prep release: v2.10.3#9556
Merged
Merged
Conversation
Contributor
✅ Docs preview readyThe preview is ready to be viewed. View the preview File Changes 15 new, 58 changed, 4 removedBuild ID: 54d13caf310343750bbf6356 URL: https://www.apollographql.com/docs/deploy-preview/54d13caf310343750bbf6356 ✅ AI Style Review — No Issues FoundThe pull request does not have any style issues. Duration: 3147ms
|
abernix
approved these changes
May 29, 2026
abernix
enabled auto-merge (squash)
May 29, 2026 17:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🐛 Fixes
Support non-ASCII (UTF-8) WebSocket header values (Issue #1485, PR #9051)
The router can now handle WebSocket connections with UTF-8 encoded header values, including non-ASCII characters like "Montréal". Previously, such connections failed because of serialization issues in the underlying
tungstenitelibrary.The fix comes from updating
tokio-tungstenitefrom v0.28.0 to v0.29.0.By @BobaFetters in #9051
Handle both
deprecatedenum values when merging coprocessor context (PR #8913)A change to coprocessor context merges in Router v2.10 caused keys to be deleted when
context: trueis used as the coprocessor context selector in the router configuration file.The workaround was to pass
context: deprecatedinstead. This change brings parity whencontext: trueis provided.By @carodewig in #8913
🛠 Maintenance
Pin transitive
h2dependency at minimum v0.4.13 to pick up critical flow-control, deadlock, and tracing fixes (PR #9033)h20.4.13 (released January 5, 2026) contains three fixes directly relevant to the router, which uses h2 exclusively as a client when connecting to subgraphs:Capacity deadlock under concurrent streams (#860) — high relevance: Under concurrent load with
max_concurrent_streamslimits in effect, flow-control capacity could be assigned to streams still inpending_openstate. Those streams could never consume the capacity, starving already-open streams and permanently freezing all outgoing traffic on the connection with no error surfaced. This is directly triggerable in the router: any subgraph behind Envoy or a gRPC backend advertises amax_concurrent_streamslimit (Envoy defaults to 100), and under production load the router will routinely queue more concurrent requests than that limit allows.OTel tracing span lifetime leak (#868) — high relevance: The h2
Connectionobject captured the active tracing span at connection creation time as its parent, keeping that span alive for the entire lifetime of the connection. Since the router wraps every subgraph request in an OpenTelemetry span and connections are pooled, affected spans could linger indefinitely under sustained traffic — never being exported to the tracing backend and accumulating in memory.Flow-control stall on padded DATA frames (#869) — lower relevance for typical subgraphs, higher for connectors: Padding bytes in
DATAframes were not being returned to the flow-control window, causing the connection window to drain to zero and permanently stalling downloads with no error. Typical GraphQL/gRPC subgraphs do not send padded frames, but router connectors calling arbitrary HTTP APIs (e.g., Google Cloud Storage or CDN-backed endpoints) can encounter this.By @theJC in #9033