graphql-laravel 10.0.0

This is the stable release of the 10.x series.

Version 10 focuses on safer production defaults, cleaner core architecture, and moving the optional Eloquent query-selection machinery into its own package.

Before upgrading, read the Upgrade Guide. For the complete RC-by-RC history and pull request references, see the Changelog.

Most Important Upgrade Notes

SelectFields moved to a separate package

SelectFields is no longer part of core.

If you use SelectFields, install the new package:

composer require rebing/graphql-laravel-select-fields

For most users, this is enough. The package keeps the original namespaces and reads the same field config keys such as model, alias, selectable, always, is_relation, and query.

Core removals related to this extraction:

• Rebing\GraphQL\Support\SelectFields removed from core
• Closure type-hint in resolve() no longer auto-injects a SelectFields factory unless the external package is installed
• Field::selectFieldClass() removed
• Field::instanciateSelectFields() removed
• Generated query/mutation stubs no longer include SelectFields boilerplate

Security defaults are stricter

Version 10 changes several defaults to be safer for production deployments:

• Schemas now default to POST only
• Batching is disabled by default
• Batch size is limited by batching.max_batch_size, default 10
• Introspection is disabled by default
• Query depth defaults to 13
• Query complexity defaults to 500
• Authorization now runs before validation
• authorize() must return exactly true

If you previously relied on open defaults, explicitly configure them during upgrade.

To re-enable introspection, for example in development:

GRAPHQL_DISABLE_INTROSPECTION=false

To re-enable GET requests:

'method' => ['GET', 'POST'],

If you enable GET, also enable ReadOnlyOperationMiddleware after AutomaticPersistedQueriesMiddleware so mutations and subscriptions are rejected on GET requests.

Privacy signatures changed

Privacy::validate() now receives the parent/root object and field arguments:

-public function validate(array $queryArgs, $queryContext = null): bool
+public function validate(mixed $root, array $fieldArgs, mixed $queryContext = null, ?ResolveInfo $resolveInfo = null): bool

Privacy closures receive the same shape:

-'privacy' => function (array $args, $ctx): bool {
+'privacy' => function (mixed $root, array $args, $ctx, ?ResolveInfo $info = null): bool {

The old first argument represented root query arguments. The new $fieldArgs contains the field's own arguments.

Middleware signatures changed

Resolver middleware now declares native mixed parameter and return types. Custom middleware overriding handle() must match:

-public function handle($root, array $args, $context, ResolveInfo $info, Closure $next)
+public function handle(mixed $root, array $args, mixed $context, ResolveInfo $info, Closure $next): mixed

authorize() signature changed

The unused $getSelectFields parameter was removed:

-public function authorize($root, array $args, $ctx, ?ResolveInfo $resolveInfo = null, ?Closure $getSelectFields = null): bool
+public function authorize($root, array $args, $ctx, ?ResolveInfo $resolveInfo = null): bool

Highlights

OpenTelemetry tracing support

Version 10 adds tracing infrastructure with an OpenTelemetry driver.

New tracing components include:

• TracingDriver
• TracingManager
• TracingExecutionMiddleware
• TracingResolverMiddleware
• OpenTelemetryTracingDriver

Tracing is disabled by default and can be enabled globally or per schema.

CSRF protection middleware

A new opt-in HTTP middleware is available:

Rebing\GraphQL\Support\Middleware\CsrfGuard::class

Use this for GraphQL endpoints that rely on cookie/session authentication, including Laravel session auth or Sanctum cookie mode.

Read-only GET enforcement

A new opt-in execution middleware rejects mutations and subscriptions submitted through GET:

Rebing\GraphQL\Support\ExecutionMiddleware\ReadOnlyOperationMiddleware::class

This is especially relevant if you enable GET for CDN-cacheable persisted queries.

Extensible resolver parameter injection

External packages can now hook into resolver parameter injection through:

• Rebing\GraphQL\Support\Contracts\ResolverParameterInjector
• Field::registerParameterInjector()
• Field::clearParameterInjectors()

This is what allows the external SelectFields package to restore SelectFields injection without keeping it in core.

Fixes And Behavior Improvements

• APQ middleware validates queries before persisting them in cache
• APQ cache lookup race condition fixed
• APQ config no longer calls config() inside the config file
• OperationParams now copies originalInput and readOnly
• Route middleware is no longer duplicated when no per-schema middleware is defined
• AddAuthUserContextValueMiddleware now resolves the guard from schema/global route config
• Cross-field validation rules in nested InputTypes now work correctly
• privacy on nested/sub-type fields is now enforced through field resolvers
• GraphQL::type() has a narrower PHPStan return type
• make:graphql:executionMiddleware is now registered correctly
• Minimum webonyx/graphql-php version is now ^15.31.0

Links

• Upgrade Guide
• Changelog

Stable release of the 10.x series.

No user-facing changes since 10.0.0-RC5. See the 10.0.0-RC1 through 10.0.0-RC5 entries below for the full set of breaking changes, additions, and fixes.

New changes in RC5

Added

• ExecutionMiddleware\ReadOnlyOperationMiddleware rejects GET requests targeting mutations #1261 / mfn
• Support\Middleware\CsrfGuard CSRF protection middleware #1265 / mfn

Changed

• ExecutionMiddleware\AddAuthUserContextValueMiddleware now resolves the auth guard from the config #1262 / mfn

Fixed

• Avoid duplicate middleware if no per-schema middleware is defined #1263 / mfn
• APQ middleware validates queries before persisting them in cache #1264 / mfn

Changes in RC4

Breaking changes

• SelectFields extracted to separate package https://github.com/rebing/graphql-laravel-select-fields/
  • Rebing\GraphQL\Support\SelectFields class removed from core
  • Rebing\GraphQL\Support\Contracts\WrapType interface removed from core
  • Closure type-hint in resolve() no longer auto-injects SelectFields factory
  • Field::selectFieldClass() and Field::instanciateSelectFields() removed
  • 'selectable' => false removed from pagination type metadata fields
  • Generated query/mutation stubs no longer include SelectFields boilerplate
  • Install rebing/graphql-laravel-select-fields to restore all functionality

Added

• Rebing\GraphQL\Support\Contracts\ResolverParameterInjector interface for extensible resolver DI
• Field::registerParameterInjector() / Field::clearParameterInjectors() for external DI hooks

Changes in RC3

Breaking changes

• Privacy::validate() and closure signature changed #1251 / mfn
  new mixed $root first parameter, new optional ?ResolveInfo $resolveInfo fourth parameter, $queryContext now typed as mixed
• Remove $getSelectFields parameter from Field::authorize() #1250 / mfn
  it has been non-functional since half a decade

Fixed

• Fix SelectFields crashing when field types use callable #1252 / mfn
• Fix APQ middleware race condition (TOCTOU) #1253 / mfn
• Fix OperationParams not copying originalInput/readOnly, causing TypeError #1254 / mfn
• Fix APQ config not using config() inside config file #1255 / mfn

Changes in RC2

Breaking changes

• Privacy::validate() first parameter renamed from $queryArgs to $fieldArgs — it now receives the field's own arguments instead of root query arguments
• SelectFields now identifies wrapper types via the Rebing\GraphQL\Support\Contracts\WrapType marker interface. Custom pagination types and wrap types used with SelectFields must implement this interface. #1228 / mfn

Added

• Add tracing support with OpenTelemetry driver #1220 / mfn
• Rebing\GraphQL\Support\Contracts\WrapType marker interface for wrapper types (pagination types and custom wrap types) #1228 / mfn

Fixed

• Narrow GraphQL::type() PHPStan return type to (NullableType&Type)|NonNull so consumers can pass it to Type::nonNull() without static analysis errors #1221 / mfn
• Fix SelectFields forcing select * for Interface return types instead of selecting only the requested columns #683 / mfn
• Fix SelectFields not calling custom query callbacks on relation fields inside UnionType members #900 / mfn
• Fix cross-field validation rules (prohibits, required_without, required_if, etc.) not working in nested InputTypes #930 / mfn
• Fix privacy attribute ignored on nested/sub-types by moving enforcement from SelectFields to field resolvers in Type::getFields() #1161 / mfn
• Fix SelectFields producing empty SELECT clause for custom wrap types created via GraphQL::wrapType() #1228 / mfn

Changes in RC1

Breaking changes

• Security hardening: safer defaults for production deployments #1210 / mfn
  • Default HTTP method changed from GET/POST to POST only
  • Batching disabled by default (batching.default → false)
  • Introspection disabled by default (GRAPHQL_DISABLE_INTROSPECTION env var)
  • Default query_max_depth set to 13 (was unlimited)
  • Default query_max_complexity set to 500 (was unlimited)
  • Authorization now runs before validation in field resolver
  • Authorization uses strict === true comparison

Added

- Added `max_batch_size` config option to limit batch query operations

Full Changelog: 10.0.0-RC4...10.0.0-RC5

Added

• ExecutionMiddleware\ReadOnlyOperationMiddleware rejects GET requests targeting mutations #1261 / mfn
• Support\Middleware\CsrfGuard CSRF protection middleware #1265 / mfn

Changed

• ExecutionMiddleware\AddAuthUserContextValueMiddleware now resolves the auth guard from the config #1262 / mfn

Fixed

• Avoid duplicate middleware if no per-schema middleware is defined #1263 / mfn
• APQ middleware validates queries before persisting them in cache #1264 / mfn

New changes in RC4

Breaking changes

• SelectFields extracted to separate package https://github.com/rebing/graphql-laravel-select-fields/
  • Rebing\GraphQL\Support\SelectFields class removed from core
  • Rebing\GraphQL\Support\Contracts\WrapType interface removed from core
  • Closure type-hint in resolve() no longer auto-injects SelectFields factory
  • Field::selectFieldClass() and Field::instanciateSelectFields() removed
  • 'selectable' => false removed from pagination type metadata fields
  • Generated query/mutation stubs no longer include SelectFields boilerplate
  • Install rebing/graphql-laravel-select-fields to restore all functionality

Added

• Rebing\GraphQL\Support\Contracts\ResolverParameterInjector interface for extensible resolver DI
• Field::registerParameterInjector() / Field::clearParameterInjectors() for external DI hooks

Changes in RC3

Breaking changes

• Privacy::validate() and closure signature changed #1251 / mfn
  new mixed $root first parameter, new optional ?ResolveInfo $resolveInfo fourth parameter, $queryContext now typed as mixed
• Remove $getSelectFields parameter from Field::authorize() #1250 / mfn
  it has been non-functional since half a decade

Fixed

• Fix SelectFields crashing when field types use callable #1252 / mfn
• Fix APQ middleware race condition (TOCTOU) #1253 / mfn
• Fix OperationParams not copying originalInput/readOnly, causing TypeError #1254 / mfn
• Fix APQ config not using config() inside config file #1255 / mfn

Changes in RC2

Breaking changes

• Privacy::validate() first parameter renamed from $queryArgs to $fieldArgs — it now receives the field's own arguments instead of root query arguments
• SelectFields now identifies wrapper types via the Rebing\GraphQL\Support\Contracts\WrapType marker interface. Custom pagination types and wrap types used with SelectFields must implement this interface. #1228 / mfn

Added

• Add tracing support with OpenTelemetry driver #1220 / mfn
• Rebing\GraphQL\Support\Contracts\WrapType marker interface for wrapper types (pagination types and custom wrap types) #1228 / mfn

Fixed

• Narrow GraphQL::type() PHPStan return type to (NullableType&Type)|NonNull so consumers can pass it to Type::nonNull() without static analysis errors #1221 / mfn
• Fix SelectFields forcing select * for Interface return types instead of selecting only the requested columns #683 / mfn
• Fix SelectFields not calling custom query callbacks on relation fields inside UnionType members #900 / mfn
• Fix cross-field validation rules (prohibits, required_without, required_if, etc.) not working in nested InputTypes #930 / mfn
• Fix privacy attribute ignored on nested/sub-types by moving enforcement from SelectFields to field resolvers in Type::getFields() #1161 / mfn
• Fix SelectFields producing empty SELECT clause for custom wrap types created via GraphQL::wrapType() #1228 / mfn

Changes in RC1

Breaking changes

• Security hardening: safer defaults for production deployments #1210 / mfn
  • Default HTTP method changed from GET/POST to POST only
  • Batching disabled by default (batching.default → false)
  • Introspection disabled by default (GRAPHQL_DISABLE_INTROSPECTION env var)
  • Default query_max_depth set to 13 (was unlimited)
  • Default query_max_complexity set to 500 (was unlimited)
  • Authorization now runs before validation in field resolver
  • Authorization uses strict === true comparison

Added

- Added `max_batch_size` config option to limit batch query operations

Full Changelog: 10.0.0-RC3...10.0.0-RC4

Breaking changes

• SelectFields extracted to separate package rebing/graphql-laravel-select-fields
  • Rebing\GraphQL\Support\SelectFields class removed from core
  • Rebing\GraphQL\Support\Contracts\WrapType interface removed from core
  • Closure type-hint in resolve() no longer auto-injects SelectFields factory
  • Field::selectFieldClass() and Field::instanciateSelectFields() removed
  • 'selectable' => false removed from pagination type metadata fields
  • Generated query/mutation stubs no longer include SelectFields boilerplate
  • Install rebing/graphql-laravel-select-fields to restore all functionality

Added

• Rebing\GraphQL\Support\Contracts\ResolverParameterInjector interface for extensible resolver DI
• Field::registerParameterInjector() / Field::clearParameterInjectors() for external DI hooks

New changes in RC3

Breaking changes

• Privacy::validate() and closure signature changed #1251 / mfn
  new mixed $root first parameter, new optional ?ResolveInfo $resolveInfo fourth parameter, $queryContext now typed as mixed
• Remove $getSelectFields parameter from Field::authorize() #1250 / mfn
  it has been non-functional since half a decade

Fixed

• Fix SelectFields crashing when field types use callable #1252 / mfn
• Fix APQ middleware race condition (TOCTOU) #1253 / mfn
• Fix OperationParams not copying originalInput/readOnly, causing TypeError #1254 / mfn
• Fix APQ config not using config() inside config file #1255 / mfn

Changes in RC2

Breaking changes

• Privacy::validate() first parameter renamed from $queryArgs to $fieldArgs — it now receives the field's own arguments instead of root query arguments
• SelectFields now identifies wrapper types via the Rebing\GraphQL\Support\Contracts\WrapType marker interface. Custom pagination types and wrap types used with SelectFields must implement this interface. #1228 / mfn

Added

• Add tracing support with OpenTelemetry driver #1220 / mfn
• Rebing\GraphQL\Support\Contracts\WrapType marker interface for wrapper types (pagination types and custom wrap types) #1228 / mfn

Fixed

• Narrow GraphQL::type() PHPStan return type to (NullableType&Type)|NonNull so consumers can pass it to Type::nonNull() without static analysis errors #1221 / mfn
• Fix SelectFields forcing select * for Interface return types instead of selecting only the requested columns #683 / mfn
• Fix SelectFields not calling custom query callbacks on relation fields inside UnionType members #900 / mfn
• Fix cross-field validation rules (prohibits, required_without, required_if, etc.) not working in nested InputTypes #930 / mfn
• Fix privacy attribute ignored on nested/sub-types by moving enforcement from SelectFields to field resolvers in Type::getFields() #1161 / mfn
• Fix SelectFields producing empty SELECT clause for custom wrap types created via GraphQL::wrapType() #1228 / mfn

Changes in RC1

Breaking changes

• Security hardening: safer defaults for production deployments #1210 / mfn
  • Default HTTP method changed from GET/POST to POST only
  • Batching disabled by default (batching.default → false)
  • Introspection disabled by default (GRAPHQL_DISABLE_INTROSPECTION env var)
  • Default query_max_depth set to 13 (was unlimited)
  • Default query_max_complexity set to 500 (was unlimited)
  • Authorization now runs before validation in field resolver
  • Authorization uses strict === true comparison

Added

- Added `max_batch_size` config option to limit batch query operations

Full Changelog: 10.0.0-RC2...10.0.0-RC3

Breaking changes

• Privacy::validate() and closure signature changed #1251 / mfn new mixed $root first parameter, new optional ?ResolveInfo $resolveInfo fourth parameter, $queryContext now typed as mixed
• Remove $getSelectFields parameter from Field::authorize() #1250 / mfn it has been non-functional since half a decade

Fixed

• Fix SelectFields crashing when field types use callable #1252 / mfn
• Fix APQ middleware race condition (TOCTOU) #1253 / mfn
• Fix OperationParams not copying originalInput/readOnly, causing TypeError #1254 / mfn
• Fix APQ config not using config() inside config file #1255 / mfn

New changes in RC2

Breaking changes

• Privacy::validate() first parameter renamed from $queryArgs to $fieldArgs — it now receives the field's own arguments instead of root query arguments
• SelectFields now identifies wrapper types via the Rebing\GraphQL\Support\Contracts\WrapType marker interface. Custom pagination types and wrap types used with SelectFields must implement this interface. #1228 / mfn

Added

• Add tracing support with OpenTelemetry driver #1220 / mfn
• Rebing\GraphQL\Support\Contracts\WrapType marker interface for wrapper types (pagination types and custom wrap types) #1228 / mfn

Fixed

• Narrow GraphQL::type() PHPStan return type to (NullableType&Type)|NonNull so consumers can pass it to Type::nonNull() without static analysis errors #1221 / mfn
• Fix SelectFields forcing select * for Interface return types instead of selecting only the requested columns #683 / mfn
• Fix SelectFields not calling custom query callbacks on relation fields inside UnionType members #900 / mfn
• Fix cross-field validation rules (prohibits, required_without, required_if, etc.) not working in nested InputTypes #930 / mfn
• Fix privacy attribute ignored on nested/sub-types by moving enforcement from SelectFields to field resolvers in Type::getFields() #1161 / mfn
• Fix SelectFields producing empty SELECT clause for custom wrap types created via GraphQL::wrapType() #1228 / mfn

Changes from RC1

Breaking changes

• Security hardening: safer defaults for production deployments #1210 / mfn
  • Default HTTP method changed from GET/POST to POST only
  • Batching disabled by default (batching.default → false)
  • Introspection disabled by default (GRAPHQL_DISABLE_INTROSPECTION env var)
  • Default query_max_depth set to 13 (was unlimited)
  • Default query_max_complexity set to 500 (was unlimited)
  • Authorization now runs before validation in field resolver
  • Authorization uses strict === true comparison

Added

- Added `max_batch_size` config option to limit batch query operations

Full Changelog: 10.0.0-RC1...10.0.0-RC2

Breaking changes

• Privacy::validate() first parameter renamed from $queryArgs to $fieldArgs — it now receives the field's own arguments instead of root query arguments
• SelectFields now identifies wrapper types via the Rebing\GraphQL\Support\Contracts\WrapType marker interface. Custom pagination types and wrap types used with SelectFields must implement this interface. #1228 / mfn
• Middleware::handle() and Middleware::resolve() now declare native mixed parameter and return types

Added

• Add tracing support with OpenTelemetry driver #1220 / mfn
• GraphQL::prependGlobalResolverMiddleware() for resolver middleware that must run before field/global appended middleware #1220 / mfn
• Rebing\GraphQL\Support\Contracts\WrapType marker interface for wrapper types (pagination types and custom wrap types) #1228 / mfn

Changed

• Bump minimum webonyx/graphql-php version to ^15.31.0 #1246 / mfn

Fixed

• Narrow GraphQL::type() PHPStan return type to (NullableType&Type)|NonNull so consumers can pass it to Type::nonNull() without static analysis errors #1221 / mfn
• Fix missing registration of the make:graphql:executionMiddleware Artisan command #1229 / mfn
• Fix SelectFields forcing select * for Interface return types instead of selecting only the requested columns #683 / mfn
• Fix SelectFields not calling custom query callbacks on relation fields inside UnionType members #900 / mfn
• Fix cross-field validation rules (prohibits, required_without, required_if, etc.) not working in nested InputTypes #930 / mfn
• Fix privacy attribute ignored on nested/sub-types by moving enforcement from SelectFields to field resolvers in Type::getFields() #1161 / mfn
• Fix SelectFields producing empty SELECT clause for custom wrap types created via GraphQL::wrapType() #1228 / mfn

‼️ BREAKING CHANGES ‼️

This release focuses on hardening the security defaults of this library for production deployments and hence comes with breaking changes:

• Default HTTP method changed from GET/POST to POST only
• Batching disabled by default (batching.default → false)
  • Added max_batch_size config option to limit batch query operations
• Introspection disabled by default (GRAPHQL_DISABLE_INTROSPECTION env var)
• Default query_max_depth set to 13 (was unlimited)
• Default query_max_complexity set to 500 (was unlimited)
• Authorization now runs before validation in field resolver
• Authorization uses strict === true comparison

See also the upgrade guide from 9 to 10.

For discussion, please use #1211

Full Changelog: 9.17.0...10.0.0-RC1

Breaking changes

• Security hardening: safer defaults for production deployments #1210 / mfn
  • Default HTTP method changed from GET/POST to POST only
  • Batching disabled by default (batching.default → false)
  • Added max_batch_size config option to limit batch query operations
  • Introspection disabled by default (GRAPHQL_DISABLE_INTROSPECTION env var)
  • Default query_max_depth set to 13 (was unlimited)
  • Default query_max_complexity set to 500 (was unlimited)
  • Authorization now runs before validation in field resolver
  • Authorization uses strict === true comparison

What's Changed

• gha: remove dev constraints by @mfn in #1215
• phpstan: fix reported errors by @mfn in #1216
• Remove Laravel 11 support by @mfn in #1217

Full Changelog: 9.16.0...9.17.0

Removed

• Support for Laravel 11 & PHPUnit 10 have been removed

What's Changed

• Support PHPUnit 12 by @mfn in #1209
• Add @OneOf directive from graphql-php by @KimCalvin in #1212

New Contributors

• @KimCalvin made their first contribution in #1212

Full Changelog: 9.15.0...9.16.0

Added

• Support for PHPUnit 12 #1209 / mfn
• Support for OneOf Input Objects (GraphQL @oneOf directive)
  • Fixed minimum version for webonyx/graphql-php to ^15.22.1
  • Added --oneof flag to make:graphql:input Artisan command

What's Changed

• build(deps): bump actions/cache from 4 to 5 in the deps group by @dependabot[bot] in #1205
• Support Laravel 13 by @mfn in #1207

Full Changelog: 9.14.0...9.15.0

Added

• Support for Laravel 13

Fixed

• Fix exponential time complexity in AliasArguments with circular type references #1195 / artem-schander

Added

• Allow field to be passed as instance #1178 / alancolant

Fixed

• Fixed type declaration mismatch in scalar type classes generated by make:graphql:scalar command by removing premature type hints from the stub #1190 / iisyos

Added

• Add route_attributes support for GraphQL routes #1186 / alissn

Added

• Support Laravels cursor pagination #1180 / Davidnadejdin

Removed

• Support for Laravel 10 & PHP 8.1 have been removed #1170 / mfn

Added

• Support for Laravel 12 #1164 / duncanmcclean

Changed

• Adopted PHPUnit attributes in the test suite #1167 / duncanmcclean
• Updated to PHPStan 2 #1168 / duncanmcclean

Fixed

• Fixes for implicit nullability deprecation (PHP 8.4 compat) #1152 / duncanmcclean

Fixed

• Bring back laravel-mongodb support #1144 / jsrodas-pdpaola

Changed

• Relax PaginationType/SimplePaginationType getPaginationFields typehint #1132 / jasonvarga

Added

• Possibility to add resolver middleware at runtime using GraphQL::appendGlobalResolverMiddleware(YourMiddleware::class) or GraphQL::appendGlobalResolverMiddleware(new YourMiddleware(...))

Removed

• Support for Laravel 9 & PHP 8.0 have been removed #1123 / mfn

Added

• Support Laravel for 11 #1117 / mfn

Fixed

• fix schema validation - resolve not allowed in input fields #1078 / crissi

Breaking changes

Added

• Upgrade to graphql-php 15 #953 / mfn
  This includes possible breaking changes also outside of this package, see also https://github.com/webonyx/graphql-php/releases/tag/v15.0.0
  Known breaking changes:

  • non-standard error related data keys are not included directly in errors.*.<non-standard error key> any more, but have been moved to errors.*.extensions.<non-standard error key>.
    Also new keys may appear here from upstream.
  • The errors.*.extensions.category has been removed upstream, but we try to keep it alive with the interface \Rebing\GraphQL\Error\ProvidesErrorCategory as it can be a useful discriminator on the client side in certain cases. But only the cases from this library are preserved, e.g. categories like request, graphql or internal are gone.
  • The \Rebing\GraphQL\Support\OperationParams has added required types due to its base class changes:
    • Old: public function getOriginalInput($key)
      new: public function getOriginalInput(string $key)
    • Old: public function isReadOnly()
      new: public function isReadOnly(): bool

  Some BC may happen also if you extended code originating in graphql-php, some examples:

  • if you implement custom types, you now have to use property types for e.g. $name or $description
  • If you used any \GraphQL\Validator\DocumentValidator in your code directly, you now need use FQCN to reference them and not the shortened string names.
  • ->getWrappedType(true) was replaced with ->getInnermostType()
  • the class \GraphQL\Type\Definition\FieldArgument has been renamed to \GraphQL\Type\Definition\Argument

Removed

• Remove support for eager loading (=non-lazy loading) of types
  Lazy loading has been introduced in 2.0.0 (2019-08) and has been made the default since 8.0.0 (2021-11).
  The practical impact is that types are always going to be resolved using a type loader and therefore cannot use aliases anymore. Types and their type name have to match.
• Remove integrated GraphiQL support in favour of https://github.com/mll-lab/laravel-graphiql #986 / mfn
• Laravel 6 is no longer supported #967 / mfn
• Laravel 8 is no longer supported #1049 / mfn

Changed

• The type resolver is now able to resolve the top level types 'Query', 'Mutation' and 'Subscription'
  If you have an existing query/mutation/type named like this, you need to rename it.
• Return types were added to all methods of the commands #1005 / sforward
• Upgrade to laragraph/utils v2 #1032 / mfn
• The Pagination and SimplePagination helper types now enforce nonNull on their data types
• The test suite now also runs with --prefer-lowest #1055 / mfn
  This uncovered a few issues with laragraph/utils and webonyx/graphql-php and thus their minimum version had to be slightly bumped to 2.0.1 and 15.0.3 respectively.

Removed

• Remove unused publish command #1004 / sforward A leftover from the Lumen removal yers ago (#772)

Added

• Add Laravel 10 support #983 / jasonvarga

Added

• Add support for thecodingmachine/safe 2.4 #961 / tranvantri

Added

• Register directives via schema config #947 / sforward

Added

• Add support to use array in controller param in config #906 / viktorruskai
• Add support for laravel validation attributes #901 / jacobdekeizer

Fixed

• Allow 'always' to work on object types #473 / tinyoverflow #369 / zjbarg
• Allow using addSelect() in relationship query scopes #875 / codercms

Removed

• Support for PHP 7.2, PHP 7.3 and Laravel 7.0 (all EOL) #914 / mfn

Fixed

• Fix schema parsing issue when route prefix is empty string #890 / hello-liang-shan
  Note: this is a follow-up fix to #888

Fixed

• Fix "No configuration for schema '' found" when route prefix is empty string #888 / hello-liang-shan

Added

• Support for Laravel 9 #879 / mfn

Breaking changes

• Rewrite and simplify how schemas are handled

  • \Rebing\GraphQL\GraphQL::$schemas now only holds Schemas and not a mixture of strings or arrays
  • \Rebing\GraphQL\GraphQL::schema() now only accepts a "schema name", but no ad hoc Schema or "schema configs". To use ad hoc schemas, use \Rebing\GraphQL\GraphQL::buildSchemaFromConfig() and \Rebing\GraphQL\GraphQL::addSchema()
  • \Rebing\GraphQL\GraphQL::queryAndReturnResult() (and thus also \Rebing\GraphQL\GraphQL::query()) does not accept ad hoc schemas via $opts['schema'] anymore; it now only can reference a schema via its name.
  • \Rebing\GraphQL\GraphQL::addSchema() now only accept Schema objects, where before it would support ad hoc schemas via array configuration. Use \Rebing\GraphQL\GraphQL::buildSchemaFromConfig() for that now.
  • \Rebing\GraphQL\GraphQL::getSchemaConfiguration() has been removed due to the simplifications.
  • \Rebing\GraphQL\GraphQL::getNormalizedSchemaConfiguration() does not support ad hoc schemas anymore and only accepts the schema name.
  • \Rebing\GraphQL\GraphQLServiceProvider::bootSchemas() has been removed due to the simplifications.

• The following methods now take a \Illuminate\Contracts\Config\Repository as second argument:

  • \Rebing\GraphQL\GraphQL::__construct
  • \Rebing\GraphQL\GraphQLServiceProvider::applySecurityRules

• As part of moving the architecture to an execution based middleware approach, the following methods have been removed:

  • \Rebing\GraphQL\GraphQLController::handleAutomaticPersistQueries has been replaced by the AutomaticPersistedQueriesMiddleware middleware
  • \Rebing\GraphQL\GraphQLController::queryContext has been replaced by the AddAuthUserContextValueMiddleware middleware
    If you relied on overriding queryContext to inject a custom context, you now need to create your own execution middleware and add to your configuration
  • \Rebing\GraphQL\GraphQLController::executeQuery has become obsolete, no direct replacement.

• Routing has been rewritten and simplified #757 / mfn

  • All routing related configuration is now within the top level route configuration key
  • The following configuration options have been removed:
    • graphql.routes
      It's therefore also not possible anymore to register different routes for queries and mutations within a schema. Each schema gets only one route (except for the default schema, which is registered for the global prefix route as well as under its name).
      If necessary, this can be emulated with different schemas and multi-level paths
  • The following configuration options have been moved/renamed:
    • graphql.prefix => graphql.route.prefix
    • graphql.controllers => graphql.route.controller
      Further, providing a controller action for query or mutation is not supported anymore.
    • graphql.middleware => graphql.route.middleware
    • graphql.route_group_attributes => graphql.route.group_attributes
  • The actual routes defined have changed:
    • No more separate routes for the HTTP methods
    • 1 route for each schema + 1 route for the group prefix (default schema)
    • If GraphiQL is enabled: 1 route graphiql route for each schema + 1 for the graphiql group prefix (default schema)
    • If provided, the 'method' argument must provide the HTTP method verbs in uppercase like POST or GET, post or get will not work.
  • It's now possible to prevent the registering of any routes by making the top level route an empty array or null
  • \Rebing\GraphQL\GraphQL::routeNameTransformer has been removed
  • It's now possible to register schemas with a - in their name
  • Routes are now properly cacheable

• Remove the \Rebing\GraphQL\GraphQLController::$app property #755 / mfn
  Injecting the application container early is incompatible when running within an application server like laravel/octane, as it's not guaranteed that the container received contains all the bindings. If you relied on this property when extending the classes, invoke the container directly via Container::getInstance().

• Remove deprecated \Rebing\GraphQL\Support\Type::$inputObject and \Rebing\GraphQL\Support\Type::$enumObject properties #752 / mfn
  Instead in your code, extend \Rebing\GraphQL\Support\InputType and \Rebing\GraphQL\Support\EnumType directly

• Support for Lumen has been removed

• Integrate laragraph/utils RequestParser #739 / mfn
  The parsing of GraphQL requests is now more strict:

  • if you send a GET request, the GraphQL query has to be in the query parameters
  • if you send a POST request, the GraphQL query needs to be in the body
    Mixing of either isn't possible anymore
  • batched queries will only work with POST requests This is due to RequestParser using \GraphQL\Server\Helper::parseRequestParams which includes this check Further:
  • Drop support for configuration the name of the variable for the variables (params_key)
  • GraphQLUploadMiddleware has been removed (RequestParser includes this functionality)
  • Empty GraphQL queries now return a proper validated GraphQL error

• In \Rebing\GraphQL\GraphQL, renamed remaining instances of $params to $variables
  After switching to RequestParser, the support for changing the variable name what was supposed to params_key has gone and thus the name isn't fitting anymore. Also, the default value for $variables has been changed to null to better fit the how OperationParams works:

  • old: public function query(string $query, ?array $params = [], array $opts = []): array new: public function query(string $query, ?array $variables = null, array $opts = []): array

  • old: public function queryAndReturnResult(string $query, ?array $params = [], array $opts = []): ExecutionResult new: public function queryAndReturnResult(string $query, ?array $variables = null, array $opts = []): ExecutionResult

  • \Rebing\GraphQL\Support\ResolveInfoFieldsAndArguments has been removed

  • $getSelectFields closure no longer takes a depth parameter

• The $args argument, of the handle method of the execution middlewares requires array as type.

Added

• Command to make an execution middleware #772 / mfn
• Command to make a schema configuration #830 / matsn0w
• The primary execution of the GraphQL request is now piped through middlewares #762 / crissi and mfn
  This allows greater flexibility for enabling/disabling certain functionality as well as bringing in new features without having to open up the library.
• Primarily register \Rebing\GraphQL\GraphQL as service and keep 'graphql' as alias #768 / mfn
• Automatic Persisted Queries (APQ) now cache the parsed query #740 / mfn
  This avoids having to re-parse the same queries over and over again.
• Add ability to detect unused GraphQL variables #660 / mfn
• Laravel's ValidationException is now formatted the same way as a ValidationError #748 / mfn
• A few missing typehints (mostly array related) #849 / mfn

Changed

• Internally webonyx query plan feature is now used for retrieving information about a query #793 / crissi)
• Rewrite and simplify how schemas are handled #779 / mfn
• Internally stop using the global config() function and preferable use the repository or the Facade otherwise #774 / mfn
• Don't silence broken schemas when normalizing them for generating routes #766 / mfn
• Lazy loading types has been enabled by default #758 / mfn
• Make it easier to extend select fields #799 / crissi
• The $args argument, of the handle method of the execution middlewares requires array as type #843 / sforward
• Embrace thecodingmachine/safe and use thecodingmachine/phpstan-safe-rule to enforce it #851 / mfn
• Don't require a return value for the query option of fields #856 / sforward

Fixed

• Fix TypeNotFound when an interface defined after another type where it is used #828 / kasian-sergeev

Removed

• The method \Rebing\GraphQL\GraphQLServiceProvider::provides was removed #769 / mfn
  It's only relevant for deferred providers which ours however isn't (and can't be made into with the current Laravel architecture).

Added

• Allow disabling batched requests #738 / mfn

Added

• Basic Automatic Persisted Queries (APQ) support #701 / illambo

Added

• Support Laravels simple pagination #715 / lamtranb

Breaking changes

• Signature of \Rebing\GraphQL\Support\Privacy::validate changed, now it accepts both query/mutation arguments and the query/mutation context. Update your existing privacy policies this way:

  -public function validate(array $queryArgs): bool
  +public function validate(array $queryArgs, $queryContext = null): bool
  

Added

• Ability to pass query/mutation context to the field privacy handler (both closure and class) #727 / torunar

Fixed

• Middleware and methods can be used in class based schemas. #724 / jasonvarga
  This is a follow-up fix for Support for class based schemas

Added

• Support for per-schema types #658 / stevelacey

Added

• Support for class based schemas #706 / jasonvarga

Fixed

• Lumen routing with regular expression constraints #719 / sglitowitzsoci

Same as 6.1.0-rc1!

Added

• Support for resolver middleware #594 / stevelacey

Added

• Support for resolver middleware #594 / stevelacey

Fixed

• Implemented generation of a SyntaxError instead of a hard Exception for empty single/batch queries #685 / plivius

Breaking changes

• Upgrade to webonyx/graphql-php 14.0.0 #645 / mfn Be sure to read up on breaking changes in graphql-php => https://github.com/webonyx/graphql-php/releases/tag/v14.0.0
• Remove support for Laravel < 6.0 #651 / mfn This also bumps the minimum required version to PHP 7.2

Added

• Support for Laravel 8 #672 / mfn

a9b4092

This commit was signed with the committer’s verified signature .

mfn Markus Podar

GPG key ID: D674B445C2272BD0

Verified Learn about vigilant mode .

Breaking changes

• Upgrade to webonyx/graphql-php 14.0.0 #645 / mfn

• Remove support for Laravel < 6.0 #651 / mfn This also bumps the minimum required version to PHP 7.2

Added

• (Re-implemented) Support for Laravel 8 #672 / mfn The one from the 5.x branch needed some rework

Fixed

• Implemented generation of a SyntaxError instead of a hard Exception for empty single/batch queries #685 / plivius

Added

• Support for PHP 8 #686 / mfn

Hotfix release to replace 5.1.3

Apologies for the rushed 5.1.3 release causing trouble, it was in fact cut from the wrong branch and it was current state for the upcoming 6.x series 😬

5.1.4 intends to correct this.

Added

• Support Laravel 8 #671 / mfn

Added

• Support Laravel 8 #671 / mfn

Added

• Re-added support for validation in field arguments (with breaking change fix) #630 / crissi

Fixed

• Reverted "Add support for validation in field arguments" due to breaking changes reported