Features:
- add deprecation support for GraphQL queries, mutations, and subscriptions (#463) by charlieaten (#463)
Bug Fixes:
-
enforce tenant on every subscription notification, not just the batch head (CVE-2026-80223) by @zachdaniel
-
isolate the batch_resolved process key so re-entrant publishes don't cross topics (CVE-2026-82367) by @zachdaniel
-
apply the subscription authorization filter to the whole batch, not just the first notification (CVE-2026-81643) by @zachdaniel
-
return a graphql error for unknown relay node types instead of raising (CVE-2026-81633) by @zachdaniel
-
apply query complexity limit to first/last pagination arguments (CVE-2026-81636) by @zachdaniel
-
don't crash complexity analysis on a null limit argument by @zachdaniel
-
don't re-attach a redacted error path after the error handler runs (CVE-2026-78693) by @zachdaniel