Skip to content

Add v12.1.0 breaking change notes #760

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ComfortablyCoding merged 1 commit into from
Jul 1, 2026
Merged

Add v12.1.0 breaking change notes #760

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions content/releases/3.breaking-changes/3.version-12.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,22 @@ description: Breaking changes may require action on your part before upgrading.

The `/utils/hash/generate` and `/utils/hash/verify` endpoints have been removed. Equivalent behavior can be achieved by using extensions endpoints along with the `argon2` library.

### Sensitive GraphQL system mutations are now limited to single use

Sensitive GraphQL system mutations are now limited to one per request, set by the `GRAPHQL_SINGLE_USE_MUTATIONS` environment variable.

### GraphQL WebSocket restrictions now match the HTTP endpoint

GraphQL over WebSockets now applies the same restrictions as the HTTP endpoint. When introspection is disabled, validation hints are hidden.

### `CORS_ORIGIN` is now enforced for WebSocket connections

WebSocket connections are now validated against `CORS_ORIGIN`. If you use WebSockets, make sure `CORS_ORIGIN` includes your clients' origins, or those connections will now be rejected.

### Hardened upload path validation

Upload path validation has been hardened to prevent writes to extension and temporary storage directories. Uploads that previously targeted these protected directories will now be rejected.

## Version 12.0.0

Jump to:
Expand Down
Loading