From 05f3dc260f38ec079997618c7b5d7d33a5e41ab7 Mon Sep 17 00:00:00 2001
From: daedalus <44623501+ComfortablyCoding@users.noreply.github.com>
Date: Wed, 1 Jul 2026 16:51:02 -0400
Subject: [PATCH] add breaking change notes 12.1.0

---
 .../releases/3.breaking-changes/3.version-12.md  | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/content/releases/3.breaking-changes/3.version-12.md b/content/releases/3.breaking-changes/3.version-12.md
index 327f0d936..9670a67e0 100644
--- a/content/releases/3.breaking-changes/3.version-12.md
+++ b/content/releases/3.breaking-changes/3.version-12.md
@@ -10,6 +10,22 @@ description: Breaking changes may require action on your part before upgrading.
 
 The `/utils/hash/generate` and `/utils/hash/verify` endpoints have been removed. Equivalent behavior can be achieved by using extensions endpoints along with the `argon2` library.
 
+### Sensitive GraphQL system mutations are now limited to single use
+
+Sensitive GraphQL system mutations are now limited to one per request, set by the `GRAPHQL_SINGLE_USE_MUTATIONS` environment variable.
+
+### GraphQL WebSocket restrictions now match the HTTP endpoint
+
+GraphQL over WebSockets now applies the same restrictions as the HTTP endpoint. When introspection is disabled, validation hints are hidden.
+
+### `CORS_ORIGIN` is now enforced for WebSocket connections
+
+WebSocket connections are now validated against `CORS_ORIGIN`. If you use WebSockets, make sure `CORS_ORIGIN` includes your clients' origins, or those connections will now be rejected.
+
+### Hardened upload path validation
+
+Upload path validation has been hardened to prevent writes to extension and temporary storage directories. Uploads that previously targeted these protected directories will now be rejected.
+
 ## Version 12.0.0
 
 Jump to: