What wp-graphql/wp-graphql shipped
Written by FoxPlug from the repository's own releases; not affiliated with Wpgraphql. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/wp-graphql/wp-graphql; Wpgraphql did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Query depth limiting is now on by default for new installs, schema-only queries are no longer limited, and a filter lets code change the limit per request. Pull request #4341
- Smart cache no longer advertises error responses as cacheable, since the Cache-Control decision now accounts for the response. Pull request #4390
- The GraphQL query cache key can now be filtered instead of being a fixed SHA-256 hash with no filter applied. Pull request #4389
- Taxonomy.public now reports the registered value, so a taxonomy registered with public false is no longer reported as public in the API. Pull request #4414
- Taxonomy now exposes publiclyQueryable, matching ContentType and the visibility set WordPress groups together. Pull request #4425
- The IDE resends public-visitor requests when the server answers with an HTTP auth challenge, keeping public requests working behind HTTP Basic Auth. Pull request #4396
- WPGraphQL admin notices on the dedicated IDE page now sit above the IDE instead of on top of it. Pull request #4340
- Admin notices registered with register_graphql_admin_notice() now sit above the legacy GraphiQL IDE and show on two WPGraphQL screens where they were missing. Pull request #4339
- Unit test coverage was added for the security and query-control validation rules in WPGraphQL Server ValidationRules. Pull request #4343
- The work queue now moves an issue to In Progress while a pull request that fixes it is open, distinguishing work in review from work not started. Pull request #4415
Why it matters
This week tightens the defaults for new installs with query depth limiting on by default, while existing sites keep their configuration. It also fixes several correctness issues: smart cache no longer marks error responses as cacheable and its query cache key is filterable, taxonomy visibility now matches what WordPress registered, and the IDE keeps public requests working behind HTTP Basic Auth.
Changelog entry
- Enable query depth limiting by default for new installs and add a max depth filter. Pull request #4341
- Stop smart cache from advertising error responses as cacheable. Pull request #4390
- Allow filtering the GraphQL query cache key. Pull request #4389
- Report public: false for taxonomies registered with public false. Pull request #4414
- Add publiclyQueryable to Taxonomy and correct the public description. Pull request #4425
- Keep IDE public requests working behind HTTP Basic Auth. Pull request #4396
- Show WPGraphQL admin notices above the IDE instead of over it. Pull request #4340
- Show admin notices above the legacy GraphiQL IDE and on the Extensions screen. Pull request #4339
- Add unit test coverage for Server ValidationRules. Pull request #4343
- Move an issue to In Progress while its fix is open for review. Pull request #4415
- Update documentation links to moved extension repositories. Pull request #4395
Query depth limiting is on by default for new installs and schema-only queries are no longer limited. Smart cache no longer advertises error responses as cacheable, the query cache key is filterable, and taxonomy visibility now matches what WordPress registered.
This week, query depth limiting is on by default for new installs, schema-only queries are no longer limited, and a new filter lets code change the limit per request. Existing sites keep their configuration. Smart cache no longer advertises error responses as cacheable, and its GraphQL query cache key can now be filtered rather than being a fixed hash. Taxonomy.public now reports the registered value, and Taxonomy exposes publiclyQueryable to match ContentType. The IDE keeps public requests working behind HTTP Basic Auth by resending when the server answers with an auth challenge, admin notices now sit above the IDE, and new unit tests cover Server ValidationRules.
Week of September 21, 2026
What shipped
- Released wp-graphql 2.23.1 with tightened media item update authorization for GHSA-4h2c-85f8-g3jh. Release
- Fixed media item update authorization to properly enforce access controls as described in GHSA-4h2c-85f8-g3jh. Pull request #4353
- Fixed framework cache layer preventing content edits from reaching wpgraphql.com. Pull request #4364
- Fixed client-side loading of @docsearch/react to prevent WordPress-backed pages from freezing. Pull request #4363
- Added SEO metadata including title, description, canonical, Open Graph, Twitter cards, and JSON-LD to wpgraphql.com. Pull request #4359
- Fixed JSON-LD origin rewrite to use the configured WordPress URL instead of the CMS origin. Pull request #4361
- Improved logging for /api/revalidate endpoint to show which paths were rebuilt and fixed two dead documentation URLs. Pull request #4367
- Allowlisted Jetpack Site Accelerator hosts for next/image to support media URLs from the WordPress.com-hosted CMS. Pull request #4358
- Updated website CI and image defaults to point at the migrated CMS origin instead of the retiring WP Engine install. Pull request #4356
- Moved 23 recipe screenshot images into the repository to prevent 404s after the WP Engine install termination. Pull request #4357
Why it matters
A security fix in 2.23.1 tightens media item authorization. The website saw a major incident where content edits stopped appearing due to caching and loading issues, now resolved. The project also migrated its CMS from WP Engine and added SEO metadata to improve site discoverability.
Changelog entry
- 2.23.1 - tighten media item update authorization (GHSA-4h2c-85f8-g3jh) Release
Wp-graphql 2.23.1 is out with a media authorization security fix. Website incidents from framework caching and loading issues are resolved. SEO metadata now live on wpgraphql.com.
Wp-graphql 2.23.1 released with security fix for media item update authorization (GHSA-4h2c-85f8-g3jh). The project addressed a critical website incident where content edits weren't reaching the live site due to framework cache and component loading issues. Site now includes full SEO metadata and has successfully migrated its CMS away from WP Engine.
Week of September 14, 2026
What shipped
- Wp-graphql core 2.23.0 released with updated WordPress component dependencies from 38.0.0 to 39.0.0 and dev dependency updates. Release
- Wp-graphql-ide 5.6.0 released with WordPress component dependency updates and npm package updates. Release
- Wp-graphql-smart-cache 2.3.2 released with a security fix requiring persisted query ids to match the query hash and auditing stored documents. Pull request #4332
- Smart Cache fix to prevent fatal errors on option updates when WPGraphQL core is older than 2.18.0. Pull request #4333
- Wp-graphql-smart-cache 2.3.2 released with updates to wp-graphql-stubs dev dependencies. Release
- Unit test coverage added for helper methods in the WPGraphQL Utils class. Pull request #4321
- Plugin documentation directories excluded from release-please versioning to prevent unrelated changes from triggering version bumps. Pull request #4335
Why it matters
This week includes three stable releases across the core wp-graphql project and two related plugins. A security fix in Smart Cache addresses query persistence validation, while version compatibility fixes ensure the plugin works with older core versions. Dependency updates keep the ecosystem current with WordPress component libraries.
Changelog entry
- Wp-graphql 2.23.0: deps bump @wordpress/components from 38.0.0 to 39.0.0 Release
- Wp-graphql-ide 5.6.0: deps bump @wordpress/components from 37.0.0 to 39.0.0 Release
- Wp-graphql-smart-cache 2.3.2: fix persisted query ids validation and audit stored documents (GHSA-r844-6gqh-59qj) Pull request #4332
- Wp-graphql-smart-cache: prevent fatal error on option updates for WPGraphQL core older than 2.18.0 Pull request #4333
- Add comprehensive unit test coverage for WPGraphQL Utils helper methods Pull request #4321
Wp-graphql 2.23.0, wp-graphql-ide 5.6.0, and Smart Cache 2.3.2 are now available. Smart Cache includes a security fix for persisted queries and improved compatibility with older core versions.
This week we shipped stable releases across the wp-graphql ecosystem. wp-graphql 2.23.0 and wp-graphql-ide 5.6.0 update dependencies to latest WordPress components. wp-graphql-smart-cache 2.3.2 includes security improvements for persisted query validation and fixes compatibility issues with older wp-graphql core versions. All packages are ready for production use.