chore(deps): update dependency @apollo/server-integration-testsuite to v5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@apollo/server-integration-testsuite (source)	4.13.0 → 5.5.0

---

Release Notes

apollographql/apollo-server (@​apollo/server-integration-testsuite)

v5.5.0

Compare Source

Minor Changes

• #​8191 ada1200 - ⚠️ SECURITY @apollo/server/standalone:

  Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

  (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

  This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

  If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

  This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

  See advisory GHSA-9q82-xgwf-vj6h for more details.

Patch Changes

• Updated dependencies [ada1200]:
  • @​apollo/server@​5.5.0

v5.4.0

Compare Source

Patch Changes

• Updated dependencies [d25a5bd]:
  • @​apollo/server@​5.4.0

v5.3.0

Compare Source

Patch Changes

• Updated dependencies [8e54e58, 26320bc]:
  • @​apollo/server@​5.3.0

v5.2.0

Compare Source

Patch Changes

• Updated dependencies [51acbeb]:
  • @​apollo/server@​5.2.0

v5.1.0

Compare Source

Patch Changes

• Updated dependencies [80a1a1a]:
  • @​apollo/server@​5.1.0

v5.0.0

Compare Source

Major Changes

• Drop support for Node.JS v14, v16, and v20.

• The integration test suite no longer uses lib: ["dom"] to tell TypeScript to assume DOM-related symbols are in the global namespace. If your integration library's test suite relied on this behavior, you may need to add lib: ["dom"] to the compilerOptions section of your test suite's tsconfig.json.

Patch Changes

• #​8078 dabe7ba Thanks @​renovate! - Support Jest v30 as well as Jest v29.

• Updated dependencies [5b26558, 100233a, 100233a, 100233a, 100233a]:

  • @​apollo/server@​5.0.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.