build(deps): bump @apollo/client from 4.2.5 to 4.2.9 in the graphql group across 1 directory

[dependabot]

Bumps the graphql group with 1 update in the / directory: @apollo/client.

Updates @apollo/client from 4.2.5 to 4.2.9

Release notes

Sourced from @​apollo/client's releases.

@​apollo/client@​4.2.9

Patch Changes

• #13364 2f383e7 Thanks @​atharv-sys32! - Fix a bug where GraphQL variable default values were not applied during cache reads when variables with defaults were explicitly set to undefined. This caused @include/@skip directives to throw "Invalid variable referenced" errors when the variable was passed as undefined instead of being omitted entirely.

• #13367 2b39cc8 Thanks @​jerelmiller! - Fix an issue where some @export queries would not react to cache updates when the fields keyed by exported variables were updated.

@​apollo/client@​4.2.8

Patch Changes

• #13349 501a33b Thanks @​jerelmiller! - Prevent the setTimeout in connectToDevtools that shows the devtools suggestion from firing when the user agent does not match Chrome or Firefox. This check was previously done inside the setTimeout which meant the timer was scheduled for environments where we'd never show the message anyways. For test environments, this could cause flaky tests when that setTimeout outlived the tests and ran after any virtual DOM was torn down and removed.

@​apollo/client@​4.2.7

Patch Changes

• #13320 538c906 Thanks @​jerelmiller! - Cleanup some unused internals. Please file an issue if you notice anything change.

@​apollo/client@​4.2.6

Patch Changes

• #13315 a406cc9 Thanks @​fallintoplace! - Prevent relay multipart subscriptions from issuing a fetch request after serializing the request body fails.

• #13307 abd0781 Thanks @​wolfie! - Speed up cache writes by avoiding a full AST visit of every written field to detect @stream. The check now runs only when the result carries stream info, and only inspects the field node's own directives. As a result, fields that merely contain @stream on a nested field are no longer treated as streamed themselves and now overwrite existing lists like regular fields instead of merging chunk-wise.

Changelog

Sourced from @​apollo/client's changelog.

4.2.9

Patch Changes

• #13364 2f383e7 Thanks @​atharv-sys32! - Fix a bug where GraphQL variable default values were not applied during cache reads when variables with defaults were explicitly set to undefined. This caused @include/@skip directives to throw "Invalid variable referenced" errors when the variable was passed as undefined instead of being omitted entirely.

• #13367 2b39cc8 Thanks @​jerelmiller! - Fix an issue where some @export queries would not react to cache updates when the fields keyed by exported variables were updated.

4.2.8

Patch Changes

• #13349 501a33b Thanks @​jerelmiller! - Prevent the setTimeout in connectToDevtools that shows the devtools suggestion from firing when the user agent does not match Chrome or Firefox. This check was previously done inside the setTimeout which meant the timer was scheduled for environments where we'd never show the message anyways. For test environments, this could cause flaky tests when that setTimeout outlived the tests and ran after any virtual DOM was torn down and removed.

4.2.7

Patch Changes

• #13320 538c906 Thanks @​jerelmiller! - Cleanup some unused internals. Please file an issue if you notice anything change.

4.2.6

Patch Changes

• #13315 a406cc9 Thanks @​fallintoplace! - Prevent relay multipart subscriptions from issuing a fetch request after serializing the request body fails.

• #13307 abd0781 Thanks @​wolfie! - Speed up cache writes by avoiding a full AST visit of every written field to detect @stream. The check now runs only when the result carries stream info, and only inspects the field node's own directives. As a result, fields that merely contain @stream on a nested field are no longer treated as streamed themselves and now overwrite existing lists like regular fields instead of merging chunk-wise.

Commits

• e8b8ff0 Version Packages (#13370)
• 2b39cc8 Fix issue where changes to @export fields did not trigger updates (#13367)
• 2f383e7 fix: apply query variable defaults when undefined is passed explicitly (#13364)
• 8518419 chore(deps): update zizmorcore/zizmor-action action to v0.6.0 (#13356)
• 8426bee Update events for summit 2026 (#13338)
• f25b12a Version Packages (#13350)
• 501a33b Prevent setTimeout from firing if we can't match devtools user agent (#13349)
• 4bb6df7 chore(deps): update actions/stale action to v10.4.0 (#13341)
• 544daab Version Packages (#13332)
• 538c906 Remove lastRequestId on QueryInfo (#13320)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@apollo/client	4.2.9	🟢 6.6	Details Check Score Reason Code-Review ⚠️ 2 Found 4/15 approved changesets -- score normalized to 2 Maintained 🟢 10 30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 6 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 6 SAST tool is not run on all commits -- score normalized to 6

Scanned Files

• package-lock.json

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud