apollo-server-core

Core engine for Apollo GraphQL server

apollo-server-core@3.13.0 was published on 2023-11-14. Its manifest declares 23 runtime dependencies and 1 peer requirement. Type declarations are bundled according to the package metadata. The declared Node.js requirement is >=12.0.

Deprecated: The `apollo-server-core` package is part of Apollo Server v2 and v3, which are now end-of-life (as of October 22nd 2023 and October 22nd 2024, respectively). This package's functionality is now found in the `@apollo/server` package. See https://www.apollographql.com/docs/apollo-server/previous-versions/ for more details.

All apollo-server-core versions · Permanent reference to 3.13.0

Package specifications

Version	3.13.0
License declaration	MIT
Published	2023-11-14T00:17:04.028Z
Node.js requirement	>=12.0
Type declarations	Bundled declarations
Runtime dependency count	23
Peer requirement count	1
Optional dependency count	0
Minified size	Measurement not available yet
Minified + gzip	Measurement not available yet
Unpacked distribution size	940.67 KiB
Published file count	204
Package type	Not declared
ES module entry	Not declared
Default entry	dist/index.js
Side effects declaration	Not declared
Direct advisories	1
Resolved graph dependencies	96
Repository stars	13954
Repository forks	2001

Install apollo-server-core 3.13.0

npm install apollo-server-core@3.13.0
pnpm add apollo-server-core@3.13.0
yarn add apollo-server-core@3.13.0

Runtime dependencies

uuid ^9.0.0
sha.js ^2.4.11
loglevel ^1.6.8
lru-cache ^6.0.0
async-retry ^1.2.1
graphql-tag ^2.11.0
whatwg-mimetype ^3.0.0
apollo-datasource ^3.3.2
apollo-server-env ^4.2.1
@graphql-tools/mock ^8.1.2
@josephg/resolvable ^1.0.0
apollo-server-types ^3.8.0
@apollo/utils.logger ^1.0.0
apollo-server-errors ^3.3.1
@graphql-tools/schema ^8.0.0
node-abort-controller ^3.0.1
apollo-reporting-protobuf ^3.4.0
apollo-server-plugin-base ^3.7.2
fast-json-stable-stringify ^2.1.0
@apollo/utils.keyvaluecache ^1.0.1
@apollographql/apollo-tools ^0.5.3
@apollo/utils.usagereporting ^1.0.0
@apollographql/graphql-playground-html 1.6.29

Peer requirements

graphql ^15.3.0 || ^16.0.0

Optional dependencies

None declared

Resolved dependency graph

This deps.dev graph describes a generic 64-bit Linux environment, not your application lockfile.

@apollo/protobufjs@1.2.6 — indirect
@apollo/protobufjs@1.2.8 — indirect
@apollo/usage-reporting-protobuf@4.1.2 — indirect
@apollo/utils.dropunuseddefinitions@1.1.0 — indirect
@apollo/utils.keyvaluecache@1.0.2 — direct
@apollo/utils.logger@1.0.1 — direct
@apollo/utils.printwithreducedwhitespace@1.1.0 — indirect
@apollo/utils.removealiases@1.0.0 — indirect
@apollo/utils.sortast@1.1.0 — indirect
@apollo/utils.stripsensitiveliterals@1.2.0 — indirect
@apollo/utils.usagereporting@1.0.1 — direct
@apollographql/apollo-tools@0.5.4 — direct
@apollographql/graphql-playground-html@1.6.29 — direct
@graphql-tools/merge@8.3.1 — indirect
@graphql-tools/merge@8.4.2 — indirect
@graphql-tools/mock@8.7.20 — direct
@graphql-tools/schema@8.5.1 — direct
@graphql-tools/schema@9.0.19 — indirect
@graphql-tools/utils@8.9.0 — indirect
@graphql-tools/utils@9.2.1 — indirect
@graphql-typed-document-node/core@3.2.0 — indirect
@josephg/resolvable@1.0.1 — direct
@protobufjs/aspromise@1.1.2 — indirect
@protobufjs/base64@1.1.2 — indirect
@protobufjs/codegen@2.0.5 — indirect
@protobufjs/eventemitter@1.1.1 — indirect
@protobufjs/fetch@1.1.1 — indirect
@protobufjs/float@1.0.2 — indirect
@protobufjs/inquire@1.1.2 — indirect
@protobufjs/path@1.1.2 — indirect
@protobufjs/pool@1.1.0 — indirect
@protobufjs/utf8@1.1.2 — indirect
@types/long@4.0.2 — indirect
@types/node@10.17.60 — indirect
apollo-datasource@3.3.2 — direct
apollo-reporting-protobuf@3.4.0 — direct
apollo-server-env@4.2.1 — direct
apollo-server-errors@3.3.1 — direct
apollo-server-plugin-base@3.7.2 — direct
apollo-server-types@3.8.0 — direct
async-function@1.0.0 — indirect
async-generator-function@1.0.0 — indirect
async-retry@1.3.3 — direct
available-typed-arrays@1.0.7 — indirect
call-bind@1.0.9 — indirect
call-bind-apply-helpers@1.0.2 — indirect
call-bound@1.0.4 — indirect
commander@2.20.3 — indirect
cssfilter@0.0.10 — indirect
define-data-property@1.1.4 — indirect
dunder-proto@1.0.1 — indirect
es-define-property@1.0.1 — indirect
es-errors@1.3.0 — indirect
es-object-atoms@1.1.2 — indirect
fast-json-stable-stringify@2.1.0 — direct
for-each@0.3.5 — indirect
function-bind@1.1.2 — indirect
generator-function@2.0.1 — indirect
get-intrinsic@1.3.1 — indirect
get-proto@1.0.1 — indirect
gopd@1.2.0 — indirect
graphql-tag@2.12.7 — direct
has-property-descriptors@1.0.2 — indirect
has-symbols@1.1.0 — indirect
has-tostringtag@1.0.2 — indirect
hasown@2.0.4 — indirect
inherits@2.0.4 — indirect
is-callable@1.2.7 — indirect
is-typed-array@1.1.15 — indirect
isarray@2.0.5 — indirect
lodash.sortby@4.7.0 — indirect
loglevel@1.9.2 — direct
long@4.0.0 — indirect
lru-cache@6.0.0 — direct
lru-cache@7.13.1 — indirect
math-intrinsics@1.1.0 — indirect
node-abort-controller@3.1.1 — direct
node-fetch@2.7.0 — indirect
possible-typed-array-names@1.1.0 — indirect
retry@0.13.1 — indirect
safe-buffer@5.2.1 — indirect
set-function-length@1.2.2 — indirect
sha.js@2.4.12 — direct
to-buffer@1.2.2 — indirect
tr46@0.0.3 — indirect
tslib@2.8.1 — indirect
typed-array-buffer@1.0.3 — indirect
uuid@9.0.1 — direct
value-or-promise@1.0.11 — indirect
value-or-promise@1.0.12 — indirect
webidl-conversions@3.0.1 — indirect
whatwg-mimetype@3.0.0 — direct
whatwg-url@5.0.0 — indirect
which-typed-array@1.1.24 — indirect
xss@1.0.17 — indirect
yallist@4.0.0 — indirect

How to interpret the specifications

Bundlephobia measurements use its standard package build and may exclude peer dependencies. Unpacked npm distribution size includes shipped files and is a different measurement. Module declarations do not prove tree-shaking or runtime compatibility.

Advisories apply to this package version directly; transitive dependencies need separate inspection. Repository signals describe the whole repository and are current observations, including on historical-version pages.

Known direct advisories

GHSA-9q82-xgwf-vj6h

OpenSSF repository checks

Provider assessment: 2026-08-24T00:00:00Z. These are repository checks, not a jsL maintenance score.

Dangerous-Workflow	10/10 — no dangerous workflow patterns detected
Maintained	2/10 — 1 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 2
Code-Review	3/10 — Found 8/21 approved changesets -- score normalized to 3
Binary-Artifacts	10/10 — no binaries found in the repo
CII-Best-Practices	0/10 — no effort to earn an OpenSSF best practices badge detected
Token-Permissions	9/10 — detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	4/10 — dependency not pinned by hash detected -- score normalized to 4
License	10/10 — license file detected
Security-Policy	10/10 — security policy file detected
Fuzzing	0/10 — project is not fuzzed
SAST	0/10 — SAST tool is not run on all commits -- score normalized to 0

Evidence and freshness

https://registry.npmjs.org/apollo-server-core/3.13.0 — retrieved 2026-10-29T13:01:36.886Z
https://api.deps.dev/v3/projects/github.com%2Fapollographql%2Fapollo-server — retrieved 2026-10-29T09:32:16.976Z
https://api.deps.dev/v3/systems/npm/packages/apollo-server-core/versions/3.13.0 — retrieved 2026-10-29T13:01:37.541Z
https://api.deps.dev/v3/systems/npm/packages/apollo-server-core/versions/3.13.0:dependencies — retrieved 2026-10-29T13:01:37.570Z