fix(with-apollo-and-redux): resolve install failure and handle upstream API errors

[ZaforAbdullah]

For Contributors

Fixing a bug

• Fixes #(open or reference an issue if one exists, otherwise omit)
• No tests required — this is an examples/ change only
• No custom error links needed — failures are surfaced via Apollo's built-in error state

---

What?

Three fixes to the with-apollo-and-redux example:

1. package.json — bump graphql from 14.5.8 to 16.13.1
@apollo/client@^3 requires graphql@^15 || ^16; the old pin causes npm install to fail with ERESOLVE.

2. package.json — bump lodash from ^4.17.21 to ^4.17.23
   Fixes three high-severity CVEs (Command Injection, ReDoS, Prototype Pollution) in the version used by lib/apollo.js for Apollo cache deduplication.

3. pages/index.js, pages/apollo.js — wrap apolloClient.query() in try/catch inside getStaticProps
   An upstream API 500 throws an unhandled ApolloError, which Next.js surfaces as a page-level 500. The catch block falls back to an empty Apollo cache and lets PostList handle the error via its own useQuery call.

4. components/PostList.js — add if (!data) return null guard
   When getStaticProps returns an empty cache (e.g. upstream unavailable), SSR renders PostList with data = undefined. The existing error/loading guards do not fire at that point, so destructuring data crashes. The null guard prevents the crash.

Why?

The example fails on a clean install due to the peer dependency conflict, and crashes with a 500 if the upstream API is unavailable — both of which make the example unusable as a reference.

How?

Minimal, targeted changes — no API surface or architecture changes. The try/catch pattern is idiomatic for getStaticProps and the !data guard is a one-line defensive check.

[nextjs-bot]

Allow CI Workflow Run

• approve CI run for commit: 1a116f0

Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer

[icyJoseph]

Here you'd want to error at build time, not hide the error or hope to catch it during rendering. You might end up shipping bad UI

[ZaforAbdullah]

It call https://nextjs-graphql-with-prisma-simple-foo.vercel.app/api endpoint which is empty, hence the example project can't be build at all.

[icyJoseph]

Mm but that's another issue then, that project should serve data... I don't have time to look into at the moment - but I'll try later

[ZaforAbdullah]

https://nextjs-graphql-with-prisma-simple-foo.vercel.app/api

I found the origin of the url project: https://github.com/prisma-labs/nextjs-graphql-api-examples

[icyJoseph]

Yes. I asked them about it, they'll look into it. 🙏

[icyJoseph]

pin these, aka remove ^ - arguably the other deps should also be like but we lost control, let's not diverge with these

[ZaforAbdullah]

graphql is now pinned to 16.13.1 with no ^

[icyJoseph]

should pin lodash too

[ZaforAbdullah]

Hi @icyJoseph
Anything remained on my side?