What wp-graphql/wp-graphql shipped

WPGraphQL 2.26.2 is out: malformed cursors now return no results instead of the first page. Comment connections are limited to what the requester can see. WPGraphQL for ACF 3.2.0 and Smart Cache 2.4.0 also shipped, and updateComment now reports itself as an update.

WPGraphQL 2.26.2 is released. Passing a cursor WPGraphQL did not return now gives no results instead of the first page, so check any client that sends after or before values taken from URLs. The comments connection now only filters and counts comments the requesting user can see, and settings exposed only through the REST API now need manage_options to read through the settings fields. WPGraphQL for ACF 3.2.0 lets custom field types resolve ACF's formatted value and returns null for options pages whose loader was replaced. WPGraphQL Smart Cache 2.4.0 passes structured context to purge listeners and no longer purges a user's cached data on every login and logout. Term mutations now fire an update data action, and updateComment reports itself as an update.

Wp-graphql 2.26.0 is out with Site Health checks for security settings and a static to_global_id() helper on models. wp-graphql-acf 3.1.0 fixes a long list of bugs; five fixes can change results, so read the upgrade notice. wp-graphql-ide 5.8.0 adds a usage tracking opt-out.

Three releases this week. wp-graphql 2.26.0 adds four Site Health checks for WPGraphQL security settings and a static to_global_id() helper on the model layer. wp-graphql-acf 3.1.0 fixes a long list of bugs after a quiet stretch; five of those fixes can change what a query returns or which types a field group appears on, and one asks sites on ACF older than 6.1 to check their field groups, all described in the upgrade notice. wp-graphql-ide 5.8.0 includes dependency updates and lets sites opt out of usage tracking from settings. WYSIWYG values with block markup now render blocks before ACF's wpautop, and a duplicated ACF field gets its own GraphQL field name.

WPGraphQL 2.25.0 is out, along with IDE 5.7.0 and Smart Cache 2.3.4. WPGraphQL for ACF now tests and documents Secure Custom Fields support, Link fields in rows resolve title, url and target, and sites can opt out of usage tracking from settings.

This week: WPGraphQL 2.25.0 shipped, alongside WPGraphQL IDE 5.7.0 and Smart Cache 2.3.4. For people using WPGraphQL for ACF, the integration suite now runs against Secure Custom Fields and documents it as supported. Link fields with the Link URL return format resolve inside repeater and flexible content rows, field groups on All blocks apply to every block type, and stored 0 values resolve as 0 instead of null. Sites can also opt out of usage tracking from the settings screen.

Wp-graphql 2.24.0, 2.24.1 and 2.24.2 are out. 2.24.1 and 2.24.2 are security patches that change behavior for comment mutations, media address validation and restricted views. Upgrade notices for 2.24.1, 2.24.2 and ACF 3.0.1 are in the readmes. Read them before updating.

This week shipped three releases of wp-graphql. 2.24.0 adds a security settings review, publiclyQueryable on Taxonomy, and query depth limiting for new installs. 2.24.1 and 2.24.2 are security patches: media address validation now rejects internal IPv6 forms and the local-use NAT64 prefix and fails closed on a failed AAAA lookup, and several mutations now check capabilities before looking up their target. Comment mutations no longer reveal which comment IDs exist or overwrite a stored byline when only content changes, and trashed content requires edit_others_posts to read. Several of these fixes change behavior a site may depend on, so hand-written upgrade notices were added for 2.24.1 and 2.24.2, and for ACF 3.0.1, where the location rule fix removes fields from the schema.

Query depth limiting is on by default for new installs and schema-only queries are no longer limited. Smart cache no longer advertises error responses as cacheable, the query cache key is filterable, and taxonomy visibility now matches what WordPress registered.

This week, query depth limiting is on by default for new installs, schema-only queries are no longer limited, and a new filter lets code change the limit per request. Existing sites keep their configuration. Smart cache no longer advertises error responses as cacheable, and its GraphQL query cache key can now be filtered rather than being a fixed hash. Taxonomy.public now reports the registered value, and Taxonomy exposes publiclyQueryable to match ContentType. The IDE keeps public requests working behind HTTP Basic Auth by resending when the server answers with an auth challenge, admin notices now sit above the IDE, and new unit tests cover Server ValidationRules.

Wp-graphql 2.23.1 is out with a media authorization security fix. Website incidents from framework caching and loading issues are resolved. SEO metadata now live on wpgraphql.com.

Wp-graphql 2.23.1 released with security fix for media item update authorization (GHSA-4h2c-85f8-g3jh). The project addressed a critical website incident where content edits weren't reaching the live site due to framework cache and component loading issues. Site now includes full SEO metadata and has successfully migrated its CMS away from WP Engine.

Wp-graphql 2.23.0, wp-graphql-ide 5.6.0, and Smart Cache 2.3.2 are now available. Smart Cache includes a security fix for persisted queries and improved compatibility with older core versions.

This week we shipped stable releases across the wp-graphql ecosystem. wp-graphql 2.23.0 and wp-graphql-ide 5.6.0 update dependencies to latest WordPress components. wp-graphql-smart-cache 2.3.2 includes security improvements for persisted query validation and fixes compatibility issues with older wp-graphql core versions. All packages are ready for production use.