10.0.0-RC3

[mfn]

New changes in RC3

Breaking changes

• Privacy::validate() and closure signature changed #1251 / mfn
  new mixed $root first parameter, new optional ?ResolveInfo $resolveInfo fourth parameter, $queryContext now typed as mixed
• Remove $getSelectFields parameter from Field::authorize() #1250 / mfn
  it has been non-functional since half a decade

Fixed

• Fix SelectFields crashing when field types use callable #1252 / mfn
• Fix APQ middleware race condition (TOCTOU) #1253 / mfn
• Fix OperationParams not copying originalInput/readOnly, causing TypeError #1254 / mfn
• Fix APQ config not using config() inside config file #1255 / mfn

Changes in RC2

Breaking changes

• Privacy::validate() first parameter renamed from $queryArgs to $fieldArgs — it now receives the field's own arguments instead of root query arguments
• SelectFields now identifies wrapper types via the Rebing\GraphQL\Support\Contracts\WrapType marker interface. Custom pagination types and wrap types used with SelectFields must implement this interface. #1228 / mfn

Added

• Add tracing support with OpenTelemetry driver #1220 / mfn
• Rebing\GraphQL\Support\Contracts\WrapType marker interface for wrapper types (pagination types and custom wrap types) #1228 / mfn

Fixed

• Narrow GraphQL::type() PHPStan return type to (NullableType&Type)|NonNull so consumers can pass it to Type::nonNull() without static analysis errors #1221 / mfn
• Fix SelectFields forcing select * for Interface return types instead of selecting only the requested columns #683 / mfn
• Fix SelectFields not calling custom query callbacks on relation fields inside UnionType members #900 / mfn
• Fix cross-field validation rules (prohibits, required_without, required_if, etc.) not working in nested InputTypes #930 / mfn
• Fix privacy attribute ignored on nested/sub-types by moving enforcement from SelectFields to field resolvers in Type::getFields() #1161 / mfn
• Fix SelectFields producing empty SELECT clause for custom wrap types created via GraphQL::wrapType() #1228 / mfn

Changes in RC1

Breaking changes

• Security hardening: safer defaults for production deployments #1210 / mfn
  • Default HTTP method changed from GET/POST to POST only
  • Batching disabled by default (batching.default → false)
  • Introspection disabled by default (GRAPHQL_DISABLE_INTROSPECTION env var)
  • Default query_max_depth set to 13 (was unlimited)
  • Default query_max_complexity set to 500 (was unlimited)
  • Authorization now runs before validation in field resolver
  • Authorization uses strict === true comparison

Added

- Added `max_batch_size` config option to limit batch query operations

Full Changelog: 10.0.0-RC2...10.0.0-RC3

---

This discussion was created from the release 10.0.0-RC3.