chore(deps): bump apollo-router from 2.9.0 to 2.10.0

[dependabot]

Bumps apollo-router from 2.9.0 to 2.10.0.

Release notes

Sourced from apollo-router's releases.

v2.10.0 (LTS)

Long-Term Support

This release is marked for LTS under the v2026.1 LTS Policy for the GraphOS Runtime. It will be supported until September 30, 2026 with patch updates.

🚀 Features

Response caching is now Generally Available 🎉 ([PR #8678](apollographql/router#8678))

Response caching is now Generally Available (GA) and ready for production use!

Response caching enables the router to cache subgraph query responses using Redis, improving query latency and reducing load on your underlying services. Unlike traditional HTTP caching solutions, response caching provides GraphQL-aware caching at the entity and root field level, making cached data reusable across different users and queries.

For complete documentation, configuration options, and quickstart guide, see the response caching documentation.

Key benefits

• Improved performance: Cache origin responses and reuse them across queries to reduce latency
• Reduced subgraph load: Minimize redundant requests to your subgraphs by serving cached data
• Entity-level caching: Cache individual entity representations independently, enabling fine-grained control over data freshness
• Flexible cache control: Set different TTLs for different types of data based on @cacheControl directives or Cache-Control response headers
• Privacy-aware: Share cached data across users while maintaining privacy for personalized data
• Active cache invalidation: Tag cached data with @cacheTag and invalidate specific cache entries via HTTP endpoint when data changes

What's cached

The router caches two kinds of data:

• Root query fields: Cached as complete units (the entire response for these root fields)
• Entity representations: Cached independently—each origin's contribution to an entity is cached separately and can be reused across different queries

Additional features

• Cache debugger: See exactly what's being cached during development
• Redis cluster support: Scale your cache with Redis cluster deployments and read replicas
• Comprehensive metrics: Monitor cache performance with detailed Redis-specific metrics

By @​bnjjj in apollographql/router#8678

Support Redis read replicas ([PR #8405](apollographql/router#8405))

Read-only queries are now sent to replica nodes when using clustered Redis. Previously, all commands were sent to the primary nodes.

This change applies to all Redis caches, including the query plan cache and the response cache.

By @​carodewig in apollographql/router#8405

Enable HTTP/2 header size limits for TCP and UDS ([PR #8673](apollographql/router#8673))

The router's HTTP/2 header size limit configuration option now applies to requests using TCP and UDS (Unix domain sockets). Previously, this setting only worked for TLS connections.

... (truncated)

Changelog

Sourced from apollo-router's changelog.

[2.10.0] - 2025-12-11

🚀 Features

Response caching is now Generally Available 🎉 ([PR #8678](apollographql/router#8678))

Response caching is now Generally Available (GA) and ready for production use!

Response caching enables the router to cache subgraph query responses using Redis, improving query latency and reducing load on your underlying services. Unlike traditional HTTP caching solutions, response caching provides GraphQL-aware caching at the entity and root field level, making cached data reusable across different users and queries.

For complete documentation, configuration options, and quickstart guide, see the response caching documentation.

Key benefits

• Improved performance: Cache origin responses and reuse them across queries to reduce latency
• Reduced subgraph load: Minimize redundant requests to your subgraphs by serving cached data
• Entity-level caching: Cache individual entity representations independently, enabling fine-grained control over data freshness
• Flexible cache control: Set different TTLs for different types of data based on @cacheControl directives or Cache-Control response headers
• Privacy-aware: Share cached data across users while maintaining privacy for personalized data
• Active cache invalidation: Tag cached data with @cacheTag and invalidate specific cache entries via HTTP endpoint when data changes

What's cached

The router caches two kinds of data:

• Root query fields: Cached as complete units (the entire response for these root fields)
• Entity representations: Cached independently—each origin's contribution to an entity is cached separately and can be reused across different queries

Additional features

• Cache debugger: See exactly what's being cached during development
• Redis cluster support: Scale your cache with Redis cluster deployments and read replicas
• Comprehensive metrics: Monitor cache performance with detailed Redis-specific metrics

By @​bnjjj in apollographql/router#8678

Support Redis read replicas ([PR #8405](apollographql/router#8405))

Read-only queries are now sent to replica nodes when using clustered Redis. Previously, all commands were sent to the primary nodes.

This change applies to all Redis caches, including the query plan cache and the response cache.

By @​carodewig in apollographql/router#8405

Enable HTTP/2 header size limits for TCP and UDS ([PR #8673](apollographql/router#8673))

The router's HTTP/2 header size limit configuration option now applies to requests using TCP and UDS (Unix domain sockets). Previously, this setting only worked for TLS connections.

By @​aaronArinder in apollographql/router#8673

🐛 Fixes

... (truncated)

Commits

• 696b1e1 release: v2.10.0
• f2f3b20 prep release: v2.10.0 (#8758)
• 942ccc0 prep release: v2.10.0-rc.0
• 6223c9e Start v2.10.0 PR
• 123d013 Put response cache in GA and remove preview_ prefix (#8678)
• ccbf23d Fix empty @join__directive(graphs: [], ...) bug (#8721)
• 990111b docs: Point Federation Version Support doc to Changelog (#8689)
• 465c2d0 docs: Document early CSRF enforcement changes (#8732)
• 5cb49ed fix(composition): Enable and debug tests for post-merge validations (#8719)
• d86bf88 chore(deny.toml): add rustsec-2025-0134 for non-maint of rustls-pemfile (#8731)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dotansimha]

@kamilkisiela I think we prefer not to merge this one, and use only lockfile for this dependency, right?

[github-actions]

🐋 This PR was built and pushed to the following Docker images:

Targets: build

Platforms: linux/arm64

Image Tag: 7aa9569b2762442808542f62d28b1143ca090308

[github-actions]

🐋 This PR was built and pushed to the following Docker images:

Targets: apollo-router-hive-build

Platforms: linux/amd64

Image Tag: ffa976647de00e15bf582610301356577d251982