9.0.0 — GraphQL security mitigations

Security release with breaking changes

Version 9.0.0 contains high-priority GraphQL security mitigations and requires application migration before deployment.

Security fixes

• Remove model data, submitted input and raw validation messages from standard mutation errors.
• Bind mutation IDs to primary-key lookups to prevent PHQL injection.
• Use the explicit dispatch DI for authorization and execution; clear handler/resolver caches between dispatches.
• Reject unsupported ACL plugin registration and missing authorization/field definitions.
• Require explicit generated input fields and writable mutation properties.
• Require webonyx/graphql-php 15.32.3 or newer within the 15.x line.

Migration required

Configure generated inputs with only() or explicit fields, define writableFields() for standard create/update mutations, explicitly call $dispatcher->setDI($requestDi), and register the ACL plugin on the schema. Review application record and tenant policies as part of the upgrade.

Read the complete migration guide and changelog before updating. Deploy the application policies and updated Composer lockfiles together with this library.

Validation

• 56 security regression checks passed with graphql-php 15.32.3, and 56 with 15.38.1.
• Tested with PHP 8.4.26, Phalcon 5.22.1 and the published phalcon-api 6.0.0.
• PHP syntax checks passed for all 93 source/test files.
• Both isolated dependency lockfiles passed composer audit --locked without vulnerability advisories.

Remaining work

Existing PHP 8.4 implicit-nullability deprecation notices remain in scalar types and several ModelCollection methods. Keep diagnostic output out of public production responses. Filter/sort/search policies, union ACL semantics, complete schema immutability, introspection policy and application authentication rollout are not fully addressed by this release; phalcon-api authentication fixes require separate work.