npm / graphql-ws
graphql-ws
What changed in graphql-ws 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
1 breaking1 security3 new APIs and options11 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initgraphql-ws 616 changes
Breaking changes 1
Removed from graphql-ws peer dependencies because it no longer exists on npm; using graphql-ws with uWebSockets.js still works.
Security 1
The ws, uWebSockets.js, and @fastify/websocket use-server helpers now accept isProd to control whether internal error messages are masked before reaching the client.
New APIs and options 3
Adds a server callback that receives the connection Context and ping payload. Its automatic pong reply is preserved; the low-level websocket onPing listener still disables automatic replies.
Adds a server callback that receives the connection Context and pong payload, allowing apps to log or react to subprotocol-level pongs with access to connection state.
Adds a parse option for custom GraphQL parsing.
Fixes and other changes 11
The client and server now use jsonMessageReplacer when automatically responding to a ping with a pong.
The client now uses a single lazy close timeout and checks for active subscriptions before closing, preventing an in-use socket from closing when a new subscription starts within the timeout.
Avoids an unhandled rejection when a subscription is disposed before the connection is acknowledged and the socket closes before the subscription releases its connection lock.
Fixes the client leaking memory per operation on long-living connections.
Allows operation IDs that match properties inherited from Object.prototype.
Support crossws 0.4 by selecting the GraphQL WebSocket subprotocol during the upgrade handshake, while preserving automatic protocol negotiation in legacy crossws 0.3 Node and uWebSockets adapters.
The CrossWS adapter now honors socket closes issued from server.opened, preventing protocol-mismatch closes from being dropped and the WebSocket from remaining open without a ConnectionAck.
Fixes the typings for WebSocketServer.
Disposing an event listener twice no longer removes an unrelated listener, including during nested emits.
Adds support for graphql@17, allowing graphql-ws to be used with that version of graphql.
When a subscription's async iterable throws an error, the server now sends only an Error message and does not follow it with a Complete message.