v0.22.0

[0.22.0] - 2026-10-04

Highlights

An authorization and availability audit of @loradb/lora-graphql against a production consumer.

• Security fixes: @authorization on Query/Mutation @cypher fields is now enforced (it was accepted and ignored); directives on extend type are no longer dropped; a negated filter on a guarded field, full-text and vector search, subscription DELETE / previousState / relationship events, and write error messages no longer reveal hidden data.
• Availability: the engine enforces timeoutMs and cancellation inside pattern/list comprehensions (relationship filters ran unbounded); a @cypher mutation inside a shared transaction no longer deadlocks every write; queries get an operation deadline and bounded statement concurrency; filters are charged the rows they examine.
• New: rule references (${node.path}, ${source.…}/${target.…}), <field>Exists, @uniqueTogether, nestedOperations: [UPDATE_EDGE], $viewer in @cypher, @size/@range on arguments, nodes(ids:), lora.operationAccess(), read-sets from execute(), G-42 property rules, and new check() lints.

Upgrade notes

• A delete or update on a node the caller can't read now behaves like a missing key (null / nodesDeleted: 0) instead of FORBIDDEN.
• @authorizationDefaults(mutations:) now applies per operation the type's own rules don't cover (a filter rule never covers CREATE).
• New limits with defaults: maxFilterDepth 2, maxListFilter 1000, maxStringFilter 10 000, operationTimeoutMs 2 × timeoutMs, maxConcurrentStatements 2, maxSubscriptions 100, compileCacheBytes 64 MiB; maxBatch also counts updates and disconnects.
• A @fulltext index over a masked or READ-guarded field is a model error; previousState fields with masks or field @authentication follow the subscriber's access.
• Root @cypher fields now appear in accessMatrix() (snapshot diffs expected); viewer is a reserved @cypher argument name.
• Using Yoga on getSchema()? Add plugins: [lora.envelopPlugin()] for atomic multi-root mutations and error collapsing.

Bug fixes

• executor: Enforce the query deadline and cancellation inside comprehensions (b31a53f)
• lora-graphql: Collapse identical errors across list indices (b11e0b2)
• lora-graphql: Cap filter operands with maxListFilter and maxStringFilter (f9e203d)
• lora-graphql: Estimate nested fan-out at the maximum degree after analyze() (9b01940)
• lora-graphql: Charge filters the rows they examine; maxFilterDepth (4bc0e68)
• lora-graphql: Atomic multi-root mutations through envelopPlugin() (dc82c3f)
• lora-graphql: Apply the mutations default per uncovered operation (6fedb6e)
• lora-graphql: Write errors no longer reveal hidden nodes (f06e242)
• lora-graphql: MaxBatch counts updates, upsert inputs and disconnect lists (d614e28)
• lora-graphql: Check @uniqueTogether after @cypher mutations (fc2a31d)
• lora-graphql: @cypher mutations run in the shared transaction (edb0179)
• lora-graphql: Charge cost per execution, not per reused context (7cdc4a8)
• lora-graphql: Bound subscriptions and charge their filters (4d8bc5e)
• lora-graphql: Relationship events name only nodes the subscriber may read (fd3eea5)
• lora-graphql: PreviousState honours masks and field authentication (3a8f4f2)
• lora-graphql: A deleted node's events reach only subscribers who could read it (4c3f640)
• lora-graphql: Directives on type extensions are no longer dropped (e4420f9)
• lora-graphql: Vector search with vector: checks the vector field's read rules (6bf6557)
• lora-graphql: A full-text index over a guarded field is a model error (ca06363)
• lora-graphql: A negated filter on a guarded field no longer reveals it (b4ecc96)

Documentation

• lora-graphql: Mark load-audit finding 6 addressed; threat model limits (be7ad9b)

Features

• lora-graphql: Operation deadline and statement concurrency per query (2820000)
• lora-graphql: @timestamp and @populatedBy fields settable by explicit @settable and a rule (993e7fa)
• lora-graphql: Relationship-property READ rules may test source, target and edge (G-42) (688f098)
• lora-graphql: Lora.operationAccess() gives each root field's verdict per caller (df64193)
• lora-graphql: Access matrix lists relationship-property rules, field writes and key scopes (dff2d65)
• lora-graphql: CLI diff --base over files and directories (fc6344a)
• lora-graphql: Execute() returns the operation's read-set for response caches (496ed3c)
• lora-graphql: Nodes(ids:) root field next to node(id:) (bdc94c9)
• lora-graphql: @range(min:, max:) on Int and Float arguments of @cypher fields (1e17cdf)
• lora-graphql: EnvelopPlugin reports a second graphql copy (eaa102f)
• lora-graphql: Export LORA_GRAPHQL_ERROR_CODES and isLoraGraphQLError (3898496)
• lora-graphql: Rule references, @uniqueTogether, authorization lints and @cypher hardening (2375fde)

Performance

• lora-graphql: Bound the compile and document caches by bytes (88d094b)

Tests

• lora-graphql: Delete the followed secret as its owner (26903cc)

---

Assets

Platform	Asset
Linux x86_64	lora-server-v0.22.0-x86_64-unknown-linux-gnu.tar.gz
Windows x86_64	lora-server-v0.22.0-x86_64-pc-windows-msvc.zip
macOS Intel	lora-server-v0.22.0-x86_64-apple-darwin.tar.gz
macOS Apple Silicon	lora-server-v0.22.0-aarch64-apple-darwin.tar.gz
Full changelog	CHANGELOG.md

Each binary archive ships with a matching .sha256 file. An aggregated lora-server-v0.22.0-SHA256SUMS.txt is also attached.

Download, verify, and run instructions: see RELEASING.md and the README.