Repository: apollographql/apollo-server
Pull request #7509 (2023-04-15 07:08:54)

chore(deps): update dependency graphql-http to v1.18.0
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [graphql-http](https://togithub.com/graphql/graphql-http) | [`1.17.1` -> `1.18.0`](https://renovatebot.com/diffs/npm/graphql-http/1.17.1/1.18.0) | [![age](https://badges.renovateapi.com/packages/npm/graphql-http/1.18.0/age-slim)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://badges.renovateapi.com/packages/npm/graphql-http/1.18.0/adoption-slim)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://badges.renovateapi.com/packages/npm/graphql-http/1.18.0/compatibility-slim/1.17.1)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://badges.renovateapi.com/packages/npm/graphql-http/1.18.0/confidence-slim/1.17.1)](https://docs.renovatebot.com/merge-confidence/) |

---

### Release Notes

<details>
<summary>graphql/graphql-http</summary>

### [`v1.18.0`](https://togithub.com/graphql/graphql-http/blob/HEAD/CHANGELOG.md#&#8203;1180-httpsgithubcomgraphqlgraphql-httpcomparev1171v1180-2023-04-14)

[Compare Source](https://togithub.com/graphql/graphql-http/compare/v1.17.1...v1.18.0)

##### Bug Fixes

-   **audits/server:** Avoid auditing non well-formatted GraphQL-over-HTTP requests ([#&#8203;62](https://togithub.com/graphql/graphql-http/issues/62)) ([d72e344](https://togithub.com/graphql/graphql-http/commit/d72e3444a719c0a9710b8a96201f3cc3d9324ffb))
-   **audits/server:** Prefer using POST ([#&#8203;77](https://togithub.com/graphql/graphql-http/issues/77)) ([8cd7dfb](https://togithub.com/graphql/graphql-http/commit/8cd7dfb2e571e7660839681a796ab98fe82f652a))
-   **handler:** Stringify errors by exposing only the message ([cabf8a9](https://togithub.com/graphql/graphql-http/commit/cabf8a98b7e266af15b3e6da1b5d874e8d43a238))

##### Features

-   **audits:** Notices section for optional recommendations ([#&#8203;76](https://togithub.com/graphql/graphql-http/issues/76)) ([b8bdc71](https://togithub.com/graphql/graphql-http/commit/b8bdc71811a5d21a3f8a60b61f61ddf5ee3445ce))
-   **handler:** Error formatter function ([#&#8203;78](https://togithub.com/graphql/graphql-http/issues/78)) ([c0eaeb4](https://togithub.com/graphql/graphql-http/commit/c0eaeb4595abc9d13b624d71a8b72ff22298b706))

#### [1.17.1](https://togithub.com/graphql/graphql-http/compare/v1.17.0...v1.17.1) (2023-03-31)

##### Bug Fixes

-   Add file extensions to imports/exports in ESM type definitions ([d084a8d](https://togithub.com/graphql/graphql-http/commit/d084a8d8e83ac65c8fbc07322ca37a2bea8ac372)), closes [#&#8203;70](https://togithub.com/graphql/graphql-http/issues/70)
-   **audits/server:** Better "must accept UTF-8" test with emoji ([#&#8203;69](https://togithub.com/graphql/graphql-http/issues/69)) ([a322d2c](https://togithub.com/graphql/graphql-http/commit/a322d2c5f457e864ef303a08e8067d65b828f7d2))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/apollographql/apollo-server).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS40MC4wIiwidXBkYXRlZEluVmVyIjoiMzUuNDAuMCJ9-->


netlify[bot]: ### <span aria-hidden="true">👷</span> Deploy Preview for *apollo-server-docs* processing.


|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 60d00d53f2b02f57add89b5daea16fe8fc7d61f4 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/apollo-server-docs/deploys/643a4d897a555d00083d1ff0 |
codesandbox-ci[bot]: This pull request is automatically built and testable in [CodeSandbox](https://codesandbox.io).

  To see build info of the built libraries, click [here](https://ci.codesandbox.io/status/apollographql/apollo-server/pr/7509/builds/368425) or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 60d00d53f2b02f57add89b5daea16fe8fc7d61f4:

|Sandbox| Source |
|--|--|
|[Apollo Server Typescript](https://codesandbox.io/s/apollo-server-typescript-k1ptje)| Configuration |
|[Apollo Server](https://codesandbox.io/s/apollo-server-5cmbmn)| Configuration |


Patch:
diff --git a/.changeset/dirty-seals-breathe.md b/.changeset/dirty-seals-breathe.md
new file mode 100644
index 000000000..d2b1363cf
--- /dev/null
+++ b/.changeset/dirty-seals-breathe.md
@@ -0,0 +1,5 @@
+---
+'@apollo/server-integration-testsuite': patch
+---
+
+Update `graphql-http` dependency
diff --git a/.changeset/honest-donuts-sparkle.md b/.changeset/honest-donuts-sparkle.md
new file mode 100644
index 000000000..4c625583c
--- /dev/null
+++ b/.changeset/honest-donuts-sparkle.md
@@ -0,0 +1,30 @@
+---
+'@apollo/server': minor
+---
+
+In the Apollo Server Landing Page Local config, you can now opt out of the telemetry that Apollo Studio runs in the
+embedded Sandbox & Explorer landing pages. This telemetry includes Google Analytics for event tracking and
+Sentry for error tracking.
+
+Example of the new config option:
+
+```
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+  plugins: [
+    process.env.NODE_ENV === 'production'
+      ? ApolloServerPluginLandingPageProductionDefault({
+          graphRef: 'my-graph-id@my-graph-variant',
+          embed: {
+            runTelemetry: false
+          },
+        })
+      : ApolloServerPluginLandingPageLocalDefault({
+          embed: {
+            runTelemetry: false
+          },
+        }),
+  ],
+});
+```
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 000000000..22dfe6cf8
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,49 @@
+# This file exists primarily to influence scheduled scans that Apollo runs of all repos in Apollo-managed orgs. 
+# This is an Apollo-Internal link, but more information about these scans is available here:
+# https://apollographql.atlassian.net/wiki/spaces/SecOps/pages/81330213/Everything+Static+Application+Security+Testing#Scheduled-Scans.1
+# 
+# Apollo is using Gitleaks (https://github.com/gitleaks/gitleaks) to run these scans.
+# However, this file is not something that Gitleaks natively consumes. This file is an
+# Apollo-convention. Prior to scanning a repo, Apollo merges
+# our standard Gitleaks configuration (which is largely just the Gitleaks-default config) with
+# this file if it exists in a repo. The combined config is then used to scan a repo.
+# 
+# We did this because the natively-supported allowlisting functionality in Gitleaks didn't do everything we wanted
+# or wasn't as robust as we needed. For example, one of the allowlisting options offered by Gitleaks depends on the line number
+# on which a false positive secret exists to allowlist it. (https://github.com/gitleaks/gitleaks#gitleaksignore).
+# This creates a fairly fragile allowlisting mechanism. This file allows us to leverage the full capabilities of the Gitleaks rule syntax
+# to create allowlisting functionality.
+
+
+[[ rules ]]
+    id = "high-entropy-base64"
+    [ rules.allowlist ]
+        commits = [
+            # Allowlist https://github.com/apollographql/apollo-server/blob/48aa02fe3bd6bad0a61ef122acef5fda38920df1/docs/source/getting-started.md?plain=1#L175
+            # This is a blob of data from StackEdit
+            "48aa02fe3bd6bad0a61ef122acef5fda38920df1",
+            # Allowlist https://github.com/apollographql/apollo-server/blob/213acbba32829c83f99f12d81ed9e88f3fe1c8cb/docs/_config.yml#L36
+            # This is a segment key that Apollo SecOps was unable to utilize with Segment
+            "213acbba32829c83f99f12d81ed9e88f3fe1c8cb",
+            
+        ]
+
+[[ rules ]]
+    id = "generic-api-key"
+    [ rules.allowlist ]
+        commits = [
+            # Allowlist https://github.com/apollographql/apollo-server/blob/89da132450677ae69aef156ade4c3a11e3885a33/test/testApolloServer.js#L56
+            # Code comments indicate the value being identified is not a secret
+            "89da132450677ae69aef156ade4c3a11e3885a33",
+            
+        ]
+
+[[ rules ]]
+    id = "private-key"
+    [ rules.allowlist ]
+        commits = [
+            # Allowlist https://github.com/apollographql/apollo-server/blob/aadbeb647485207b408f620a10d8c385ce4ee25f/packages/apollo-server/src/__tests__/stoppable/fixture.key#L1
+            # Based on file path, the private key is part of a test and not actually in-use
+            "aadbeb647485207b408f620a10d8c385ce4ee25f",
+            
+        ]
diff --git a/docs/source/api/plugin/landing-pages.mdx b/docs/source/api/plugin/landing-pages.mdx
index 2b5871604..2a4fcc6de 100644
--- a/docs/source/api/plugin/landing-pages.mdx
+++ b/docs/source/api/plugin/landing-pages.mdx
@@ -221,6 +221,21 @@ These are the fields you can include in the `embed` option you pass to the `Apol
 <tr>
 <td>
 
+###### `runTelemetry`
+
+`boolean`
+
+</td>
+<td>
+
+If `false`, the embedded Explorer rendered by Apollo Server doesn't initialize error or event tracking.
+
+</td>
+</tr>
+
+<tr>
+<td>
+
 ###### `initialState`
 
 `Object`
@@ -600,6 +615,21 @@ If `dark`, the Explorer's dark theme is used. If `light`, the light theme is use
 
 The default value is `dark`.
 
+</td>
+</tr>
+
+<tr>
+<td>
+
+###### `runTelemetry`
+
+`boolean`
+
+</td>
+<td>
+
+If `false`, the embedded Explorer rendered by Apollo Server doesn't initialize error or event tracking.
+
 </td>
 </tr>
 </tbody>
diff --git a/package-lock.json b/package-lock.json
index 7a782b834..62419bb58 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -55,7 +55,7 @@
         "eslint": "8.38.0",
         "eslint-plugin-import": "2.27.5",
         "express": "4.18.2",
-        "glob": "10.0.0",
+        "glob": "10.1.0",
         "graphql": "16.6.0",
         "graphql-tag": "2.12.6",
         "jest": "29.5.0",
@@ -71,7 +71,7 @@
         "qs-middleware": "1.0.3",
         "requisition": "1.7.0",
         "rimraf": "5.0.0",
-        "rollup": "3.20.2",
+        "rollup": "3.20.4",
         "supertest": "6.3.3",
         "test-listen": "1.1.0",
         "ts-jest": "29.1.0",
@@ -8426,15 +8426,15 @@
       }
     },
     "node_modules/glob": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.0.0.tgz",
-      "integrity": "sha512-zmp9ZDC6NpDNLujV2W2n+3lH+BafIVZ4/ct+Yj3BMZTH/+bgm/eVjHzeFLwxJrrIGgjjS2eiQLlpurHsNlEAtQ==",
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.1.0.tgz",
+      "integrity": "sha512-daGobsYuT0G4hng24B5LbeLNvwKZYRhWyDl3RvqqAGZjJnCopWWK6PWnAGBY1M/vdA63QE+jddhZcYp+74Bq6Q==",
       "dev": true,
       "dependencies": {
         "fs.realpath": "^1.0.0",
         "minimatch": "^9.0.0",
         "minipass": "^5.0.0",
-        "path-scurry": "^1.6.4"
+        "path-scurry": "^1.7.0"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -8625,9 +8625,9 @@
       }
     },
     "node_modules/graphql-http": {
-      "version": "1.17.1",
-      "resolved": "https://registry.npmjs.org/graphql-http/-/graphql-http-1.17.1.tgz",
-      "integrity": "sha512-FZyZNd/3sz4n1smEa3A7d/OCPR9iYeqTPypsLjaYu6QbthKuMqZldxSSXVE2p+WwEHWx7EYfeVl4U7LQ7bFYNA==",
+      "version": "1.18.0",
+      "resolved": "https://registry.npmjs.org/graphql-http/-/graphql-http-1.18.0.tgz",
+      "integrity": "sha512-r2sIo6jCTQi1aj7s+Srg7oU3+r5pUUgxgDD5JDZOmFzrbXVGz+yMhIKhvqW0cV10DcnVIFCOzuFuc1qvnjJ7yQ==",
       "engines": {
         "node": ">=12"
       },
@@ -11780,9 +11780,9 @@
       }
     },
     "node_modules/path-scurry": {
-      "version": "1.6.4",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.6.4.tgz",
-      "integrity": "sha512-Qp/9IHkdNiXJ3/Kon++At2nVpnhRiPq/aSvQN+H3U1WZbvNRK0RIQK/o4HMqPoXjpuGJUEWpHSs6Mnjxqh3TQg==",
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.7.0.tgz",
+      "integrity": "sha512-UkZUeDjczjYRE495+9thsgcVgsaCPkaw80slmfVFgllxY+IO8ubTsOpFVjDPROBqJdHfVPUFRHPBV/WciOVfWg==",
       "dev": true,
       "dependencies": {
         "lru-cache": "^9.0.0",
@@ -12549,9 +12549,9 @@
       }
     },
     "node_modules/rollup": {
-      "version": "3.20.2",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-3.20.2.tgz",
-      "integrity": "sha512-3zwkBQl7Ai7MFYQE0y1MeQ15+9jsi7XxfrqwTb/9EK8D9C9+//EBR4M+CuA1KODRaNbFez/lWxA5vhEGZp4MUg==",
+      "version": "3.20.4",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-3.20.4.tgz",
+      "integrity": "sha512-n7J4tuctZXUErM9Uc916httwqmTc63zzCr2+TLCiSCpfO/Xuk3g/marGN1IlRJZi+QF3XMYx75PxXRfZDVgaRw==",
       "dev": true,
       "bin": {
         "rollup": "dist/bin/rollup"
@@ -14495,7 +14495,7 @@
         "@josephg/resolvable": "^1.0.1",
         "body-parser": "^1.20.0",
         "express": "^4.18.1",
-        "graphql-http": "1.17.1",
+        "graphql-http": "1.18.0",
         "graphql-tag": "^2.12.6",
         "loglevel": "^1.8.0",
         "node-fetch": "^2.6.7",
@@ -14813,7 +14813,7 @@
         "@josephg/resolvable": "^1.0.1",
         "body-parser": "^1.20.0",
         "express": "^4.18.1",
-        "graphql-http": "1.17.1",
+        "graphql-http": "1.18.0",
         "graphql-tag": "^2.12.6",
         "loglevel": "^1.8.0",
         "node-fetch": "^2.6.7",
@@ -21107,15 +21107,15 @@
       }
     },
     "glob": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.0.0.tgz",
-      "integrity": "sha512-zmp9ZDC6NpDNLujV2W2n+3lH+BafIVZ4/ct+Yj3BMZTH/+bgm/eVjHzeFLwxJrrIGgjjS2eiQLlpurHsNlEAtQ==",
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.1.0.tgz",
+      "integrity": "sha512-daGobsYuT0G4hng24B5LbeLNvwKZYRhWyDl3RvqqAGZjJnCopWWK6PWnAGBY1M/vdA63QE+jddhZcYp+74Bq6Q==",
       "dev": true,
       "requires": {
         "fs.realpath": "^1.0.0",
         "minimatch": "^9.0.0",
         "minipass": "^5.0.0",
-        "path-scurry": "^1.6.4"
+        "path-scurry": "^1.7.0"
       },
       "dependencies": {
         "brace-expansion": {
@@ -21245,9 +21245,9 @@
       }
     },
     "graphql-http": {
-      "version": "1.17.1",
-      "resolved": "https://registry.npmjs.org/graphql-http/-/graphql-http-1.17.1.tgz",
-      "integrity": "sha512-FZyZNd/3sz4n1smEa3A7d/OCPR9iYeqTPypsLjaYu6QbthKuMqZldxSSXVE2p+WwEHWx7EYfeVl4U7LQ7bFYNA==",
+      "version": "1.18.0",
+      "resolved": "https://registry.npmjs.org/graphql-http/-/graphql-http-1.18.0.tgz",
+      "integrity": "sha512-r2sIo6jCTQi1aj7s+Srg7oU3+r5pUUgxgDD5JDZOmFzrbXVGz+yMhIKhvqW0cV10DcnVIFCOzuFuc1qvnjJ7yQ==",
       "requires": {}
     },
     "graphql-request": {
@@ -23460,9 +23460,9 @@
       "dev": true
     },
     "path-scurry": {
-      "version": "1.6.4",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.6.4.tgz",
-      "integrity": "sha512-Qp/9IHkdNiXJ3/Kon++At2nVpnhRiPq/aSvQN+H3U1WZbvNRK0RIQK/o4HMqPoXjpuGJUEWpHSs6Mnjxqh3TQg==",
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.7.0.tgz",
+      "integrity": "sha512-UkZUeDjczjYRE495+9thsgcVgsaCPkaw80slmfVFgllxY+IO8ubTsOpFVjDPROBqJdHfVPUFRHPBV/WciOVfWg==",
       "dev": true,
       "requires": {
         "lru-cache": "^9.0.0",
@@ -23973,9 +23973,9 @@
       }
     },
     "rollup": {
-      "version": "3.20.2",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-3.20.2.tgz",
-      "integrity": "sha512-3zwkBQl7Ai7MFYQE0y1MeQ15+9jsi7XxfrqwTb/9EK8D9C9+//EBR4M+CuA1KODRaNbFez/lWxA5vhEGZp4MUg==",
+      "version": "3.20.4",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-3.20.4.tgz",
+      "integrity": "sha512-n7J4tuctZXUErM9Uc916httwqmTc63zzCr2+TLCiSCpfO/Xuk3g/marGN1IlRJZi+QF3XMYx75PxXRfZDVgaRw==",
       "dev": true,
       "requires": {
         "fsevents": "~2.3.2"
diff --git a/package.json b/package.json
index 2ad4954c7..6d1f409c9 100644
--- a/package.json
+++ b/package.json
@@ -82,7 +82,7 @@
     "eslint": "8.38.0",
     "eslint-plugin-import": "2.27.5",
     "express": "4.18.2",
-    "glob": "10.0.0",
+    "glob": "10.1.0",
     "graphql": "16.6.0",
     "graphql-tag": "2.12.6",
     "jest": "29.5.0",
@@ -98,7 +98,7 @@
     "qs-middleware": "1.0.3",
     "requisition": "1.7.0",
     "rimraf": "5.0.0",
-    "rollup": "3.20.2",
+    "rollup": "3.20.4",
     "supertest": "6.3.3",
     "test-listen": "1.1.0",
     "ts-jest": "29.1.0",
diff --git a/packages/server/src/plugin/landingPage/default/getEmbeddedHTML.ts b/packages/server/src/plugin/landingPage/default/getEmbeddedHTML.ts
index 51e9e4162..9340862d2 100644
--- a/packages/server/src/plugin/landingPage/default/getEmbeddedHTML.ts
+++ b/packages/server/src/plugin/landingPage/default/getEmbeddedHTML.ts
@@ -46,10 +46,13 @@ export const getEmbeddedExplorerHTML = (
     endpointUrl: string;
 
     includeCookies?: boolean; // defaults to 'false'
+
+    runTelemetry?: boolean;
   }
-  const productionLandingPageConfigOrDefault = {
+  const productionLandingPageEmbedConfigOrDefault = {
     displayOptions: {},
     persistExplorerState: false,
+    runTelemetry: true,
     ...(typeof config.embed === 'boolean' ? {} : config.embed),
   };
   const embeddedExplorerParams: Omit<
@@ -73,13 +76,14 @@ export const getEmbeddedExplorerHTML = (
           }
         : {}),
       displayOptions: {
-        ...productionLandingPageConfigOrDefault.displayOptions,
+        ...productionLandingPageEmbedConfigOrDefault.displayOptions,
       },
     },
     persistExplorerState:
-      productionLandingPageConfigOrDefault.persistExplorerState,
+      productionLandingPageEmbedConfigOrDefault.persistExplorerState,
     includeCookies: config.includeCookies,
     runtime: apolloServerVersion,
+    runTelemetry: productionLandingPageEmbedConfigOrDefault.runTelemetry,
   };
 
   return `
@@ -119,12 +123,36 @@ export const getEmbeddedSandboxHTML = (
   config: ApolloServerPluginEmbeddedLandingPageLocalDefaultOptions,
   apolloServerVersion: string,
 ) => {
-  const endpointIsEditable =
-    typeof config.embed === 'boolean'
-      ? false
-      : typeof config.embed?.endpointIsEditable === 'boolean'
-      ? config.embed?.endpointIsEditable
-      : false;
+  const localDevelopmentEmbedConfigOrDefault = {
+    runTelemetry: true,
+    endpointIsEditable: false,
+    initialState: {},
+    ...(typeof config.embed === 'boolean' ? {} : config.embed ?? {}),
+  };
+  const embeddedSandboxConfig = {
+    target: '#embeddableSandbox',
+    initialState: {
+      ...('document' in config || 'headers' in config || 'variables' in config
+        ? {
+            document: config.document,
+            variables: config.variables,
+            headers: config.headers,
+          }
+        : {}),
+      ...('collectionId' in config
+        ? {
+            collectionId: config.collectionId,
+            operationId: config.operationId,
+          }
+        : {}),
+      includeCookies: config.includeCookies,
+      ...localDevelopmentEmbedConfigOrDefault.initialState,
+    },
+    hideCookieToggle: false,
+    endpointIsEditable: localDevelopmentEmbedConfigOrDefault.endpointIsEditable,
+    runtime: apolloServerVersion,
+    runTelemetry: localDevelopmentEmbedConfigOrDefault.runTelemetry,
+  };
   return `
 <div class="fallback">
   <h1>Welcome to Apollo Server</h1>
@@ -146,42 +174,13 @@ id="embeddableSandbox"
   )}"></script>
 <script>
   var initialEndpoint = window.location.href;
-  new window.EmbeddedSandbox({
-    target: '#embeddableSandbox',
-    initialEndpoint,
-    initialState: ${getConfigStringForHtml({
-      ...('document' in config || 'headers' in config || 'variables' in config
-        ? {
-            document: config.document,
-            variables: config.variables,
-            headers: config.headers,
-          }
-        : {}),
-      ...('collectionId' in config
-        ? {
-            collectionId: config.collectionId,
-            operationId: config.operationId,
-          }
-        : {}),
-      includeCookies: config.includeCookies,
-      ...(typeof config.embed !== 'boolean' &&
-      config.embed?.initialState?.pollForSchemaUpdates !== undefined
-        ? {
-            pollForSchemaUpdates:
-              config.embed?.initialState?.pollForSchemaUpdates,
-          }
-        : {}),
-      ...(typeof config.embed !== 'boolean' &&
-      config.embed?.initialState?.sharedHeaders !== undefined
-        ? {
-            sharedHeaders: config.embed?.initialState?.sharedHeaders,
-          }
-        : {}),
-    })},
-    hideCookieToggle: false,
-    endpointIsEditable: ${endpointIsEditable},
-    runtime: '${apolloServerVersion}'
-  });
+  var embeddedSandboxConfig = ${getConfigStringForHtml(embeddedSandboxConfig)};
+  new window.EmbeddedSandbox(
+    {
+      ...embeddedSandboxConfig,
+      initialEndpoint,
+    }
+  );
 </script>
 `;
 };
diff --git a/packages/server/src/plugin/landingPage/default/types.ts b/packages/server/src/plugin/landingPage/default/types.ts
index a8d3a9705..e13451f40 100644
--- a/packages/server/src/plugin/landingPage/default/types.ts
+++ b/packages/server/src/plugin/landingPage/default/types.ts
@@ -52,6 +52,7 @@ export type ApolloServerPluginLandingPageDefaultBaseOptions = {
   footer?: boolean;
 
   includeCookies?: boolean;
+
   // For Apollo use only.
   __internal_apolloStudioEnv__?: 'staging' | 'prod';
 };
@@ -106,6 +107,10 @@ export type ApolloServerPluginEmbeddedLandingPageProductionDefaultOptions =
   } & InitialStateForEmbeds;
 
 type EmbeddableSandboxOptions = {
+  /**
+   * Set to false to disable running telemetry in Apollo Studio from the landing pages.
+   */
+  runTelemetry?: boolean;
   initialState?: {
     /**
      * If true, the embedded Sandbox periodically polls your initialEndpoint for schema updates.
@@ -136,6 +141,10 @@ type EmbeddableSandboxOptions = {
 };
 
 type EmbeddableExplorerOptions = {
+  /**
+   * Set to false to disable running telemetry in Apollo Studio from the landing pages.
+   */
+  runTelemetry?: boolean;
   /**
    * Display options can be configured for the embedded Explorer.
    */
@@ -172,7 +181,7 @@ type EmbeddableExplorerOptions = {
    *
    * The default value is false.
    */
-  persistExplorerState: boolean;
+  persistExplorerState?: boolean;
 };
 
 export type ApolloServerPluginLandingPageLocalDefaultOptions =


Test patch:
diff --git a/packages/integration-testsuite/package.json b/packages/integration-testsuite/package.json
index af169034e..9d2b9b771 100644
--- a/packages/integration-testsuite/package.json
+++ b/packages/integration-testsuite/package.json
@@ -36,7 +36,7 @@
     "@josephg/resolvable": "^1.0.1",
     "body-parser": "^1.20.0",
     "express": "^4.18.1",
-    "graphql-http": "1.17.1",
+    "graphql-http": "1.18.0",
     "graphql-tag": "^2.12.6",
     "loglevel": "^1.8.0",
     "node-fetch": "^2.6.7",
diff --git a/packages/server/src/__tests__/plugin/landingPage/getEmbeddedExplorerHTML.test.ts b/packages/server/src/__tests__/plugin/landingPage/getEmbeddedExplorerHTML.test.ts
index a47729b91..a8a2f0991 100644
--- a/packages/server/src/__tests__/plugin/landingPage/getEmbeddedExplorerHTML.test.ts
+++ b/packages/server/src/__tests__/plugin/landingPage/getEmbeddedExplorerHTML.test.ts
@@ -53,7 +53,7 @@ describe('Embedded Explorer Landing Page Config HTML', () => {
       </script>
       <script>
         var endpointUrl = window.location.href;
-        var embeddedExplorerConfig = {"graphRef":"graph@current","target":"#embeddableExplorer","initialState":{"document":"query Test { id }","headers":{"authorization":"true"},"variables":{"option":{"a":"val","b":1,"c":true}},"displayOptions":{"showHeadersAndEnvVars":true,"docsPanelState":"open","theme":"light"}},"persistExplorerState":true,"includeCookies":true,"runtime":"@apollo/server@4.0.0"};
+        var embeddedExplorerConfig = {"graphRef":"graph@current","target":"#embeddableExplorer","initialState":{"document":"query Test { id }","headers":{"authorization":"true"},"variables":{"option":{"a":"val","b":1,"c":true}},"displayOptions":{"showHeadersAndEnvVars":true,"docsPanelState":"open","theme":"light"}},"persistExplorerState":true,"includeCookies":true,"runtime":"@apollo/server@4.0.0","runTelemetry":true};
         new window.EmbeddedExplorer({
           ...embeddedExplorerConfig,
           endpointUrl,
@@ -93,7 +93,7 @@ describe('Embedded Explorer Landing Page Config HTML', () => {
       </script>
       <script>
         var endpointUrl = window.location.href;
-        var embeddedExplorerConfig = {"graphRef":"graph@current","target":"#embeddableExplorer","initialState":{"headers":{"authorization":"true"},"displayOptions":{}},"persistExplorerState":false,"includeCookies":true,"runtime":"@apollo/server@4.0.0"};
+        var embeddedExplorerConfig = {"graphRef":"graph@current","target":"#embeddableExplorer","initialState":{"headers":{"authorization":"true"},"displayOptions":{}},"persistExplorerState":false,"includeCookies":true,"runtime":"@apollo/server@4.0.0","runTelemetry":true};
         new window.EmbeddedExplorer({
           ...embeddedExplorerConfig,
           endpointUrl,
@@ -134,7 +134,7 @@ describe('Embedded Explorer Landing Page Config HTML', () => {
       </script>
       <script>
         var endpointUrl = window.location.href;
-        var embeddedExplorerConfig = {"graphRef":"graph@current","target":"#embeddableExplorer","initialState":{"collectionId":"12345","operationId":"abcdef","displayOptions":{}},"persistExplorerState":false,"includeCookies":true,"runtime":"@apollo/server@4.0.0"};
+        var embeddedExplorerConfig = {"graphRef":"graph@current","target":"#embeddableExplorer","initialState":{"collectionId":"12345","operationId":"abcdef","displayOptions":{}},"persistExplorerState":false,"includeCookies":true,"runtime":"@apollo/server@4.0.0","runTelemetry":true};
         new window.EmbeddedExplorer({
           ...embeddedExplorerConfig,
           endpointUrl,
@@ -173,7 +173,49 @@ describe('Embedded Explorer Landing Page Config HTML', () => {
       </script>
       <script>
         var endpointUrl = window.location.href;
-        var embeddedExplorerConfig = {"graphRef":"graph@current","target":"#embeddableExplorer","initialState":{"displayOptions":{}},"persistExplorerState":false,"includeCookies":false,"runtime":"@apollo/server@4.0.0"};
+        var embeddedExplorerConfig = {"graphRef":"graph@current","target":"#embeddableExplorer","initialState":{"displayOptions":{}},"persistExplorerState":false,"includeCookies":false,"runtime":"@apollo/server@4.0.0","runTelemetry":true};
+        new window.EmbeddedExplorer({
+          ...embeddedExplorerConfig,
+          endpointUrl,
+        });
+      </script>
+    `);
+  });
+
+  it('with runTelemetry false', () => {
+    const config: ApolloServerPluginEmbeddedLandingPageProductionDefaultOptions =
+      {
+        includeCookies: true,
+        headers: { authorization: 'true' },
+        embed: {
+          runTelemetry: false,
+        },
+        graphRef: 'graph@current',
+      };
+    expect(getEmbeddedExplorerHTML(cdnVersion, config, apolloServerVersion))
+      .toMatchInlineSnapshot(`
+      <div class="fallback">
+        <h1>
+          Welcome to Apollo Server
+        </h1>
+        <p>
+          Apollo Explorer cannot be loaded; it appears that you might be offline.
+        </p>
+      </div>
+      <style>
+        iframe {
+          background-color: white;
+        }
+      </style>
+      <div style="width: 100vw; height: 100vh; position: absolute; top: 0;"
+           id="embeddableExplorer"
+      >
+      </div>
+      <script src="https://embeddable-explorer.cdn.apollographql.com/_latest/embeddable-explorer.umd.production.min.js?runtime=%40apollo%2Fserver%404.0.0">
+      </script>
+      <script>
+        var endpointUrl = window.location.href;
+        var embeddedExplorerConfig = {"graphRef":"graph@current","target":"#embeddableExplorer","initialState":{"headers":{"authorization":"true"},"displayOptions":{}},"persistExplorerState":false,"includeCookies":true,"runtime":"@apollo/server@4.0.0","runTelemetry":false};
         new window.EmbeddedExplorer({
           ...embeddedExplorerConfig,
           endpointUrl,
diff --git a/packages/server/src/__tests__/plugin/landingPage/getEmbeddedSandboxHTML.test.ts b/packages/server/src/__tests__/plugin/landingPage/getEmbeddedSandboxHTML.test.ts
index bfc7ae3c2..be4f2d095 100644
--- a/packages/server/src/__tests__/plugin/landingPage/getEmbeddedSandboxHTML.test.ts
+++ b/packages/server/src/__tests__/plugin/landingPage/getEmbeddedSandboxHTML.test.ts
@@ -44,14 +44,13 @@ describe('Landing Page Config HTML', () => {
       </script>
       <script>
         var initialEndpoint = window.location.href;
-        new window.EmbeddedSandbox({
-          target: '#embeddableSandbox',
-          initialEndpoint,
-          initialState: {"document":"query Test { id }","variables":{"option":{"a":"val","b":1,"c":true}},"headers":{"authorization":"true"},"includeCookies":true},
-          hideCookieToggle: false,
-          endpointIsEditable: false,
-          runtime: '@apollo/server@4.0.0'
-        });
+        var embeddedSandboxConfig = {"target":"#embeddableSandbox","initialState":{"document":"query Test { id }","variables":{"option":{"a":"val","b":1,"c":true}},"headers":{"authorization":"true"},"includeCookies":true},"hideCookieToggle":false,"endpointIsEditable":false,"runtime":"@apollo/server@4.0.0","runTelemetry":true};
+        new window.EmbeddedSandbox(
+          {
+            ...embeddedSandboxConfig,
+            initialEndpoint,
+          }
+        );
       </script>
     `);
   });
@@ -85,14 +84,13 @@ describe('Landing Page Config HTML', () => {
       </script>
       <script>
         var initialEndpoint = window.location.href;
-        new window.EmbeddedSandbox({
-          target: '#embeddableSandbox',
-          initialEndpoint,
-          initialState: {"headers":{"authorization":"true"},"includeCookies":true},
-          hideCookieToggle: false,
-          endpointIsEditable: false,
-          runtime: '@apollo/server@4.0.0'
-        });
+        var embeddedSandboxConfig = {"target":"#embeddableSandbox","initialState":{"headers":{"authorization":"true"},"includeCookies":true},"hideCookieToggle":false,"endpointIsEditable":false,"runtime":"@apollo/server@4.0.0","runTelemetry":true};
+        new window.EmbeddedSandbox(
+          {
+            ...embeddedSandboxConfig,
+            initialEndpoint,
+          }
+        );
       </script>
     `);
   });
@@ -124,14 +122,13 @@ describe('Landing Page Config HTML', () => {
       </script>
       <script>
         var initialEndpoint = window.location.href;
-        new window.EmbeddedSandbox({
-          target: '#embeddableSandbox',
-          initialEndpoint,
-          initialState: {},
-          hideCookieToggle: false,
-          endpointIsEditable: false,
-          runtime: '@apollo/server@4.0.0'
-        });
+        var embeddedSandboxConfig = {"target":"#embeddableSandbox","initialState":{},"hideCookieToggle":false,"endpointIsEditable":false,"runtime":"@apollo/server@4.0.0","runTelemetry":true};
+        new window.EmbeddedSandbox(
+          {
+            ...embeddedSandboxConfig,
+            initialEndpoint,
+          }
+        );
       </script>
     `);
   });
@@ -165,14 +162,13 @@ describe('Landing Page Config HTML', () => {
       </script>
       <script>
         var initialEndpoint = window.location.href;
-        new window.EmbeddedSandbox({
-          target: '#embeddableSandbox',
-          initialEndpoint,
-          initialState: {"collectionId":"12345","operationId":"abcdef"},
-          hideCookieToggle: false,
-          endpointIsEditable: false,
-          runtime: '@apollo/server@4.0.0'
-        });
+        var embeddedSandboxConfig = {"target":"#embeddableSandbox","initialState":{"collectionId":"12345","operationId":"abcdef"},"hideCookieToggle":false,"endpointIsEditable":false,"runtime":"@apollo/server@4.0.0","runTelemetry":true};
+        new window.EmbeddedSandbox(
+          {
+            ...embeddedSandboxConfig,
+            initialEndpoint,
+          }
+        );
       </script>
     `);
   });
@@ -211,14 +207,13 @@ describe('Landing Page Config HTML', () => {
       </script>
       <script>
         var initialEndpoint = window.location.href;
-        new window.EmbeddedSandbox({
-          target: '#embeddableSandbox',
-          initialEndpoint,
-          initialState: {"includeCookies":false,"pollForSchemaUpdates":false,"sharedHeaders":{"SharedHeaderKey":"SharedHeaderValue"}},
-          hideCookieToggle: false,
-          endpointIsEditable: true,
-          runtime: '@apollo/server@4.0.0'
-        });
+        var embeddedSandboxConfig = {"target":"#embeddableSandbox","initialState":{"includeCookies":false,"pollForSchemaUpdates":false,"sharedHeaders":{"SharedHeaderKey":"SharedHeaderValue"}},"hideCookieToggle":false,"endpointIsEditable":true,"runtime":"@apollo/server@4.0.0","runTelemetry":true};
+        new window.EmbeddedSandbox(
+          {
+            ...embeddedSandboxConfig,
+            initialEndpoint,
+          }
+        );
       </script>
     `);
   });
diff --git a/smoke-test/package.json b/smoke-test/package.json
index 9983b31b1..0eef2b098 100644
--- a/smoke-test/package.json
+++ b/smoke-test/package.json
@@ -8,7 +8,7 @@
     "@rollup/plugin-json": "6.0.0",
     "@rollup/plugin-node-resolve": "15.0.2",
     "@types/make-fetch-happen": "10.0.1",
-    "rollup": "3.20.2"
+    "rollup": "3.20.4"
   },
   "volta": {
     "extends": "../package.json"