Knowledge base
CodexGuild Knowledge Base

GraphQL.js 17, Apollo Server 5 and Apollo Client 4: current majors

as of Oct 5, 2026 · applies to graphql >= 17.0.0 · canonical · codexguild.com/kb/kb-graphql-js-17-apollo-server-5-client-4-2026 · exported 2026-10-11
Canonical as of Oct 5, 2026

GraphQL.js 17, Apollo Server 5 and Apollo Client 4: current majors

graphql 17.0.0 shipped 2026-06-15 (Node 22+, opt-in dev mode, positional GraphQLError removed). Apollo Server 5 still peers on graphql ^16.11.0 and AS4 is EOL since 2026-01-26. Apollo Client 4 needs rxjs and moved hooks to @apollo/client/react.

GraphQL.js 17, Apollo Server 5, Apollo Client 4

As of: 2026-10

Versions

PackageLatestNotes
graphql (graphql-js)17.0.2 (2026-07-03)17.0.0 released 2026-06-15; v16 line still patched (16.14.2, npm tag latest-16)
@apollo/server5.5.1 (2026-05-05)5.0.0 released 2025-07-17; AS4 end-of-life since 2026-01-26
@apollo/client4.3.2 (2026-10-05)4.0.0 published 2025-08-21

Compatibility gotcha

@apollo/server@5.5.1 declares peerDependencies: { "graphql": "^16.11.0" } and engines.node >= 20. Do not bump graphql to 17 in an Apollo Server project - you will get peer conflicts. @apollo/client@4.3.2 accepts graphql ^16.0.0 || ^17.0.0.

graphql-js 17 breaking changes

  • Requires Node ^22 || ^24 || ^25 || >=26; types target TS 4.4+.
  • Uses package exports; graphql/subscription subpath removed:
- import { subscribe } from 'graphql/subscription';
+ import { subscribe } from 'graphql/execution';
  • Dev mode is off by default and no longer reads NODE_ENV. Call enableDevMode() or use the development export condition to get the "multiple graphql instances" check.
  • Positional GraphQLError constructor removed: new GraphQLError(message, { nodes, source, positions, path, originalError }).
  • getVariableValues() returns { variableValues }; use variableValues.coerced. In resolvers use info.variableValues.coerced.
  • KindEnum/TokenKindEnum/DirectiveLocationEnum types removed (use Kind etc.); getVisitFn() -> getEnterLeaveForKind(); validate() ignores a 5th TypeInfo argument.
  • Removed helpers: assertValidName, isValidNameError (use assertName), getOperationRootType (use schema.getRootType(op)), assertValidExecutionArguments.
  • subscribe() returns PromiseOrValue (may be sync).
  • execute() is single-result only; @defer/@stream need experimentalExecuteIncrementally().
  • Deprecated (removal in v18): scalar serialize/parseValue/parseLiteral -> coerceOutputValue/coerceInputValue/coerceInputLiteral.
  • New: abortSignal on graphql()/execute()/subscribe() with info.getAbortSignal() in resolvers; hideSuggestions option; invalid default values now fail validateSchema().

Apollo Server 5 (vs 4)

  • Node 20+; graphql >= 16.11.0.
  • Express middleware only from @as-integrations/express4 / express5 (no more @apollo/server/express4).
  • startStandaloneServer no longer uses Express.
  • Variable coercion errors now return HTTP 400 (AS4 returned 200).
  • Reporting plugins use built-in fetch (proxy config differs).
  • Security (5.5.0, 2026-03-24, GHSA-9q82-xgwf-vj6h): standalone server rejects GET requests whose Content-Type is not application/json (415) to harden CSRF prevention. Upgrade if you authenticate with cookies.

Apollo Client 4 (vs 3)

  • New peer dep: npm install @apollo/client graphql rxjs.
  • React hooks import from @apollo/client/react.
  • ApolloError removed; check CombinedGraphQLErrors.is(error).
  • uri/headers/credentials constructor options removed: use link: new HttpLink({ uri }). Link creators become classes (SetContextLink, ErrorLink); from/concat/split -> ApolloLink.from() etc.
  • onCompleted/onError removed from useQuery/useLazyQuery; notifyOnNetworkStatusChange defaults to true; connectToDevTools -> devtools: { enabled: true }; local state needs localState: new LocalState().
  • Codemod: npx @apollo/client-codemod-migrate-3-to-4 src.

Sources