Pull 2.8.5 and 2.9.0 release updates into next

.cspell/cspell-dict.txt

@@ -81,6 +81,7 @@ follwoing
 fooz
 Fragmentization
 fufilled
+GHSA
 Gmsuh
 gqlgen
 Graphi

composition-js/CHANGELOG.md

@@ -1,5 +1,27 @@
 # CHANGELOG for `@apollo/composition`
 
+## 2.9.0
+
+### Minor Changes
+
+- Implements two new directives for defining custom costs for demand control. The `@cost` directive allows setting a custom weight to a particular field in the graph, overriding the default cost calculation. The `@listSize` directive gives the cost calculator information about how to estimate the size of lists returned by subgraphs. This can either be a static size or a value derived from input arguments, such as paging parameters. ([#3074](https://github.com/apollographql/federation/pull/3074))
+
+### Patch Changes
+
+- Reduce memory overhead during satisfiability checking when there are many options. ([#3109](https://github.com/apollographql/federation/pull/3109))
+
+- Updated dependencies [[`acfe3193429c7f99b4fc564b20828aaa8659a75c`](https://github.com/apollographql/federation/commit/acfe3193429c7f99b4fc564b20828aaa8659a75c), [`02c2a34a62c3717a4885449172e404f19ebf66c9`](https://github.com/apollographql/federation/commit/02c2a34a62c3717a4885449172e404f19ebf66c9), [`0ccfd937d4b4a576f890665ceebbd7986fac5d0c`](https://github.com/apollographql/federation/commit/0ccfd937d4b4a576f890665ceebbd7986fac5d0c), [`e0a5075c0d12a0e2f7ef303b246e3216a139d3e0`](https://github.com/apollographql/federation/commit/e0a5075c0d12a0e2f7ef303b246e3216a139d3e0)]:
+  - @apollo/[email protected]
+  - @apollo/[email protected]
+
+## 2.8.5
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @apollo/[email protected]
+  - @apollo/[email protected]
+
 ## 2.8.4
 
 ### Patch Changes

composition-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apollo/composition",
-  "version": "2.8.4",
+  "version": "2.9.0",
   "description": "Apollo Federation composition utilities",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -27,8 +27,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@apollo/federation-internals": "2.8.4",
-    "@apollo/query-graphs": "2.8.4"
+    "@apollo/federation-internals": "2.9.0",
+    "@apollo/query-graphs": "2.9.0"
   },
   "peerDependencies": {
     "graphql": "^16.5.0"

docs/source/entities/index.mdx

@@ -4,6 +4,12 @@ subtitle: Learn how to define federated types across multiple subgraphs
 description: Learn to define and contribute to object types that resolve their fields across multiple services in a federated GraphQL architecture.
 ---
 
+<SummitCallout
+  topic="entities"
+  workshopName="Federation from day 1: Thinking in entities"
+  URL="https://reg.summit.graphql.com/flow/apollo/summit24/AttendeePortal/page/catalog/session/1712947980868001Lumq"
+/>
+
 _Entities_ are a fundamental building block of Apollo Federation.
 In a supergraph, an entity is an object type that can resolve its fields across multiple subgraphs.
 Each subgraph can contribute different fields to the entity and is responsible for resolving only the fields that it contributes.

docs/source/federation-2/moving-to-federation-2.mdx

@@ -172,7 +172,7 @@ Federation 2 provides powerful new features that require making some changes to
 - Safely migrating fields from one subgraph to another with [`@override`](../federated-types/federated-directives#override)
 - Hiding internal routing fields from graph consumers with [`@inaccessible`](../federated-types/federated-directives#inaccessible)
 
-The schema changes you make are backward incompatible with Federation 1, which means you won't be able to use Federation 1 composition anymore unless you revert those changes.
+The schema changes you make are not backward compatible with Federation 1, which means you won't be able to use Federation 1 composition anymore unless you revert those changes.
 
 ### Update your subgraph library
 

docs/source/index.mdx

@@ -4,6 +4,12 @@ subtitle: Learn how to combine your GraphQL APIs into a unified supergraph
 description: Learn how Apollo Federation can help you declaratively combine your services into a unified, federated GraphQL API using a microservices architecture.
 ---
 
+<SummitCallout
+  topic="federation"
+  workshopName="Federation from day 1: Thinking in entities"
+  URL="https://reg.summit.graphql.com/flow/apollo/summit24/AttendeePortal/page/catalog/session/1712947980868001Lumq"
+/>
+
 ## What is Apollo Federation?
 
 Apollo Federation lets you declaratively combine multiple GraphQL APIs into a single, federated graph. This federated graph enables clients to interact with multiple APIs through a single request.

docs/source/quickstart.mdx

@@ -34,6 +34,12 @@ To learn more about Apollo Federation and the benefits of using it with GraphOS,
 - [Introduction to Apollo Federation](./)
 - [Introduction to GraphOS](/graphos)
 
+<SummitCallout
+  topic="federation"
+  workshopName="Federation from day 1: Thinking in entities"
+  URL="https://reg.summit.graphql.com/flow/apollo/summit24/AttendeePortal/page/catalog/session/1712947980868001Lumq"
+/>
+
 ## Prerequisites
 
 To complete this quickstart, you must have the following:

federation-integration-testsuite-js/CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG for `federation-integration-testsuite-js`
 
+## 2.9.0
+
+## 2.8.5
+
 ## 2.8.4
 
 ## 2.8.3

federation-integration-testsuite-js/package.json

@@ -1,7 +1,7 @@
 {
   "name": "apollo-federation-integration-testsuite",
   "private": true,
-  "version": "2.8.4",
+  "version": "2.9.0",
   "description": "Apollo Federation Integrations / Test Fixtures",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

gateway-js/CHANGELOG.md

@@ -1,5 +1,35 @@
 # CHANGELOG for `@apollo/gateway`
 
+## 2.9.0
+
+### Patch Changes
+
+- Avoid type explosion for inline fragments where the type condition is an interface that implements the parent type. ([#3122](https://github.com/apollographql/federation/pull/3122))
+
+- Reduce memory overhead during satisfiability checking when there are many options. ([#3109](https://github.com/apollographql/federation/pull/3109))
+
+- Updated dependencies [[`02c2a34a62c3717a4885449172e404f19ebf66c9`](https://github.com/apollographql/federation/commit/02c2a34a62c3717a4885449172e404f19ebf66c9), [`0ccfd937d4b4a576f890665ceebbd7986fac5d0c`](https://github.com/apollographql/federation/commit/0ccfd937d4b4a576f890665ceebbd7986fac5d0c), [`e0a5075c0d12a0e2f7ef303b246e3216a139d3e0`](https://github.com/apollographql/federation/commit/e0a5075c0d12a0e2f7ef303b246e3216a139d3e0)]:
+  - @apollo/[email protected]
+  - @apollo/[email protected]
+  - @apollo/[email protected]
+
+## 2.8.5
+
+## 🔒 Security
+
+### CVE-2024-43414: Prevent uncontrolled recursion for complex queries
+
+Correct a bug where complex queries can cause uncontrolled recursion due to failure to reduce the number of possible query plans (classified as [CWE-674](https://cwe.mitre.org/data/definitions/674.html)). ([#3128](https://github.com/apollographql/federation/pull/3128))
+
+This weakness impacts all v2 versions of `@apollo/gateway` prior to this release. See the associated Github Advisory, [GHSA-fmj9-77q8-g6c4](https://github.com/apollographql/federation/security/advisories/GHSA-fmj9-77q8-g6c4), for more information.
+
+##
+
+- Updated dependencies [[`926cbb7949200e12b81100a07fa3438b5ae9efd0`](https://github.com/apollographql/federation/commit/926cbb7949200e12b81100a07fa3438b5ae9efd0)]:
+  - @apollo/[email protected]
+  - @apollo/[email protected]
+  - @apollo/[email protected]
+
 ## 2.8.4
 
 ### Patch Changes

gateway-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apollo/gateway",
-  "version": "2.8.4",
+  "version": "2.9.0",
   "description": "Apollo Gateway",
   "author": "Apollo <[email protected]>",
   "main": "dist/index.js",
@@ -25,9 +25,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@apollo/composition": "2.8.4",
-    "@apollo/federation-internals": "2.8.4",
-    "@apollo/query-planner": "2.8.4",
+    "@apollo/composition": "2.9.0",
+    "@apollo/federation-internals": "2.9.0",
+    "@apollo/query-planner": "2.9.0",
     "@apollo/server-gateway-interface": "^1.1.0",
     "@apollo/usage-reporting-protobuf": "^4.1.0",
     "@apollo/utils.createhash": "^2.0.0",

internals-js/CHANGELOG.md

@@ -1,5 +1,19 @@
 # CHANGELOG for `@apollo/federation-internals`
 
+## 2.9.0
+
+### Minor Changes
+
+- Implements two new directives for defining custom costs for demand control. The `@cost` directive allows setting a custom weight to a particular field in the graph, overriding the default cost calculation. The `@listSize` directive gives the cost calculator information about how to estimate the size of lists returned by subgraphs. This can either be a static size or a value derived from input arguments, such as paging parameters. ([#3074](https://github.com/apollographql/federation/pull/3074))
+
+### Patch Changes
+
+- Reduce memory overhead during satisfiability checking when there are many options. ([#3109](https://github.com/apollographql/federation/pull/3109))
+
+- Fix issue where variable was not passed into subgraph when embedded in a fragment ([#3119](https://github.com/apollographql/federation/pull/3119))
+
+## 2.8.5
+
 ## 2.8.4
 
 ### Patch Changes

internals-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apollo/federation-internals",
-  "version": "2.8.4",
+  "version": "2.9.0",
   "description": "Apollo Federation internal utilities",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

query-graphs-js/CHANGELOG.md

@@ -1,5 +1,21 @@
 # CHANGELOG for `@apollo/query-graphs`
 
+## 2.9.0
+
+### Patch Changes
+
+- Avoid type explosion for inline fragments where the type condition is an interface that implements the parent type. ([#3122](https://github.com/apollographql/federation/pull/3122))
+
+- Updated dependencies [[`02c2a34a62c3717a4885449172e404f19ebf66c9`](https://github.com/apollographql/federation/commit/02c2a34a62c3717a4885449172e404f19ebf66c9), [`0ccfd937d4b4a576f890665ceebbd7986fac5d0c`](https://github.com/apollographql/federation/commit/0ccfd937d4b4a576f890665ceebbd7986fac5d0c), [`e0a5075c0d12a0e2f7ef303b246e3216a139d3e0`](https://github.com/apollographql/federation/commit/e0a5075c0d12a0e2f7ef303b246e3216a139d3e0)]:
+  - @apollo/[email protected]
+
+## 2.8.5
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @apollo/[email protected]
+
 ## 2.8.4
 
 ### Patch Changes

query-graphs-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apollo/query-graphs",
-  "version": "2.8.4",
+  "version": "2.9.0",
   "description": "Apollo Federation library to work with 'query graphs'",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -23,7 +23,7 @@
     "node": ">=14.15.0"
   },
   "dependencies": {
-    "@apollo/federation-internals": "2.8.4",
+    "@apollo/federation-internals": "2.9.0",
     "deep-equal": "^2.0.5",
     "ts-graphviz": "^1.5.4",
     "uuid": "^9.0.0"

query-planner-js/CHANGELOG.md

@@ -1,5 +1,31 @@
 # CHANGELOG for `@apollo/query-planner`
 
+## 2.9.0
+
+### Patch Changes
+
+- Fix issue where variable was not passed into subgraph when embedded in a fragment ([#3119](https://github.com/apollographql/federation/pull/3119))
+
+- Updated dependencies [[`acfe3193429c7f99b4fc564b20828aaa8659a75c`](https://github.com/apollographql/federation/commit/acfe3193429c7f99b4fc564b20828aaa8659a75c), [`02c2a34a62c3717a4885449172e404f19ebf66c9`](https://github.com/apollographql/federation/commit/02c2a34a62c3717a4885449172e404f19ebf66c9), [`0ccfd937d4b4a576f890665ceebbd7986fac5d0c`](https://github.com/apollographql/federation/commit/0ccfd937d4b4a576f890665ceebbd7986fac5d0c), [`e0a5075c0d12a0e2f7ef303b246e3216a139d3e0`](https://github.com/apollographql/federation/commit/e0a5075c0d12a0e2f7ef303b246e3216a139d3e0)]:
+  - @apollo/[email protected]
+  - @apollo/[email protected]
+
+## 2.8.5
+
+## 🔒 Security
+
+### CVE-2024-43414: Prevent uncontrolled recursion for complex queries
+
+Correct a bug where complex queries can cause uncontrolled recursion due to failure to reduce the number of possible query plans (classified as [CWE-674](https://cwe.mitre.org/data/definitions/674.html)). ([#3128](https://github.com/apollographql/federation/pull/3128))
+
+This weakness impacts all v2 versions of `@apollo/query-planner` prior to this release. See the associated Github Advisory, [GHSA-fmj9-77q8-g6c4](https://github.com/apollographql/federation/security/advisories/GHSA-fmj9-77q8-g6c4), for more information.
+
+##
+
+- Updated dependencies []:
+  - @apollo/[email protected]
+  - @apollo/[email protected]
+
 ## 2.8.4
 
 ### Patch Changes