chore: cap major supported version of @apollo/server to v4 (#4838)

Author: david-luna

.github/dependabot.yml

@@ -37,6 +37,8 @@ updates:
       # Packages whose newer versions are not supported by the agent
       - dependency-name: "koa-router" # support is >=5.2.0 <14.0.0
       - dependency-name: "redis" # support is >=2.0.0 <5
+      - dependency-name: "@apollo/server" # support is >=4.0.0 <5 so we will ignore any major release
+        update-types: ["version-update:semver-major"]
     groups:
       aws-sdk:
         dependency-type: "development"

docs/reference/supported-technologies.md

@@ -73,7 +73,7 @@ By default transactions are named based on their matched HTTP route if the frame
 | --- | --- | --- |
 | [express-graphql](https://www.npmjs.com/package/express-graphql) | >=0.6.1 <0.13.0 | Will name all transactions by the GraphQL query name. There is a [known issue with node <10.4](https://github.com/elastic/apm-agent-nodejs/issues/2516). This module is deprecated and is no longer tested. |
 | [apollo-server-express](https://www.npmjs.com/package/apollo-server-express) | >=2.0.4 <4 | Will name all transactions by the GraphQL query name. Versions before 2.9.6 are no longer tested. |
-| [@apollo/server](https://www.npmjs.com/package/@apollo/server) | >=4.0.0 | Will name all transactions by the GraphQL query name |
+| [@apollo/server](https://www.npmjs.com/package/@apollo/server) | >=4.0.0 <5 | Will name all transactions by the GraphQL query name |
 
 
 ## Tracing and Instrumentation [compatibility-tracing-and-instrumentation]

docs/release-notes/index.md

@@ -60,6 +60,10 @@ To check for security updates, go to [Security announcements for the Elastic sta
     export ELASTIC_APM_SANITIZE_FIELD_NAMES=password,passwd,pwd,secret,*key,*token*,*session*,*credit*,*card*,*auth*,set-cookie,*principal*,pw,pass,connect.sid
     ```
 
+### Chores [next-chores]
+
+* Cap the major supported version of `@apollo/server` to v4.
+
 ## 4.14.0 [4-14-0]
 **Release date:** Sep 25, 2025
 

lib/instrumentation/modules/@apollo/server.js

@@ -6,13 +6,22 @@
 
 'use strict';
 
+const semver = require('semver');
 const shimmer = require('../../shimmer');
 
-module.exports = function (apolloServer, agent, { enabled }) {
+module.exports = function (apolloServer, agent, { version, enabled }) {
   if (!enabled) {
     return apolloServer;
   }
 
+  if (!semver.satisfies(version, '^4.0.0')) {
+    agent.logger.debug(
+      '@apollo/server version %s not supported, skipping @apollo/server instrumentation',
+      version,
+    );
+    return apolloServer;
+  }
+
   function wrapExecuteHTTPGraphQLRequest(orig) {
     return function wrappedExecuteHTTPGraphQLRequest() {
       var trans = agent._instrumentation.currTransaction();