June 25, 2026

@graphql-hive/gateway@2.10.0

Minor Changes

• #2433 6ff1264 Thanks @enisdenjo! - Rate limiting now supports per-field identity via identifier template strings and per-field identifyFn with argument access

  identifier template string

  Use {args.argName} or {context.propName} dot-path interpolation to build the rate limit key inline, without writing a function:

  import { defineConfig } from '@graphql-hive/gateway';
  
  export const gatewayConfig = defineConfig({
    rateLimiting: [
      {
        type: 'Query',
        field: 'getProduct',
        max: 10,
        ttl: 60000,
        identifier: '{args.id}',
      },
      {
        type: 'Query',
        field: 'search',
        max: 30,
        ttl: 60000,
        identifier: '{context.ip}',
      },
    ],
  });

  Per-field identifyFn with argument values

  Override the identity function for a single field and receive the resolved argument values as a second parameter, useful for rate limiting unauthenticated requests by argument value:

  import { defineConfig } from '@graphql-hive/gateway';
  
  export const gatewayConfig = defineConfig({
    rateLimiting: [
      {
        type: 'Query',
        field: 'getProduct', // getProduct(id: ID!): Product!
        max: 10,
        ttl: 60000,
        identifyFn: (ctx, args) => String(args.id),
      },
    ],
  });

Patch Changes

• #2433 6ff1264 Thanks @enisdenjo! - dependencies updates:

  • Added dependency @envelop/rate-limiter@^10.1.0 ↗︎ (to dependencies)
  • Added dependency @graphql-mesh/string-interpolation@^0.5.17 ↗︎ (to dependencies)
  • Added dependency @whatwg-node/promise-helpers@^1.3.2 ↗︎ (to dependencies)
  • Removed dependency @graphql-mesh/plugin-rate-limit@^0.106.14 ↗︎ (from dependencies)

• #2442 bff3ce4 Thanks @dependabot! - dependencies updates:

  • Updated dependency @opentelemetry/api-logs@^0.219.0 ↗︎ (from ^0.218.0, in dependencies)
  • Updated dependency @opentelemetry/sampler-jaeger-remote@^0.219.0 ↗︎ (from ^0.218.0, in dependencies)
  • Updated dependency @opentelemetry/sdk-logs@^0.219.0 ↗︎ (from ^0.218.0, in dependencies)

• #2433 6ff1264 Thanks @enisdenjo! - host header was removed from the fallback chain of default rate limiting identifier as it identifies the server, not the caller

• #2433 6ff1264 Thanks @enisdenjo! - Add type definitions for Redis Cluster configuration

• #2433 6ff1264 Thanks @enisdenjo! - Rate limiter default identity now checks WHATWG Request for authorization and x-forwarded-for, ensuring correct caller identification in GraphQL Yoga, Cloudflare Workers, Bun, and other non-Node environments

• Updated dependencies [bff3ce4]:

  • @graphql-hive/plugin-opentelemetry@1.4.32

@graphql-hive/nestjs@2.0.80

Patch Changes

• Updated dependencies [6ff1264, bff3ce4, 6ff1264, 6ff1264, 6ff1264, 6ff1264]:
  • @graphql-hive/gateway@2.10.0

@graphql-hive/plugin-opentelemetry@1.4.32

Patch Changes

• #2442 bff3ce4 Thanks @dependabot! - dependencies updates:

  • Updated dependency @opentelemetry/api-logs@^0.219.0 ↗︎ (from ^0.218.0, in dependencies)
  • Updated dependency @opentelemetry/auto-instrumentations-node@^0.77.0 ↗︎ (from ^0.76.0, in dependencies)
  • Updated dependency @opentelemetry/exporter-trace-otlp-grpc@^0.219.0 ↗︎ (from ^0.218.0, in dependencies)
  • Updated dependency @opentelemetry/exporter-trace-otlp-http@^0.219.0 ↗︎ (from ^0.218.0, in dependencies)
  • Updated dependency @opentelemetry/instrumentation@^0.219.0 ↗︎ (from ^0.218.0, in dependencies)
  • Updated dependency @opentelemetry/sdk-logs@^0.219.0 ↗︎ (from ^0.218.0, in dependencies)
  • Updated dependency @opentelemetry/sdk-node@^0.219.0 ↗︎ (from ^0.218.0, in dependencies)

@graphql-hive/router-runtime@1.4.12

Patch Changes

• #2441 c23fe21 Thanks @dependabot! - dependencies updates:

  • Updated dependency @graphql-hive/router-query-planner@^0.0.35 ↗︎ (from ^0.0.28, in dependencies)