apollographql · abernix · May 29, 2026 · May 29, 2026
diff --git a/.changesets/fix_caroline_rh_1292.md b/.changesets/fix_caroline_rh_1292.md
diff --git a/.changesets/fix_zach_router_1485_non_ascii_websocket_headers.md b/.changesets/fix_zach_router_1485_non_ascii_websocket_headers.md
diff --git a/.changesets/maint_jc_bump_h2_min_version.md b/.changesets/maint_jc_bump_h2_min_version.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,42 @@
 
 This project adheres to [Semantic Versioning v2.0.0](https://semver.org/spec/v2.0.0.html).
 
+# [2.10.3] - 2026-05-29
+
+## 🐛 Fixes
+
+### Support non-ASCII (UTF-8) WebSocket header values ([Issue #1485](https://github.com/apollographql/router/issues/1485), [PR #9051](https://github.com/apollographql/router/pull/9051))
+
+The router can now handle WebSocket connections with UTF-8 encoded header values, including non-ASCII characters like "Montréal". Previously, such connections failed because of serialization issues in the underlying `tungstenite` library.
+
+The fix comes from updating `tokio-tungstenite` from v0.28.0 to v0.29.0.
+
+By [@BobaFetters](https://github.com/BobaFetters) in https://github.com/apollographql/router/pull/9051
+
+### Handle both `deprecated` enum values when merging coprocessor context ([PR #8913](https://github.com/apollographql/router/pull/8913))
+
+A change to coprocessor context merges in Router v2.10 caused keys to be deleted when `context: true` is used as the coprocessor context selector in the router configuration file.
+
+The workaround was to pass `context: deprecated` instead. This change brings parity when `context: true` is provided.
+
+By [@carodewig](https://github.com/carodewig) in https://github.com/apollographql/router/pull/8913
+
+## 🛠 Maintenance
+
+### Pin transitive `h2` dependency at minimum v0.4.13 to pick up critical flow-control, deadlock, and tracing fixes ([PR #9033](https://github.com/apollographql/router/pull/9033))
+
+`h2` 0.4.13 (released January 5, 2026) contains three fixes directly relevant to the router, which uses h2 exclusively as a client when connecting to subgraphs:
+
+- **Capacity deadlock under concurrent streams ([#860](https://github.com/hyperium/h2/pull/860)) — high relevance:** Under concurrent load with `max_concurrent_streams` limits in effect, flow-control capacity could be assigned to streams still in `pending_open` state. Those streams could never consume the capacity, starving already-open streams and permanently freezing all outgoing traffic on the connection with no error surfaced. This is directly triggerable in the router: any subgraph behind Envoy or a gRPC backend advertises a `max_concurrent_streams` limit (Envoy defaults to 100), and under production load the router will routinely queue more concurrent requests than that limit allows.
+
+- **OTel tracing span lifetime leak ([#868](https://github.com/hyperium/h2/pull/868)) — high relevance:** The h2 `Connection` object captured the active tracing span at connection creation time as its parent, keeping that span alive for the entire lifetime of the connection. Since the router wraps every subgraph request in an OpenTelemetry span and connections are pooled, affected spans could linger indefinitely under sustained traffic — never being exported to the tracing backend and accumulating in memory.
+
+- **Flow-control stall on padded DATA frames ([#869](https://github.com/hyperium/h2/pull/869)) — lower relevance for typical subgraphs, higher for connectors:** Padding bytes in `DATA` frames were not being returned to the flow-control window, causing the connection window to drain to zero and permanently stalling downloads with no error. Typical GraphQL/gRPC subgraphs do not send padded frames, but router connectors calling arbitrary HTTP APIs (e.g., Google Cloud Storage or CDN-backed endpoints) can encounter this.
+
+By [@theJC](https://github.com/theJC) in https://github.com/apollographql/router/pull/9033
+
+
+
 # [2.10.2] - 2026-03-24
 
 ## 🔒 Security

diff --git a/Cargo.lock b/Cargo.lock
@@ -212,7 +212,7 @@ dependencies = [
 
 [[package]]
 name = "apollo-federation"
-version = "2.10.3-rc.0"
+version = "2.10.3"
 dependencies = [
  "apollo-compiler",
  "apollo-federation",
@@ -286,7 +286,7 @@ dependencies = [
 
 [[package]]
 name = "apollo-router"
-version = "2.10.3-rc.0"
+version = "2.10.3"
 dependencies = [
  "addr2line 0.25.1",
  "ahash",
@@ -463,7 +463,7 @@ dependencies = [
 
 [[package]]
 name = "apollo-router-benchmarks"
-version = "2.10.3-rc.0"
+version = "2.10.3"
 dependencies = [
  "apollo-parser",
  "apollo-router",

diff --git a/apollo-federation/Cargo.toml b/apollo-federation/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "apollo-federation"
-version = "2.10.3-rc.0"
+version = "2.10.3"
 authors = ["The Apollo GraphQL Contributors"]
 edition = "2024"
 description = "Apollo Federation"

diff --git a/apollo-router-benchmarks/Cargo.toml b/apollo-router-benchmarks/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "apollo-router-benchmarks"
-version = "2.10.3-rc.0"
+version = "2.10.3"
 authors = ["Apollo Graph, Inc. <packages@apollographql.com>"]
 edition = "2021"
 license = "Elastic-2.0"

diff --git a/apollo-router/Cargo.toml b/apollo-router/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "apollo-router"
-version = "2.10.3-rc.0"
+version = "2.10.3"
 authors = ["Apollo Graph, Inc. <packages@apollographql.com>"]
 repository = "https://github.com/apollographql/router/"
 documentation = "https://docs.rs/apollo-router"
@@ -59,7 +59,7 @@ snapshot = []
 addr2line = "0.25.0"
 anyhow = "1.0.86"
 apollo-compiler.workspace = true
-apollo-federation = { path = "../apollo-federation", version = "=2.10.3-rc.0" }
+apollo-federation = { path = "../apollo-federation", version = "=2.10.3" }
 async-compression = { version = "0.4.6", features = [
     "tokio",
     "futures-io",

diff --git a/docs/shared/k8s-manual-config.mdx b/docs/shared/k8s-manual-config.mdx
@@ -6,10 +6,10 @@ kind: ServiceAccount
 metadata:
   name: release-name-router
   labels:
-    helm.sh/chart: router-2.10.3-rc.0
+    helm.sh/chart: router-2.10.3
     app.kubernetes.io/name: router
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: "v2.10.3-rc.0"
+    app.kubernetes.io/version: "v2.10.3"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: router/templates/secret.yaml
@@ -18,10 +18,10 @@ kind: Secret
 metadata:
   name: "release-name-router"
   labels:
-    helm.sh/chart: router-2.10.3-rc.0
+    helm.sh/chart: router-2.10.3
     app.kubernetes.io/name: router
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: "v2.10.3-rc.0"
+    app.kubernetes.io/version: "v2.10.3"
     app.kubernetes.io/managed-by: Helm
 data:
   managedFederationApiKey: "UkVEQUNURUQ="
@@ -32,10 +32,10 @@ kind: ConfigMap
 metadata:
   name: release-name-router
   labels:
-    helm.sh/chart: router-2.10.3-rc.0
+    helm.sh/chart: router-2.10.3
     app.kubernetes.io/name: router
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: "v2.10.3-rc.0"
+    app.kubernetes.io/version: "v2.10.3"
     app.kubernetes.io/managed-by: Helm
 data:
   configuration.yaml: |
@@ -55,10 +55,10 @@ kind: Service
 metadata:
   name: release-name-router
   labels:
-    helm.sh/chart: router-2.10.3-rc.0
+    helm.sh/chart: router-2.10.3
     app.kubernetes.io/name: router
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: "v2.10.3-rc.0"
+    app.kubernetes.io/version: "v2.10.3"
     app.kubernetes.io/managed-by: Helm
 spec:
   type: ClusterIP
@@ -81,10 +81,10 @@ kind: Deployment
 metadata:
   name: release-name-router
   labels:
-    helm.sh/chart: router-2.10.3-rc.0
+    helm.sh/chart: router-2.10.3
     app.kubernetes.io/name: router
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: "v2.10.3-rc.0"
+    app.kubernetes.io/version: "v2.10.3"
     app.kubernetes.io/managed-by: Helm
   annotations:
 
@@ -103,10 +103,10 @@ spec:
       annotations:
         kubectl.kubernetes.io/default-container: router
       labels:
-        helm.sh/chart: router-2.10.3-rc.0
+        helm.sh/chart: router-2.10.3
         app.kubernetes.io/name: router
         app.kubernetes.io/instance: release-name
-        app.kubernetes.io/version: "v2.10.3-rc.0"
+        app.kubernetes.io/version: "v2.10.3"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: release-name-router
@@ -117,7 +117,7 @@ spec:
         - name: router
           securityContext:
             {}
-          image: "ghcr.io/apollographql/router:v2.10.3-rc.0"
+          image: "ghcr.io/apollographql/router:v2.10.3"
           imagePullPolicy: IfNotPresent
           args:
             - --hot-reload
@@ -171,10 +171,10 @@ kind: Pod
 metadata:
   name: "release-name-router-test-connection"
   labels:
-    helm.sh/chart: router-2.10.3-rc.0
+    helm.sh/chart: router-2.10.3
     app.kubernetes.io/name: router
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: "v2.10.3-rc.0"
+    app.kubernetes.io/version: "v2.10.3"
     app.kubernetes.io/managed-by: Helm
   annotations:
     "helm.sh/hook": test

diff --git a/helm/chart/router/Chart.yaml b/helm/chart/router/Chart.yaml
@@ -20,10 +20,10 @@ type: application
 # so it matches the shape of our release process and release automation.
 # By proxy of that decision, this version uses SemVer 2.0.0, though the prefix
 # of "v" is not included.
-version: 2.10.3-rc.0
+version: 2.10.3
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v2.10.3-rc.0"
+appVersion: "v2.10.3"
diff --git a/helm/chart/router/README.md b/helm/chart/router/README.md
@@ -2,7 +2,7 @@
 
 [router](https://github.com/apollographql/router) Rust Graph Routing runtime for Apollo Federation
 
-![Version: 2.10.3-rc.0](https://img.shields.io/badge/Version-2.10.3--rc.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v2.10.3-rc.0](https://img.shields.io/badge/AppVersion-v2.10.3--rc.0-informational?style=flat-square)
+![Version: 2.10.3](https://img.shields.io/badge/Version-2.10.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v2.10.3](https://img.shields.io/badge/AppVersion-v2.10.3-informational?style=flat-square)
 
 ## Prerequisites
 
@@ -11,15 +11,15 @@
 ## Get Repo Info
 
 ```console
-helm pull oci://ghcr.io/apollographql/helm-charts/router --version 2.10.3-rc.0
+helm pull oci://ghcr.io/apollographql/helm-charts/router --version 2.10.3
 ```
 
 ## Install Chart
 
 **Important:** only helm3 is supported
 
 ```console
-helm upgrade --install [RELEASE_NAME] oci://ghcr.io/apollographql/helm-charts/router --version 2.10.3-rc.0 --values my-values.yaml
+helm upgrade --install [RELEASE_NAME] oci://ghcr.io/apollographql/helm-charts/router --version 2.10.3 --values my-values.yaml
 ```
 
 _See [configuration](#configuration) below._

diff --git a/scripts/install.sh b/scripts/install.sh
@@ -11,7 +11,7 @@ BINARY_DOWNLOAD_PREFIX="${APOLLO_ROUTER_BINARY_DOWNLOAD_PREFIX:="https://github.
 
 # Router version defined in apollo-router's Cargo.toml
 # Note: Change this line manually during the release steps.
-PACKAGE_VERSION="v2.10.3-rc.0"
+PACKAGE_VERSION="v2.10.3"
 
 download_binary() {
     downloader --check