feat(TD-9488)!: Phase 2 — apollo-client 2 → @apollo/client 3 + graphql 16 by VDubber · Pull Request #171 · JupiterOne/jupiterone-client-nodejs

VDubber · 2026-10-20T21:47:58Z

Stacked on the Phase 1a TS-upgrade PR. The TD-9488 core — closes the graphql@14.7.0 EOL item and takes production vulnerabilities to 0.

Replace 5 EOL apollo-* packages with @apollo/client ^3.14
graphql 14.6 → 16.9, graphql-tag → 2.12.6
Imports from @apollo/client/core + /link/retry + /link/batch-http (classic node resolution, CJS-safe)
Only the link setup in index.ts + the ApolloQueryResult/GraphQLFormattedError types in util/query changed; all graphClient method bodies untouched

Production npm audit: 322 → 0. 72 tests green.

⚠️ BREAKING (see PUBLIC-API.md §6c)

@apollo/client 3 drops the "Network error: " prefix on network errors → "Response not successful: Received status code 401"
ApolloClient/QueryOptions type import source → @apollo/client/core
queryGraphQL returns InteropApolloQueryResult (same runtime shape)
QueryResults<T>.errors element type → GraphQLFormattedError (graphql 16 split; same runtime shape)

Validated via diff PUBLIC-API.baseline.d.ts dist/index.d.ts — only the approved changes above.
🤖 Generated with Claude Code

socket-security · 2026-10-20T21:48:28Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	graphql@16.14.2
	@apollo/client@3.14.1

View full report

… + graphql 16 Closes the TD-9488 graphql@14.7.0 EOL item and removes the last production vulnerabilities (the apollo-utilities -> lodash/minimatch chain). - Replace apollo-client, apollo-cache-inmemory, apollo-link, apollo-link-retry, apollo-link-batch-http (all EOL) with @apollo/client ^3.14. - graphql 14.6 -> 16.9, graphql-tag -> 2.12.6. - Imports from @apollo/client/core + @apollo/client/link/retry + @apollo/client/link/batch-http (classic node resolution, CommonJS-safe). Updated src/index.ts (link setup) and src/util/query/{query,types}.ts (ApolloQueryResult import source). All graphClient method bodies untouched. Production npm audit: 0 vulnerabilities (down from 322 at the start of TD-9488). 72 tests green. BREAKING CHANGE: @apollo/client 3 drops the "Network error: " prefix on network-error messages (now e.g. "Response not successful: Received status code 401"). ApolloClient/QueryOptions type import source moves to @apollo/client/core; queryGraphQL returns InteropApolloQueryResult (same runtime shape); QueryResults<T>.errors element type is now GraphQLFormattedError (graphql 16 split). See PUBLIC-API.md §6c. The PollyJS retry test assertion was updated to the new message format. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- Bump version 2.1.2 -> 3.0.0 (breaking: Node 22 floor, @apollo/client 3, pino logger, error-message format change). - Add MIGRATING-v3.md: customer-facing before/after upgrade guide. - Add CHANGELOG 3.0.0 entry summarizing breaking changes + the EOL remediation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… fixes - PUBLIC-API.md §6/§6a were written against an assumed Apollo 2->4 migration; reconcile them to the shipped Apollo 3 outcome. Mark the integrationInstances.update/.delete `query`-keyword-in-mutate() quirk as RESOLVED (covered by the nock suite, passes under Apollo 3) rather than an open "Apollo 4 may reject" risk. Record that @apollo/client 3.x is itself maintenance-only, so a future v4 upgrade stays tracked as an open EOL item. - Correct the `InteropApolloQueryResult` description in MIGRATING-v3.md §4 and PUBLIC-API.md §6c: it is a NARROWING (drops `networkStatus`/`partial` from the type), not a pure rename — a consumer reading `.networkStatus` now fails to type-check even without annotating. `data` stays non-optional. - Document the js-yaml 3->4 (YAML 1.1 -> 1.2) CLI parsing change in MIGRATING-v3.md §5 and CHANGELOG (0777 -> 777 decimal, 12:30 -> string); pinned by src/yaml-parsing.test.ts (added in the Phase 1b PR). The Logger "✅ Still valid" claim in MIGRATING-v3.md §3 is now true as written, since the interface was fixed to method-shorthand in the Phase 1b PR. 75 tests green, lint gate passes, prod audit 0, contract baseline unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… Apollo-3 refs - Revert the InteropApolloQueryResult "narrowing" wording in MIGRATING-v3.md §4, PUBLIC-API.md §6c and CHANGELOG. Verified against @apollo/client 3.14.1: InteropApolloQueryResult is field-for-field identical to ApolloQueryResult (data, errors?, error?, loading, networkStatus, partial?) and mutually assignable — a pure deprecated-bridge rename, not a narrowing. (Reviewer retracted the original finding.) - Reconcile the remaining current-plan Apollo-4 references in DEPENDENCY-AUDIT.md: Phase 2 now reads @apollo/client 3, Risk Notes read Apollo 2→3. Historical "as-written" lines left as-is. - Add §6 "Remaining EOL follow-ups" to DEPENDENCY-AUDIT.md so the EOL inventory tracks the @apollo/client 3→4, CLI-deps, and dev-tooling upgrades. Docs only — no code change; tests/contract unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Keep the feature stack at 2.1.2 so merging #168-#171 to main does not trigger the version-gated auto-publish mid-stack. The 3.0.0 bump + npm publish happen in a dedicated release PR merged last, matching this repo's release-X.Y.Z convention (cf. #165 release-2.1.2, #161 release-2.0.1). CHANGELOG 3.0.0 notes and MIGRATING-v3.md remain in the feature PRs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The merge-base changed after approval.

VDubber requested a review from a team as a code owner October 20, 2026 21:47

VDubber force-pushed the td-9488/apollo-client-3 branch from c17000e to 0eae00b Compare October 20, 2026 22:04

VDubber added this pull request to stack #172 October 21, 2026 03:50

This was referenced Oct 21, 2026

feat(TD-9488): EOL deps — Node 22, js-yaml 4, bunyan→pino (Phases 0 + 1b) #169

Merged

chore(TD-9488): Phase 1a — TypeScript 3.8→5.5 + test/lint toolchain #170

Merged

tom-foley-j1 reviewed Oct 21, 2026

View reviewed changes

Comment thread MIGRATING-v3.md

Comment thread PUBLIC-API.md

Comment thread MIGRATING-v3.md

VDubber force-pushed the td-9488/apollo-client-3 branch from 4dd4f91 to e1bc6c4 Compare October 21, 2026 15:01

tom-foley-j1 previously approved these changes Oct 21, 2026

View reviewed changes

VDubber and others added 4 commits October 21, 2026 11:19

VDubber dismissed tom-foley-j1’s stale review via 8db668c October 21, 2026 17:20

VDubber force-pushed the td-9488/apollo-client-3 branch from 436215d to 8db668c Compare October 21, 2026 17:20

gastonyelmini previously approved these changes Oct 21, 2026

View reviewed changes

tom-foley-j1 previously approved these changes Oct 21, 2026

View reviewed changes

VDubber merged commit d9b8b48 into main Oct 21, 2026
8 checks passed

VDubber deleted the td-9488/apollo-client-3 branch October 21, 2026 17:35

VDubber mentioned this pull request Oct 21, 2026

chore(release): v3.0.0 #173

Merged

Navigation Menu

Repository navigation

feat(TD-9488)!: Phase 2 — apollo-client 2 → @apollo/client 3 + graphql 16 - #171

feat(TD-9488)!: Phase 2 — apollo-client 2 → @apollo/client 3 + graphql 16#171
VDubber merged 4 commits into
td-9488/ts-upgradefrom
td-9488/apollo-client-3

VDubber commented Oct 20, 2026

Uh oh!

socket-security Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

VDubber commented Oct 20, 2026

⚠️ BREAKING (see PUBLIC-API.md §6c)

Uh oh!

socket-security Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

socket-security Bot commented Oct 20, 2026 •

edited

Loading