Apollo GraphQL

The past month spans client pre-releases, runtime fixes, and a public security audit of the MCP server.

Apollo Client 4.3 pre-release adds type-safe subscription skipping. The 4.3.0 alpha series introduces skipToken support for useSubscription, giving teams a type-safe alternative to skip: true when variables are required. The minimum supported TypeScript version is now 5.9.x. A development-mode warning fires when queries overwrite each other's cached data, making cache feud detection visible before it causes silent data corruption.

Apollo Client 4.2.12 preserves multi-byte characters in streamed responses. Multi-byte UTF-8 characters split across multipart response chunks are now preserved correctly.

Kotlin 5.1.0 cuts compiler and runtime overhead. Performance patches replace O(n²) schema checks with an indexed type hierarchy, skip unnecessary @defer walks, and eliminate exception-based JSON number detection. These changes reduce cost on every compile and runtime round-trip.

iOS 2.4.0 opens SQLiteDatabase to wrapper implementations. DatabaseRow members are now public, allowing custom SQLiteDatabase implementations — for encryption, compression, or logging — to inspect and transform row contents while composing Apollo's default implementation. The additionalCapitalizationRules feature also extends to generated operation and fragment type names.

Gateway 2.14.4 corrects OTLP metrics routing. The opt-out telemetry pipeline was exporting to the bare usage-reporting host instead of the /v1/metrics path; the exporter now targets the correct OTLP route.

The Apollo MCP Server now has a public OWASP Top 10 audit. A self-authored review against the OWASP MCP Top 10 maps each risk to architecture decisions, shared responsibility boundaries, and what GraphQL's typed operation model closes by construction.

Apollo Summit 2026 runs October 6–8 in San Francisco.