A weekly newsletter of the best news, articles and projects about GraphQL

Martin Bonnin argues persisted queries let GraphQL adopt REST's strengths—CDN cacheability, predictability, standard HTTP tooling—while keeping low friction and per-field lifecycle control. The missing piece: protocol standardization.

Medusa dives into GraphQL introspection security: how attackers extract hidden operations, sensitive fields, and authorization flaws from schema metadata. Practical techniques for bug bounty hunters and pentesters to find high-severity vulnerabilities in production APIs.

The GraphQL AI WG met to advance agentic AI with GraphQL: reviewed Semantic Introspection RFC (adding metadata for better agent reasoning), proposed @mock directive for standardized mocking in development workflows, and showcased an open-source lightweight GraphQL embedding prototype using OLLAMA for schema navigation without heavy compute. Next: refine RFCs and tooling.

Latest WordPress GraphQL plugin update adds siteIcon/siteIconUrl fields, extra settings sanitization, dependency bump to graphql-php 15.29.4, and GraphiQL IDE improvements for better local dev experience.

Apollo's update enables streaming large lists in GraphQL queries (no waiting for full data), improving perceived performance for incremental UI updates.