v5.5.1

Compare Source

Patch Changes

• #​8201 3f46c51 Thanks @​mhassan1! - Replace dependency uuid with calls to crypto.randomUUID.

v5.5.0

Compare Source

Minor Changes

• #​8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

  Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

  (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

  This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

  If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

  This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

  See advisory GHSA-9q82-xgwf-vj6h for more details.

v5.4.0

Compare Source

Minor Changes

• d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
  Any other character set will be rejected with a 415 Unsupported Media Type error.
  Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8.
  Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now.
  In a future major release, we may tighten this restriction further to only allow UTF-8.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
  For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

v5.3.0

Compare Source

Minor Changes

• #​8062 8e54e58 Thanks @​cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

  const server = new ApolloServer({
    typeDefs,
    resolvers,
    executionOptions: {
      maxCoercionErrors: 50,
    },
  });

• #​8014 26320bc Thanks @​mo4islona! - Expose graphql validation options.

  const server = new ApolloServer({
    typeDefs,
    resolvers,
    validationOptions: {
      maxErrors: 10,
    },
  });

v5.2.0

Compare Source

Minor Changes

• #​8161 51acbeb Thanks @​jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.

  import { legacyExecuteIncrementally } from '@​yaacovcr/transform';
  
  const server = new ApolloServer({
    // ...
    legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
  });

  If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

v5.1.0

Compare Source

Minor Changes

• #​8148 80a1a1a Thanks @​jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with graphql@17.0.0-alpha.9. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.

  Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.

v5.0.0

Compare Source

BREAKING CHANGES

Apollo Server v5 has very few breaking API changes. It is a small upgrade focused largely on adjusting which versions of Node.js and Express are supported.

Read our migration guide for more details on how to update your app.

• Dropped support for Node.js v14, v16, and v18, which are no longer under long-term support from the Node.js Foundation. Apollo Server 5 supports Node.js v20 and later; v24 is recommended. Ensure you are on a non-EOL version of Node.js before upgrading Apollo Server.
• Dropped support for versions of the graphql library older than v16.11.0. (Apollo Server 4 supports graphql v16.6.0 or later.) Upgrade graphql before upgrading Apollo Server.
• Express integration requires a separate package. In Apollo Server 4, you could import the Express 4 middleware from @apollo/server/express4, or you could import it from the separate package @as-integrations/express4. In Apollo Server 5, you must import it from the separate package. You can migrate your server to the new package before upgrading to Apollo Server 5. (You can also use @as-integrations/express5 for a middleware that works with Express 5.)
• Usage Reporting, Schema Reporting, and Subscription Callback plugins now use the Node.js built-in fetch implementation for HTTP requests by default, instead of the node-fetch npm package. If your server uses an HTTP proxy to make HTTP requests, you need to configure it in a slightly different way. See the migration guide for details.
• The server started with startStandaloneServer no longer uses Express. This is mostly invisible, but it does set slightly fewer headers. If you rely on the fact that this server is based on Express, you should explicitly use the Express middleware.
• The experimental support for incremental delivery directives @defer and @stream (which requires using a pre-release version of graphql v17) now explicitly only works with version 17.0.0-alpha.2 of graphql. Note that this supports the same incremental delivery protocol implemented by Apollo Server 4, which is not the same protocol in the latest alpha version of graphql. As this support is experimental, we may switch over from "only alpha.2 is supported" to "only a newer alpha or final release is supported, with a different protocol" during the lifetime of Apollo Server 5.
• Apollo Server is now compiled by the TypeScript compiler targeting the ES2023 standard rather than the ES2020 standard.
• Apollo Server 5 responds to requests with variable coercion errors (eg, if a number is passed in the variables map for a variable declared in the operation as a String) with a 400 status code, indicating a client error. This is also the behavior of Apollo Server 3. Apollo Server 4 mistakenly responds to these requests with a 200 status code by default; we recommended the use of the status400ForVariableCoercionErrors: true option to restore the intended behavior. That option now defaults to true.
• The unsafe precomputedNonce option to landing page plugins (which was only non-deprecated for 8 days) has been removed.

Patch Changes

There are a few other small changes in v5:

• #​8076 5b26558 Thanks @​valters! - Fix some error logs to properly call logger.error or logger.warn with this set. This fixes errors or crashes from logger implementations that expect this to be set properly in their methods.

• #​7515 100233a Thanks @​trevor-scheer! - ApolloServerPluginSubscriptionCallback now takes a fetcher argument, like the usage and schema reporting plugins. The default value is Node's built-in fetch.

• Updated dependencies [100233a]:

  • @​apollo/server-gateway-interface@​2.0.0

v4.1.0

Compare Source

Minor Changes

• #​288 87f9e0f Thanks @​martinnabhan! - Add support for Next.js 16

v4.0.0

Compare Source

Major Changes

• #​264 2572fca Thanks @​karl-run! - Add support for Apollo Server 5

  This release drops support for Apollo Server 4, and since Apollo Server 5 drops support for Node.js 18
  we're also dropping support for Node.js 18.

v21.2.1

Compare Source

Note: Version bump only for package @​commitlint/cli

v21.2.0

Compare Source

Features

• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#​4859) (fdb566f)

v21.1.0

Compare Source

Features

• cli: add --default-config flag to lint without a config file (#​4805) (7af27ba), closes #​3662

21.0.2 (2026-05-29)

Bug Fixes

• disallow same commit hash for --from and --to (#​4773) (121005e)

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/cli

v21.0.2

Compare Source

Bug Fixes

• disallow same commit hash for --from and --to (#​4773) (121005e)

v21.0.1

Compare Source

Note: Version bump only for package @​commitlint/cli

v21.0.0

Compare Source

• chore!: minimum node version v22 (#​4679) (ac2b3f4), closes #​4679

BREAKING CHANGES

• drop node v18 and v20 support

• Bump engines to >=v22 in all 39 package.json files
• Update @​types/node to ^22.0.0
• Update CI matrix to [22, 24]
• Update Ubuntu baseline job to ubuntu:26.04
• Update Dockerfile.ci, .mise.toml, .codesandbox/ci.json
• Update pre-commit hook to use --ignore-engines
• Update README and docs

Co-authored-by: Claude Opus 4.6 (1M context) noreply@anthropic.com

20.5.3 (2026-04-30)

Note: Version bump only for package @​commitlint/cli

20.5.2 (2026-04-25)

Note: Version bump only for package @​commitlint/cli

v20.5.3

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.5.2

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.5.0

Compare Source

Bug Fixes

• cli: validate that --cwd directory exists before execution (#​4658) (cf80f75), closes #​4595

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/cli

20.4.3 (2026-03-03)

Bug Fixes

• footer parser does not escape special chars for regex #​4560 (#​4634) (8ff7c7f)

20.4.2 (2026-02-19)

Note: Version bump only for package @​commitlint/cli

20.4.1 (2026-02-02)

Note: Version bump only for package @​commitlint/cli

v20.4.4

Compare Source

Note: Version bump only for package @​commitlint/cli

v21.2.0

Compare Source

Features

• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#​4859) (fdb566f)

v21.1.0

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

21.0.2 (2026-05-29)

Note: Version bump only for package @​commitlint/config-conventional

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/config-conventional

v21.0.2

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

v21.0.1

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

v21.0.0

Compare Source

• chore!: minimum node version v22 (#​4679) (ac2b3f4), closes #​4679

BREAKING CHANGES

• drop node v18 and v20 support

• Bump engines to >=v22 in all 39 package.json files
• Update @​types/node to ^22.0.0
• Update CI matrix to [22, 24]
• Update Ubuntu baseline job to ubuntu:26.04
• Update Dockerfile.ci, .mise.toml, .codesandbox/ci.json
• Update pre-commit hook to use --ignore-engines
• Update README and docs

Co-authored-by: Claude Opus 4.6 (1M context) noreply@anthropic.com

20.5.3 (2026-04-30)

Note: Version bump only for package @​commitlint/config-conventional

v20.5.3

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

v20.5.0

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/config-conventional

20.4.3 (2026-03-03)

Bug Fixes

• footer parser does not escape special chars for regex #​4560 (#​4634) (8ff7c7f)

20.4.2 (2026-02-19)

Note: Version bump only for package @​commitlint/config-conventional

20.4.1 (2026-02-02)

Note: Version bump only for package @​commitlint/config-conventional

v20.4.4

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

v7.8.0

Compare Source

Today, we are excited to share the 7.8.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Features

Prisma Client

• Added a queryPlanCacheMaxSize option to the PrismaClient constructor for fine-grained control over the query plan cache. Pass 0 to disable the cache entirely, or omit it to use the default cache size. A larger value can improve performance in applications that execute many unique queries, while a smaller one can reduce memory usage. (#​29503)

Bug Fixes

Prisma Client

• Fixed an equality filter panic and incorrect ::jsonb cast when filtering on PostgreSQL JSON list columns. Queries using where: { jsonListField: { equals: [...] } } no longer panic with a type mismatch or emit invalid SQL. (prisma/prisma-engines#5804)
• Fixed case-insensitive JSON field filtering (mode: insensitive), allowing where: { jsonField: { equals: "...", mode: "insensitive" } } to work correctly. (prisma/prisma-engines#5806)
• Fixed incorrect parameterization of enum values that have a custom database name set via @map. (#​29422)
• Fixed a database parameter limit check (P2029), which could incorrectly reject or miss over-limit queries. (#​29422)
• Fixed a regression that caused missing SQL Server VARCHAR casts for parameterized values. (prisma/prisma-engines#5801)

Schema Engine

• Fixed a misleading error message in prisma migrate diff that referenced the --shadow-database-url CLI flag, which was removed in Prisma 7. (#​29455)
• Fixed prisma migrate dev (and shadow database migration replay in general) failing with CREATE INDEX CONCURRENTLY cannot run inside a transaction block when a migration contained concurrent index creation statements on PostgreSQL. (prisma/prisma-engines#5799)
• Fixed PostgreSQL introspection silently dropping sequence defaults when the database returns the schema-qualified form pg_catalog.nextval('sequence_name'::regclass) instead of the bare nextval(...). Columns backed by sequences now correctly appear as @default(autoincrement()) in the Prisma schema in all cases. (prisma/prisma-engines#5802)

Driver Adapters

• @​prisma/adapter-d1: Savepoint operations (createSavepoint, rollbackToSavepoint, releaseSavepoint) now silently no-op with debug logging instead of executing SQL statements, consistent with how the D1 adapter already treats top-level transactions. (#​29499)

Open roles at Prisma

Interested in joining Prisma? We're growing and have several exciting opportunities across the company for developers who are passionate about building with Prisma. Explore our open positions on our Careers page and find the role that's right for you.

Enterprise support

Thousands of teams use Prisma and many of them already tap into our Enterprise & Agency Support Program for hands-on help with everything from schema integrations and performance tuning to security and compliance.

With this program you also get priority issue triage and bug fixes, expert scalability advice, and custom training so that your Prisma-powered apps stay rock-solid at any scale. Learn more or join: https://prisma.io/enterprise.

v7.7.0

Compare Source

Today, we are excited to share the 7.7.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

prisma bootstrap command

A new prisma bootstrap command (#​29374, #​29424) sequences the full Prisma Postgres setup into a single interactive flow. It detects the current project state and runs only the steps that are needed:

1. Init or scaffold — In an empty directory, offers a choice of 10 starter templates (Next.js, Express, Hono, Fastify, Nuxt, SvelteKit, Remix, React Router 7, Astro, NestJS) from prisma-examples. In an existing project without a schema, runs prisma init.
2. Link — Authenticates via the browser and connects to a Prisma Postgres database. Skips if already linked.
3. Install dependencies — Detects the package manager and offers to install missing @prisma/client, prisma, and dotenv.
4. Migrate — Runs prisma migrate dev if the schema contains models.
5. Generate — Runs prisma generate.
6. Seed — Runs prisma db seed if a seed script is configured.

Each side-effecting step prompts for confirmation. Re-running the command skips already-completed steps.

Basic usage

npx prisma@latest bootstrap

With a starter template

npx prisma@latest bootstrap --template nextjs

Non-interactive (CI)

npx prisma@latest bootstrap --api-key "$PRISMA_API_KEY" --database "db_abc123"

Open roles at Prisma

Interested in joining Prisma? We're growing and have several exciting opportunities across the company for developers who are passionate about building with Prisma. Explore our open positions on our Careers page and find the role that's right for you.

Enterprise support

Thousands of teams use Prisma and many of them already tap into our Enterprise & Agency Support Program for hands-on help with everything from schema integrations and performance tuning to security and compliance.

With this program you also get priority issue triage and bug fixes, expert scalability advice, and custom training so that your Prisma-powered apps stay rock-solid at any scale. Learn more or join: https://prisma.io/enterprise.

v7.6.0

Compare Source

Today, we are excited to share the 7.6.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Features

CLI

• Added a prisma postgres link command that connects a local project to a Prisma Postgres database. This is the first command in a new prisma postgres command group for managing Prisma Postgres databases directly from the CLI. (#​29352)

Driver Adapters

• @​prisma/adapter-pg: Added a statementNameGenerator option that accepts a custom prepared statement name generator to allow users to leverage pg statement caching (#​29395)
• @​prisma/adapter-pg: Added support for usage of connection strings directly in the constructor for improved ergonomics (#​29287)
• @​prisma/adapter-mariadb: Added a useTextProtocol option in the constructor to toggle between text and binary protocols (#​29392)

Bug Fixes

Prisma Client

• Disabled caching of createMany queries to avoid cache bloat and potential Node.js crashes in bulk operations (#​29382)
• Made NowGenerator lazy to avoid synchronous new Date() calls, fixing Next.js "dynamic usage" errors in cached components (#​28724)
• Fixed missing export of Get<Model>GroupByPayload type in the new prisma-client generator, making it accessible for TypeScript usage (#​29346)

CLI

• Added streaming parsing with automatic fallback to handle Prisma schemas that produce extremely large intermediate strings (>500MB) that hit V8's string limits (#​29377)

Driver Adapters

• @​prisma/adapter-pg: Relaxed the @types/pg version constraint to ^8.16.0 for compatibility with newer PostgreSQL type definitions (#​29390)
• @​prisma/adapter-pg: Corrected error handling for ColumnNotFound errors to correctly extract column names from both quoted and unquoted PostgreSQL error messages (#​29307)
• @​prisma/adapter-mariadb: Modified the adapter to disable mariadb statement caching by default to address a reported leak (#​29392)

Prisma Studio

We’re continuing our work to improve Prisma Studio with more features being added.

Dark Mode

Need we say more? You’ve all asked for it, and it’s back.

Copy as markdown

Now, you can copy one or more rows as either CSV or Markdown

Multi-cell editing

This is big one, something that folks have been asking for. Now, it’s possible to edit multiple cells while inspecting your database. If you make any changes, you’ll be prompted to either save or discard them. This makes manually adding new rows much easier to accomplish.

Back relations

If your data references another table, Prisma Studio now links to the related records, making it easy to inspect them. This makes traversing your database much simpler.

Generative SQL with AI

If you need to inspect your database, instead of manually writing the SQL you may need, you can use natural language and AI to generate the appropriate SQL statements.

Open roles at Prisma

Interested in joining Prisma? We’re growing and have several exciting opportunities across the company for developers who are passionate about building with Prisma. Explore our open positions on our Careers page and find the role that’s right for you.

Enterprise support

Thousands of teams use Prisma and many of them already tap into our Enterprise & Agency Support Program for hands-on help with everything from schema integrations and performance tuning to security and compliance.

With this program you also get priority issue triage and bug fixes, expert scalability advice, and custom training so that your Prisma-powered apps stay rock-solid at any scale. Learn more or join: https://prisma.io/enterprise.

v7.5.0

Compare Source

Today, we are excited to share the 7.5.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Features

• Added support for nested transaction rollbacks via savepoints (#​21678)

  Adds support for nested transaction rollback behavior for SQL databases: if an outer transaction fails, the inner nested transaction is rolled back as well. Implements this by tracking transaction ID + nesting depth so Prisma can reuse an existing open transaction in the underlying engine, and it also enables using $transaction from an interactive transaction client.

Bug fixes

Driver Adapters

• Made the adapter-mariadb use the binary MySQL protocol to fix an issue with lossy number conversions (#​29285)
• Made @types/pg a direct dependency of adapter-pg for better TypeScript experience out-of-the-box (#​29277)

Prisma Client

• Resolved Prisma.DbNull serializing as empty object in some bundled environments like Next.js (#​29286)
• Fixed DateTime fields returning Invalid Date with unixepoch-ms timestamps in some cases (#​29274)
• Fixed a cursor-based pagination issue with @db.Date columns (#​29327)

Schema Engine

• Manual partial indexes are now preserved when partialIndexes preview feature is disabled, preventing unnecessary drops and additions in migrations (#​5790, #​5795)
• Enhanced partial index predicate comparison to handle quoted vs unquoted identifiers correctly, eliminating needless recreate cycles (#​5788)
• Excluded partial unique indexes from DMMF uniqueFields and uniqueIndexes to prevent incorrect findUnique input type generation (#​5792)

Studio

With the launch of Prisma ORM v7, we also introduced a rebuilt version of Prisma Studio. With the feedback we’ve gathered since the release, we’ve added some high requested features to help make Studio a better experience.

Multi-cell Selection & Full Table Search

This release brings the ability to select multiple cells when viewing your database. In addition to being able to select multiple cells, you can also search across your database. You can search for a specific table or for specific cells within that table.

More intuitive filtering

Filtering is now easier to use, and includes an option for raw SQL filters.

And if you are using Studio in Console, you can use ai generated filters:

Cmd+k Command Palette

You can now use the keyboard to perform most actions in Studio with the new cmd+k command palette

Run raw SQL queries

Another feature we’ve included in Prisma Studio is the ability to run raw SQL queries against your data. There’s a new “SQL” tab in the sidebar that will bring you to page where you can perform any queries against your data. Below, we’re getting all the rows in the “Todo” table.

Open roles at Prisma

Interested in joining Prisma? We’re growing and have several exciting opportunities across the company for developers who are passionate about building with Prisma. Explore our open positions on our [Careers page](https://www.prisma.io/careers#current) and find the role that’s right for you.

Enterprise support

Thousands of teams use Prisma and many of them already tap into our Enterprise & Agency Support Program for hands-on help with everything from schema integrations and performance tuning to security and compliance.

With this program you also get priority issue triage and bug fixes, expert scalability advice, and custom training so that your Prisma-powered apps stay rock-solid at any scale. Learn more or join: https://prisma.io/enterprise.

v7.4.2

Compare Source

Today, we are issuing a 7.4.2 patch release focused on bug fixes and quality improvements.

🛠 Fixes

Prisma Client

• Fix a case-insensitive IN and NOT IN filter regression (#​29243)
• Fix a query plan mutation issue that resulted in broken cursor queries (#​29262)
• Fix an array parameter wrapping issue in push operations (prisma/prisma-engines#5784)
• Fix Uint8Array serialization in nested JSON fields (#​29268)
• Fix an issue with MySQL joins that relied on non-strict equality (#​29251)

Driver Adapters

• @​prisma/adapter-mariadb: Update text column detection to check for a binary collation (#​29238)
• @​prisma/adapter-mariadb: Correct relationJoins compatibility check for MariaDB 8.x versions (#​29246

✂ Note

PR body was truncated to here.