unstale

npm / @apollo/server

@apollo/server

What changed in @apollo/server 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.

2 breaking2 security

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.8 on npm

@apollo/server 54 changes

Breaking changes 2

  • In @apollo/server/standalone, GraphQL GET requests with a Content-Type other than application/json (optionally with parameters) are rejected with status 415, strengthening CSRF protection.

    5.5.0release notes

  • Request bodies now accept only UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE); other character sets are rejected with a 415 Unsupported Media Type error, addressing a denial-of-service vulnerability.

    5.4.0release notes

Security 2

  • Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

    5.5.0security advisory

  • Apollo Serve vulnerable to Denial of Service with startStandaloneServer

    4.13.0, 5.4.0security advisory