10.0.0-RC2

[mfn]

New changes in RC2

Breaking changes

• Privacy::validate() first parameter renamed from $queryArgs to $fieldArgs — it now receives the field's own arguments instead of root query arguments
• SelectFields now identifies wrapper types via the Rebing\GraphQL\Support\Contracts\WrapType marker interface. Custom pagination types and wrap types used with SelectFields must implement this interface. #1228 / mfn

Added

• Add tracing support with OpenTelemetry driver #1220 / mfn
• Rebing\GraphQL\Support\Contracts\WrapType marker interface for wrapper types (pagination types and custom wrap types) #1228 / mfn

Fixed

• Narrow GraphQL::type() PHPStan return type to (NullableType&Type)|NonNull so consumers can pass it to Type::nonNull() without static analysis errors #1221 / mfn
• Fix SelectFields forcing select * for Interface return types instead of selecting only the requested columns #683 / mfn
• Fix SelectFields not calling custom query callbacks on relation fields inside UnionType members #900 / mfn
• Fix cross-field validation rules (prohibits, required_without, required_if, etc.) not working in nested InputTypes #930 / mfn
• Fix privacy attribute ignored on nested/sub-types by moving enforcement from SelectFields to field resolvers in Type::getFields() #1161 / mfn
• Fix SelectFields producing empty SELECT clause for custom wrap types created via GraphQL::wrapType() #1228 / mfn

Changes from RC1

Breaking changes

• Security hardening: safer defaults for production deployments #1210 / mfn
  • Default HTTP method changed from GET/POST to POST only
  • Batching disabled by default (batching.default → false)
  • Introspection disabled by default (GRAPHQL_DISABLE_INTROSPECTION env var)
  • Default query_max_depth set to 13 (was unlimited)
  • Default query_max_complexity set to 500 (was unlimited)
  • Authorization now runs before validation in field resolver
  • Authorization uses strict === true comparison

Added

- Added `max_batch_size` config option to limit batch query operations

Full Changelog: 10.0.0-RC1...10.0.0-RC2

---

This discussion was created from the release 10.0.0-RC2.

[mfn]

Additionally the README has been refreshed to bring it up2date with the code base, recent changes, restructure for accessibility 🤞🏼 , etc.

There has also been a lot of internal work (phpunit 13, phpstan), but these are irrelevant for consumers so not mentioned in the changelog summaries.

The big things I've say are:

• change of config defaults in the name of security (from RC1)
• opentelemetry based tracing driver
• change/fix how 'privacy' now works everywhere, but received the "field args" and not query args and also does not change the actual SELECT statement anymore.

[illambo]

@mfn is on fire!!🔥😃

[illambo]

I have this consideration, at a high level (I don't have the picture of the implications at the moment), don't you think it's better to move the SelectFields component to another repository as an external utility given the difficulty of maintaining it (black box), also, given that I haven't had direct experience with it yet, but doesn't it overlap with some new features like https://laravel.com/docs/13.x/eloquent-relationships#automatic-eager-loading offered by the framework?

[mfn]

TBH would love to properly decouple it, but from what I've seen and my gut feeling tells me this is quite a task. Probably also a question if it's Worth.

Also any alternative should be more fletched out and I don't think that currently this is.

[illambo]

If that's okay with you, I'll try to look into this a little more at the beginning of the week.

[mfn]

sure thing!

ps: no need to rush, it won't be something for the 10.x release but for major things we can always thereafter cut a 11.x release, etc.

[illambo]

Hi, I wrote a preliminary analysis here 😉