Skip to content

REG-1639: Allow unencrypted calls to fetch graph artifacts - #8919

Merged
sirdodger merged 9 commits into
devfrom
clee/allowlist-insecure-artifacts
Mar 2, 2026
Merged

REG-1639: Allow unencrypted calls to fetch graph artifacts#8919
sirdodger merged 9 commits into
devfrom
clee/allowlist-insecure-artifacts

Merge branch 'dev' into clee/allowlist-insecure-artifacts

44f0467
Select commit
Loading
Failed to load commit list.
Apollo Librarian / AI Style Review succeeded Feb 25, 2026 in 17s

Style Review Completed

The pull request has 4 style issues.

Duration: 2824ms
PR URL: #8919
Review Log: View detailed log
Review Comments: The AI has posted 4 inline comments with suggestions

Summary of changes:

This pull request updates the documentation to align with several style guide requirements. Framing and voice improvements include shifting to imperative verbs, second-person perspective ("you"), and providing authoritative security recommendations while using active voice. Structural changes ensure headings use sentence case and introductory list phrases end with colons. Formatting and usage updates include removing bold for general emphasis, applying codefont to hostnames like "localhost", using contractions like "isn't", and ensuring proper article usage before product components like "the Router".

鈿狅笍 This review and suggested changes are AI-generated. Please use common sense when accepting these suggestions, as they may not always be accurate or appropriate for your specific context.

Annotations

Check notice on line 102 in docs/source/routing/configuration/envvars.mdx

See this annotation in the file changed.

@apollo-librarian apollo-librarian / AI Style Review

docs/source/routing/configuration/envvars.mdx#L102

**Framing**: Use imperative verbs for instructions and descriptions.

```suggestion
Provide a comma-separated list of registry hostnames to use HTTP instead of HTTPS when fetching graph artifacts.
```

Check notice on line 97 in docs/source/routing/configuration/envvars.mdx

See this annotation in the file changed.

@apollo-librarian apollo-librarian / AI Style Review

docs/source/routing/configuration/envvars.mdx#L97

**Structural Elements**: Headings must use sentence case. While this is a constant name, ensure it is not being treated as a title case heading.

```suggestion
##### `APOLLO_GRAPH_ARTIFACT_UNSECURE_HOSTS`
```

Check warning on line 106 in docs/source/routing/configuration/envvars.mdx

See this annotation in the file changed.

@apollo-librarian apollo-librarian / AI Style Review

docs/source/routing/configuration/envvars.mdx#L106

**Structural Elements**: Introductory phrases for lists or examples should end with a colon.

```suggestion
For example, to allow HTTP for a custom internal registry:
```

Check notice on line 104 in docs/source/routing/configuration/envvars.mdx

See this annotation in the file changed.

@apollo-librarian apollo-librarian / AI Style Review

docs/source/routing/configuration/envvars.mdx#L104

**Framing**: Frame content relative to the reader using "you" and avoid passive phrasing.

**Products and Features**: Use an article before a component of a product like 'Router'.

**Text Formatting**: Do not use bold for general emphasis.

**Verb Tense and Voice**: Use active voice to clarify the actor and improve directness.

**Voice**: The original text is descriptive but lacks an authoritative recommendation. Providing a 'recommended' path for security aligns with an opinionated voice.

**Word and Symbol Usage**: Use the contraction "isn't" for better readability and apply codefont to "localhost" as it is a hostname.

```suggestion
When you do not set this variable, the router defaults to allowing HTTP for `localhost`, `127.0.0.1`, and `dockerhost`. When you set it to a non-empty value, only the specified hosts use HTTP鈥攖he defaults are replaced entirely. Setting it to an empty string (`""`) disables all HTTP overrides, requiring HTTPS for every registry including localhost.
```