i.e., Redis) entries, both for APQ and query planning caches (using either apq or query_planning, respectively). By default, entries have no expiration.

For example, to define the TTL for cached query plans stored in Redis to be 24 hours, the following configuration snippet could be used which specifies ttl: 24h.

supergraph:
  query_planning:
    experimental_cache:
      redis:
        urls: ["redis://..."]
        timeout: 5ms # Optional, by default: 2ms
        ttl: 24h # Optional, by default no expiration

Similarly, it is possible to set the cache for APQ entries. For details, see the Distributed APQ caching documentation.

By @Geal in #4164

[router-perf]

CI performance tests

• events_big_cap_high_rate - Stress test for events with a lot of users, deduplication enabled and high rate event with a big queue capacity
• events_without_dedup - Stress test for events with a lot of users and deduplication DISABLED
• events - Stress test for events with a lot of users and deduplication ENABLED
• large-request - Stress test with a 1 MB request payload
• step - Basic stress test that steps up the number of users over time
• xlarge-request - Stress test with 10 MB request payload
• reload - Reload test over a long period of time at a constant rate of users
• no-graphos - Basic stress test, no GraphOS.
• xxlarge-request - Stress test with 100 MB request payload
• step-jemalloc-tuning - Clone of the basic stress test for jemalloc tuning
• const - Basic stress test that runs with a constant number of users