apollographql / apollo-client
Repository health
Security, maintenance, dependencies and license for apollographql/apollo-client.
Security
0
Critical
0 direct
0
High
0 direct
0
Moderate
0
Low
75 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 7.0/10
Checks sorted from strongest to weakest.
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- Recent activity30 commits and 16 issue activity found in the last 90 days10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- License fileLicense file detected10/10
- Security policySecurity policy file detected10/10
- Static analysis on commitsSAST tool is not run on all commits9/10
- Pinned dependenciesDependency not pinned by hash detected8/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions6/10
- Code review before mergeFound 9/21 approved changesets4/10
- Branch protectionBranch protection is not maximal on development and all release branches3/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Fuzz testingProject is not fuzzed0/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Signed releasesNo releases foundnot scored
Maintenance
21 Oct 2026
Last commit
active
100+
Commits in the last year
940
Contributors
all time · 10 in the last 67 commits
@apollo/client@4.3.5
Latest release
~5d cadence
Outside contributions: 6 of 11 external pull requests merged (67% of those decided), median 26 days to merge.From the 54 most recently updated pull requests, bots excluded.
Recent releases
- @apollo/client@4.3.519 Oct 2026 · 3 days after previous
- @apollo/client@4.3.416 Oct 2026 · 8 days after previous
- @apollo/client@4.3.38 Oct 2026 · 2 days after previous
- @apollo/client@4.3.25 Oct 2026 · 17 days after previous
- @apollo/client@4.3.118 Sept 2026 · 7 days after previous
Pull requests
- Open
- 10
- 0 stale (60+ days, no update in 30)
- Merged
- 15
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 15
- not listed below
Open
- #13484 Exclude "partial" from dataState when fetchPolicy is "no-cache"SunilRathod27 · opened 9 days ago
- #13462 🤖🤖🤖 fix: refresh pending shared queries on refetchQiRaining · opened 38 days ago
- #13495 Update skills with stricter guidance for queries and fragmentsjerelmiller · opened 7 days ago
Recently merged
- #13505 Fix some warnings written to the console in testsjerelmiller · merged 19 Oct 2026
- #13504 Avoid mutating the raw network result object when handling subscription resultsjerelmiller · merged 19 Oct 2026
- #13501 Parse custom scalars in subscriptions with no-cache fetch policykgssystem · merged 19 Oct 2026
- #13498 Handle non-JSON-serializable scalar value in `cache.identify` and `cache.watch`jerelmiller · merged 19 Oct 2026
- #13500 Make sure `variables` option is required for `useFragment` if it has required variablesjerelmiller · merged 19 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- jerelmiller53 commits · 79%
- phryneas4 commits · 6%
- atharv-sys323 commits · 4%
- kgssystem1 commit · 1%
- rokkie1 commit · 1%
Of the 67 most recent commits.
Issues
- Open
- 409
- issues and pull requests, as GitHub counts them
- Median time to close
- 7 days
- from 13 closed of the 19 latest
- Awaiting first reply
- 0
- of 6 open among the 19 latest
- Oldest open
- 8.1 years
Most wanted
- #13499 useQuery stays loading after skipToken -> options when the cache is incomplete and the refetch returns unchanged data1 reaction · 5 comments
Rates come from the 19 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
75
Packages checked
npm
25
Direct packages checked
listed in the manifest
50
Transitive packages checked
pulled in by other packages
Unknown
External imports
outside packages the code imports
License compatibility
Repo license: MIT · 24 deps checked · 0 potential conflicts.
License
MIT
License
Permissive
Family
0
License conflicts in dependencies
24 dependencies checked
Commercial use: Generally fine for commercial and proprietary use, subject to attribution and notice terms.