0.15.0 (#1485)

# [0.15.0] - 2022-08-09

## ❗ BREAKING ❗

### CORS: Deprecate newly-added `allow_any_header` option and return to previous behavior ([PR #1480](#1480))

We've re-considered and reverted changes we shipped in the last release with regards to how we handle the [`Access-Control-Request-Headers`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers) *request* header and its corresponding [`Access-Control-Allow-Headers`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers) response header.  We've reverted to the previous releases' behavior, including the removal of the recently-added `allow_any_header` option.

The previous default behavior was to **reflect** the client's `Access-Control-Request-Headers` request header values back in the `Access-Control-Allow-Headers` response header.  This previous behavior is in fact a common default behavior in other CORS libraries as well, including the [`cors`](https://npm.im/cors) Node.js package and we think it's worth keeping as it was previously, rather than requiring users to specify `allow_any_header` for the _majority_ of use cases.  We believe this to be a safe and secure default that is also more user-friendly.

It is not typically necessary to change this default behavior, but if you wish to allow a more specific set of headers, you can disable the default header reflection and specify a list of headers using the `allow_headers` option, which will allow only those headers in negotiating a response:

```yaml title="router.yaml"
server:
  cors:
    allow_any_origin: true
    # Including this `allow_headers` isn't typically necessary (can be removed) but
    # will *restrict* the permitted Access-Control-Allow-Headers response values.
    allow_headers:
      - Content-Type
      - Authorization
      - x-my-custom-header
```

By [@o0Ignition0o](https://github.com/o0ignition0o) in #1480

### Reference-counting for the schema string given to plugins ([PR #1462](#1462))

The type of the `supergraph_sdl` field of the `apollo_router::plugin::PluginInit` struct
was changed from `String` to `Arc<String>`.
This reduces the number of copies of this string we keep in memory, as schemas can get large.

By [@SimonSapin](https://github.com/SimonSapin) in #1462

## 🐛 Fixes

### Update span attributes to be compliant with the opentelemetry for GraphQL specs ([PR #1449](#1449))

Change attribute name `query` to `graphql.document` and `operation_name` to `graphql.operation.name` in spans.

By [@bnjjj](https://github.com/bnjjj) in #1449 

### Configuration handling enhancements ([PR #1454](#1454))

Router config handling now:
* Allows completely empty configuration without error.
* Prevents unknown tags at the root of the configuration from being silently ignored.

By [@BrynCooke](https://github.com/bryncooke) in #1454

## 📚 Documentation


### CORS: Fix trailing slashes, and display defaults ([PR #1471](#1471))

The CORS documentation now displays a valid `origins` configuration (without trailing slash!), and the full configuration section displays its default settings.


By [@o0Ignition0o](https://github.com/o0Ignition0o) in #1471


### Add helm OCI example ([PR #1457](#1457))

Update existing filesystem based example to illustrate how to do the same thing using our OCI stored helm chart.

By [@garypen](https://github.com/garypen) in #1457

CHANGELOG.md

@@ -4,6 +4,74 @@ All notable changes to Router will be documented in this file.
 
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+# [0.15.0] - 2022-08-09
+
+## ❗ BREAKING ❗
+
+### CORS: Deprecate newly-added `allow_any_header` option and return to previous behavior ([PR #1480](https://github.com/apollographql/router/pull/1480))
+
+We've re-considered and reverted changes we shipped in the last release with regards to how we handle the [`Access-Control-Request-Headers`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers) *request* header and its corresponding [`Access-Control-Allow-Headers`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers) response header.  We've reverted to the previous releases' behavior, including the removal of the recently-added `allow_any_header` option.
+
+The previous default behavior was to **reflect** the client's `Access-Control-Request-Headers` request header values back in the `Access-Control-Allow-Headers` response header.  This previous behavior is in fact a common default behavior in other CORS libraries as well, including the [`cors`](https://npm.im/cors) Node.js package and we think it's worth keeping as it was previously, rather than requiring users to specify `allow_any_header` for the _majority_ of use cases.  We believe this to be a safe and secure default that is also more user-friendly.
+
+It is not typically necessary to change this default behavior, but if you wish to allow a more specific set of headers, you can disable the default header reflection and specify a list of headers using the `allow_headers` option, which will allow only those headers in negotiating a response:
+
+```yaml title="router.yaml"
+server:
+  cors:
+    allow_any_origin: true
+    # Including this `allow_headers` isn't typically necessary (can be removed) but
+    # will *restrict* the permitted Access-Control-Allow-Headers response values.
+    allow_headers:
+      - Content-Type
+      - Authorization
+      - x-my-custom-header
+```
+
+By [@o0Ignition0o](https://github.com/o0ignition0o) in https://github.com/apollographql/router/pull/1480
+
+### Reference-counting for the schema string given to plugins ([PR #1462](https://github.com/apollographql/router/pull/1462))
+
+The type of the `supergraph_sdl` field of the `apollo_router::plugin::PluginInit` struct
+was changed from `String` to `Arc<String>`.
+This reduces the number of copies of this string we keep in memory, as schemas can get large.
+
+By [@SimonSapin](https://github.com/SimonSapin) in https://github.com/apollographql/router/pull/1462
+
+## 🐛 Fixes
+
+### Update span attributes to be compliant with the opentelemetry for GraphQL specs ([PR #1449](https://github.com/apollographql/router/pull/1449))
+
+Change attribute name `query` to `graphql.document` and `operation_name` to `graphql.operation.name` in spans.
+
+By [@bnjjj](https://github.com/bnjjj) in https://github.com/apollographql/router/pull/1449 
+
+### Configuration handling enhancements ([PR #1454](https://github.com/apollographql/router/pull/1454))
+
+Router config handling now:
+* Allows completely empty configuration without error.
+* Prevents unknown tags at the root of the configuration from being silently ignored.
+
+By [@bryncooke](https://github.com/bryncooke) in https://github.com/apollographql/router/pull/1454
+
+## 📚 Documentation
+
+
+### CORS: Fix trailing slashes, and display defaults ([PR #1471](https://github.com/apollographql/router/pull/1471))
+
+The CORS documentation now displays a valid `origins` configuration (without trailing slash!), and the full configuration section displays its default settings.
+
+
+By [@o0Ignition0o](https://github.com/o0Ignition0o) in https://github.com/apollographql/router/pull/1471
+
+
+### Add helm OCI example ([PR #1457](https://github.com/apollographql/router/pull/1457))
+
+Update existing filesystem based example to illustrate how to do the same thing using our OCI stored helm chart.
+
+By [@garypen](https://github.com/garypen) in https://github.com/apollographql/router/pull/1457
+
+
 # [0.14.0] - 2022-08-02
 
 ## ❗ BREAKING ❗

NEXT_CHANGELOG.md

@@ -23,75 +23,14 @@ Description! And a link to a [reference](http://url)
 By [@USERNAME](https://github.com/USERNAME) in https://github.com/apollographql/router/pull/PULL_NUMBER
 -->
 
-# [0.14.1] (unreleased) - 2022-mm-dd
+# [0.15.1] (unreleased) - 2022-mm-dd
 
 ## ❗ BREAKING ❗
 
-### CORS: Deprecate newly-added `allow_any_header` option and return to previous behavior ([PR #1480](https://github.com/apollographql/router/pull/1480))
-
-We've re-considered and reverted changes we shipped in the last release with regards to how we handle the [`Access-Control-Request-Headers`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers) *request* header and its corresponding [`Access-Control-Allow-Headers`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers) response header.  We've reverted to the previous releases' behavior, including the removal of the recently-added `allow_any_header` option.
-
-The previous default behavior was to **reflect** the client's `Access-Control-Request-Headers` request header values back in the `Access-Control-Allow-Headers` response header.  This previous behavior is in fact a common default behavior in other CORS libraries as well, including the [`cors`](https://npm.im/cors) Node.js package and we think it's worth keeping as it was previously, rather than requiring users to specify `allow_any_header` for the _majority_ of use cases.  We believe this to be a safe and secure default that is also more user-friendly.
-
-It is not typically necessary to change this default behavior, but if you wish to allow a more specific set of headers, you can disable the default header reflection and specify a list of headers using the `allow_headers` option, which will allow only those headers in negotiating a response:
-
-```yaml title="router.yaml"
-server:
-  cors:
-    allow_any_origin: true
-    # Including this `allow_headers` isn't typically necessary (can be removed) but
-    # will *restrict* the permitted Access-Control-Allow-Headers response values.
-    allow_headers:
-      - Content-Type
-      - Authorization
-      - x-my-custom-header
-```
-
-By [@o0Ignition0o](https://github.com/o0ignition0o) in https://github.com/apollographql/router/pull/1480
-
-### Reference-counting for the schema string given to plugins ([PR #???](https://github.com/apollographql/router/pull/))
-
-The type of the `supergraph_sdl` field of the `apollo_router::plugin::PluginInit` struct
-was changed from `String` to `Arc<String>`.
-This reduces the number of copies of this string we keep in memory, as schemas can get large.
-
-By [@SimonSapin](https://github.com/SimonSapin)
-
 ## 🚀 Features
 
 ## 🐛 Fixes
 
-### Update span attributes to be compliant with the opentelemetry for GraphQL specs ([PR #1449](https://github.com/apollographql/router/pull/1449))
-
-Change attribute name `query` to `graphql.document` and `operation_name` to `graphql.operation.name` in spans.
-
-By [@bnjjj](https://github.com/bnjjj) in https://github.com/apollographql/router/pull/1449 
-
-### Configuration handling enhancements ([PR #1454](https://github.com/apollographql/router/pull/1454))
-
-Router config handling now:
-* Allows completely empty configuration without error.
-* Prevents unknown tags at the root of the configuration from being silently ignored.
-
-By [@bryncooke](https://github.com/bryncooke) in https://github.com/apollographql/router/pull/1454
-
-
 ## 🛠 Maintenance
 
 ## 📚 Documentation
-
-
-### CORS: Fix trailing slashes, and display defaults ([PR #1471](https://github.com/apollographql/router/pull/1471))
-
-The CORS documentation now displays a valid `origins` configuration (without trailing slash!), and the full configuration section displays its default settings.
-
-
-By [@o0Ignition0o](https://github.com/o0Ignition0o) in https://github.com/apollographql/router/pull/1471
-
-
-
-### Add helm OCI example ([PR #1457](https://github.com/apollographql/router/pull/1457))
-
-Update existing filesystem based example to illustrate how to do the same thing using our OCI stored helm chart.
-
-By [@garypen](https://github.com/garypen) in https://github.com/apollographql/router/pull/1457

apollo-router-benchmarks/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "apollo-router-benchmarks"
-version = "0.14.0"
+version = "0.15.0"
 authors = ["Apollo Graph, Inc. <[email protected]>"]
 edition = "2021"
 license = "LicenseRef-ELv2"

apollo-router-scaffold/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "apollo-router-scaffold"
-version = "0.14.0"
+version = "0.15.0"
 authors = ["Apollo Graph, Inc. <[email protected]>"]
 edition = "2021"
 license = "Elastic-2.0"

apollo-router-scaffold/templates/base/Cargo.toml

@@ -22,7 +22,7 @@ apollo-router = { path ="{{integration_test}}apollo-router" }
 apollo-router = { git="https://github.com/apollographql/router.git", branch="{{branch}}" }
 {{else}}
 # Note if you update these dependencies then also update xtask/Cargo.toml
-apollo-router = { git="https://github.com/apollographql/router.git", tag="v0.14.0" }
+apollo-router = { git="https://github.com/apollographql/router.git", tag="v0.15.0" }
 {{/if}}
 {{/if}}
 async-trait = "0.1.52"

apollo-router-scaffold/templates/base/xtask/Cargo.toml

@@ -2,7 +2,7 @@
 name = "xtask"
 edition = "2021"
 publish = false
-version = "0.14.0"
+version = "0.15.0"
 
 [dependencies]
 # This dependency should stay in line with your router version
@@ -13,7 +13,7 @@ apollo-router-scaffold = { path ="{{integration_test}}apollo-router-scaffold" }
 {{#if branch}}
 apollo-router-scaffold = { git="https://github.com/apollographql/router.git", branch="{{branch}}" }
 {{else}}
-apollo-router-scaffold = { git="https://github.com/apollographql/router.git", tag="v0.14.0"}
+apollo-router-scaffold = { git="https://github.com/apollographql/router.git", tag="v0.15.0"}
 {{/if}}
 {{/if}}
 anyhow = "=1.0.58"

apollo-router/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "apollo-router"
-version = "0.14.0"
+version = "0.15.0"
 authors = ["Apollo Graph, Inc. <[email protected]>"]
 edition = "2021"
 license = "Elastic-2.0"
@@ -107,7 +107,7 @@ reqwest = { version = "0.11.11", default-features = false, features = [
     "json",
     "stream",
 ] }
-router-bridge = { git = "https://github.com/apollographql/federation-rs.git", branch = "geal/defer" }
+router-bridge = { git = "https://github.com/apollographql/federation-rs.git", tag = "defer-alpha1" }
 schemars = { version = "0.8.10", features = ["url"] }
 sha2 = "0.10.2"
 serde = { version = "1.0.139", features = ["derive", "rc"] }

apollo-spaceport/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "apollo-spaceport"
-version = "0.14.0"
+version = "0.15.0"
 authors = ["Apollo Graph, Inc. <[email protected]>"]
 edition = "2021"
 license = "Elastic-2.0"

dockerfiles/tracing/docker-compose.datadog.yml

@@ -3,7 +3,7 @@ services:
 
   apollo-router:
     container_name: apollo-router
-    image: ghcr.io/apollographql/router:v0.14.0
+    image: ghcr.io/apollographql/router:v0.15.0
     volumes:
       - ./supergraph.graphql:/etc/config/supergraph.graphql
       - ./router/datadog.router.yaml:/etc/config/configuration.yaml

dockerfiles/tracing/docker-compose.jaeger.yml

@@ -4,7 +4,7 @@ services:
   apollo-router:
     container_name: apollo-router
     #build: ./router
-    image: ghcr.io/apollographql/router:v0.14.0
+    image: ghcr.io/apollographql/router:v0.15.0
     volumes:
       - ./supergraph.graphql:/etc/config/supergraph.graphql
       - ./router/jaeger.router.yaml:/etc/config/configuration.yaml

dockerfiles/tracing/docker-compose.zipkin.yml

@@ -4,7 +4,7 @@ services:
   apollo-router:
     container_name: apollo-router
     build: ./router
-    image: ghcr.io/apollographql/router:v0.14.0
+    image: ghcr.io/apollographql/router:v0.15.0
     volumes:
       - ./supergraph.graphql:/etc/config/supergraph.graphql
       - ./router/zipkin.router.yaml:/etc/config/configuration.yaml

docs/source/containerization/docker.mdx

@@ -11,7 +11,7 @@ The default behaviour of the router images is suitable for a quickstart or devel
 
 Note: The [docker documentation](https://docs.docker.com/engine/reference/run/) for the run command may be helpful when reading through the examples.
 
-Note: The exact image version to use is your choice depending on which release you wish to use. In the following examples, replace `<image version>` with your chosen version. e.g.: `v0.14.0`
+Note: The exact image version to use is your choice depending on which release you wish to use. In the following examples, replace `<image version>` with your chosen version. e.g.: `v0.15.0`
 
 ## Override the configuration
 
@@ -92,10 +92,10 @@ Usage: build_docker_image.sh [-b] [<release>]
 	Example 1: Building HEAD from the repo
 		build_docker_image.sh -b
 	Example 2: Building tag from the repo
-		build_docker_image.sh -b v0.14.0
+		build_docker_image.sh -b v0.15.0
 	Example 3: Building commit hash from the repo
-		build_docker_image.sh -b 7f7d223f42af34fad35b898d976bc07d0f5440c5
-	Example 4: Building tag v0.14.0 from the released tarball
-		build_docker_image.sh v0.14.0
+		build_docker_image.sh -b 1c220d35acf9ad2537b8edc58c498390b6701d3d
+	Example 4: Building tag v0.15.0 from the released tarball
+		build_docker_image.sh v0.15.0
 ```
 Note: The script has to be run from the `dockerfiles/diy` directory because it makes assumptions about the relative availability of various files. The example uses [distroless images](https://github.com/GoogleContainerTools/distroless) for the final image build. Feel free to modify the script to use images which better suit your own needs.