Update node-fetch

[Igorgro]

This is not a bug, but rather a thing that I think should get attention. Apollo server uses an old version of node-fetch (2.7.0 or 2.6.7) which uses old version of whatwg-url (5.0.0), which uses punycode module which is considered deprecated in node.js and causes a warning when running a project which uses apollo server. Is it possible to update node-fetch dependency to a newer version (3.0.0+)?

[glasser]

Unfortunately newer versions of node-fetch only work in ESM-based projects, not CommonJS, so switching Apollo Server to depend on it would require us to make the same change for AS (which at the very least would be a major version bump).

Apollo Server mostly only uses node-fetch as a fallback if you don't pass a preferred fetcher to features such as usage reporting and schema reporting (though it does look like you can't override the fetcher for ApolloServerPluginSubscriptionCallback — would be happy to take a PR to switch that to work like the other plugins), so it's definitely possible to avoid actually running the code. Is this a runtime warning or a build-time warning? Can you demonstrate what is required to make the warning appear (eg, does it show up any time you run AS or only when usage reporting is enabled by providing an Apollo API key)? Does it show up even if you substitute a different fetcher for the default?

(We might consider a future where we don't have the magical "setting an API key enables usage reporting" and you always have to explicitly install ApolloServerPluginUsageReporting, at which point we can just require you to pass your own fetcher without a default... Definitely a major version bump though!)