Add cache: "bounded" and persistedQueries: false to default Apollo Server config

.changeset/many-bulldogs-scream.md

@@ -0,0 +1,5 @@
+---
+'@keystone-6/core': major
+---
+
+Changes default Apollo Server configuration to use `cache: "bounded"` and `persistedQueries: false`

packages/core/src/lib/server/createApolloServer.ts

@@ -5,6 +5,7 @@ import { ApolloServer as ApolloServerExpress } from 'apollo-server-express';
 import {
   ApolloServerPluginLandingPageDisabled,
   ApolloServerPluginLandingPageGraphQLPlayground,
+  Config,
 } from 'apollo-server-core';
 import type { CreateContext, GraphQLConfig, SessionStrategy } from '../../types';
 import { createSessionContext } from '../../session';
@@ -63,13 +64,15 @@ const _createApolloServerConfig = ({
 }: {
   graphQLSchema: GraphQLSchema;
   graphqlConfig?: GraphQLConfig;
-}) => {
+}): Config => {
   const apolloConfig = graphqlConfig?.apolloConfig;
   const playgroundOption = graphqlConfig?.playground ?? process.env.NODE_ENV !== 'production';
 
   return {
     schema: graphQLSchema,
     debug: graphqlConfig?.debug, // If undefined, use Apollo default of NODE_ENV !== 'production'
+    cache: 'bounded',
+    persistedQueries: false,
     ...apolloConfig,
     plugins:
       playgroundOption === 'apollo'

tests/api-tests/utils.ts

@@ -7,13 +7,10 @@ let prevConsoleWarn = console.warn;
 console.warn = function (...args: unknown[]) {
   if (
     typeof args[0] === 'string' &&
-    (args[0].endsWith(
+    args[0].endsWith(
       // this is expected
       'There are already 10 instances of Prisma Client actively running.'
-    ) ||
-      // we should really enforce a safe default for this though
-      args[0] ===
-        'Persisted queries are enabled and are using an unbounded cache. Your server is vulnerable to denial of service attacks via memory exhaustion. Set `cache: "bounded"` or `persistedQueries: false` in your ApolloServer constructor, or see https://go.apollo.dev/s/cache-backends for other alternatives.')
+    )
   ) {
     return;
   }