Skip to content

10.0.0-RC1 "Security Galore"

Pre-release
Pre-release

Choose a tag to compare

View all tags
@mfn mfn released this 18 Mar 11:25
10.0.0-RC1
e1ec2ca
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

‼️ BREAKING CHANGES ‼️

Warning

Please also read https://github.com/rebing/graphql-laravel/blob/master/UPGRADE.md#upgrading-from-9-to-10

This release focuses on hardening the security defaults of this library for production deployments and hence comes with breaking changes:

  • Default HTTP method changed from GET/POST to POST only
  • Batching disabled by default (batching.default → false)
    • Added max_batch_size config option to limit batch query operations
  • Introspection disabled by default (GRAPHQL_DISABLE_INTROSPECTION env var)
  • Default query_max_depth set to 13 (was unlimited)
  • Default query_max_complexity set to 500 (was unlimited)
  • Authorization now runs before validation in field resolver
  • Authorization uses strict === true comparison

See also the upgrade guide from 9 to 10.

For discussion, please use #1211

Full Changelog: 9.17.0...10.0.0-RC1

Assets 2
Loading