# What changed in graphql-ws

> 16 changes in graphql-ws 6 from its official release notes, upgrade guides and advisories: 1 breaking, 1 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/graphql-ws/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## graphql-ws 6

### Breaking changes

- Removed from graphql-ws peer dependencies because it no longer exists on npm; using graphql-ws with uWebSockets.js still works. (6.0.7) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.0.7)

### Security

- The ws, uWebSockets.js, and @fastify/websocket use-server helpers now accept isProd to control whether internal error messages are masked before reaching the client. (6.4.0) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.4.0)

### New APIs and options

- Adds a server callback that receives the connection Context and ping payload. Its automatic pong reply is preserved; the low-level websocket onPing listener still disables automatic replies. (6.3.0) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.3.0)
- Adds a server callback that receives the connection Context and pong payload, allowing apps to log or react to subprotocol-level pongs with access to connection state. (6.3.0) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.3.0)
- Adds a parse option for custom GraphQL parsing. (6.2.0) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.2.0)

### Fixes and other changes

- The client and server now use jsonMessageReplacer when automatically responding to a ping with a pong. (6.4.1) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.4.1)
- The client now uses a single lazy close timeout and checks for active subscriptions before closing, preventing an in-use socket from closing when a new subscription starts within the timeout. (6.4.0) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.4.0)
- Avoids an unhandled rejection when a subscription is disposed before the connection is acknowledged and the socket closes before the subscription releases its connection lock. (6.4.0) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.4.0)
- Fixes the client leaking memory per operation on long-living connections. (6.3.0) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.3.0)
- Allows operation IDs that match properties inherited from Object.prototype. (6.3.0) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.3.0)
- Support crossws 0.4 by selecting the GraphQL WebSocket subprotocol during the upgrade handshake, while preserving automatic protocol negotiation in legacy crossws 0.3 Node and uWebSockets adapters. (6.2.2) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.2.2)
- The CrossWS adapter now honors socket closes issued from server.opened, preventing protocol-mismatch closes from being dropped and the WebSocket from remaining open without a ConnectionAck. (6.2.2) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.2.2)
- Fixes the typings for WebSocketServer. (6.2.1) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.2.1)
- Disposing an event listener twice no longer removes an unrelated listener, including during nested emits. (6.1.1) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.1.1)
- Adds support for graphql@17, allowing graphql-ws to be used with that version of graphql. (6.1.0) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.1.0)
- When a subscription's async iterable throws an error, the server now sends only an Error message and does not follow it with a Complete message. (6.0.8) — [release notes](https://github.com/enisdenjo/graphql-ws/releases/tag/v6.0.8)