LaWebcapsule/d9 v12.0.22

on GitHub

Security

• #441 4e86904 - security: when GRAPHQL_INTROSPECTION is disabled, the GraphQL SDL is no longer served by /server/specs/graphql nor (GHSA-wxwm-3fxv-mrvx, CVE-2026-35413) by the server_specs_graphql query, as it exposes the same schema information as an introspection query (GHSA-wxwm-3fxv-mrvx / CVE-2026-35413)
• #437 a6ec87c - security: password reset requests now always take at least the same minimum time, whatever the outcome (invalid (GHSA-jr94-gj3h-c8rf, CVE-2026-26185) reset_url, unknown or inactive user, mail error), so response timing no longer reveals whether an account exists (GHSA-jr94-gj3h-c8rf).
• #451 7792afb - security: Validate client-supplied values for uuid fields on create and store them lowercased (GHSA-9v9p-pxh4-qxj9)
• #438 16aa3cb - security: concealed fields (such as user passwords and tokens) of the payload received by an event-triggered flow are (GHSA-x3vm-88hf-gpxp, CVE-2025-53885) now masked in the "Log to Console" operation output and in the flow run revisions (GHSA-x3vm-88hf-gpxp)
• #444 d492d37 - security: an access token passed in the query string is no longer written to the logs (GHSA-vw58-ph65-6rxp / (CVE-2024-47822) CVE-2024-47822)

@wbce-d9/api 12.7.0

Minor Changes

• #430
  eb7890d - Added the
  AUTH_<PROVIDER>_REQUIRE_REFRESH_TOKEN option for the OpenID and OAuth2 drivers (default true, which keeps the
  current behavior). Setting it to false lets users log in and renew their session when the identity provider issued
  no refresh token (for example Google when the account has already granted consent), instead of rejecting them with
  INVALID_CREDENTIALS / "No [OpenID] Session found". A stored refresh token is still checked against the provider.

  With the default, a login without a refresh token now redirects once to the provider with prompt=consent (as already
  done for a revoked token) instead of failing right away, and a stored refresh token is no longer overwritten with
  null when the provider does not issue a new one on login.

Patch Changes

• #441
  4e86904 - security: when
  GRAPHQL_INTROSPECTION is disabled, the GraphQL SDL is no longer served by /server/specs/graphql nor
  (GHSA-wxwm-3fxv-mrvx, CVE-2026-35413) by the server_specs_graphql query, as it exposes the same schema information
  as an introspection query (GHSA-wxwm-3fxv-mrvx / CVE-2026-35413)

• #437
  a6ec87c - security: password
  reset requests now always take at least the same minimum time, whatever the outcome (invalid (GHSA-jr94-gj3h-c8rf,
  CVE-2026-26185) reset_url, unknown or inactive user, mail error), so response timing no longer reveals whether an
  account exists (GHSA-jr94-gj3h-c8rf).

• #451
  7792afb - security: Validate
  client-supplied values for uuid fields on create and store them lowercased (GHSA-9v9p-pxh4-qxj9)

• #438
  16aa3cb - security: concealed
  fields (such as user passwords and tokens) of the payload received by an event-triggered flow are
  (GHSA-x3vm-88hf-gpxp, CVE-2025-53885) now masked in the "Log to Console" operation output and in the flow run
  revisions (GHSA-x3vm-88hf-gpxp)

• #444
  d492d37 - security: an access
  token passed in the query string is no longer written to the logs (GHSA-vw58-ph65-6rxp / (CVE-2024-47822)
  CVE-2024-47822)

• Updated dependencies [490e25e,
  2db4d1d,
  aba4181,
  0a82510,
  f95759f,
  20fc79d,
  2db4d1d]:

  • @wbce-d9/app@11.2.0

@wbce-d9/app 11.2.0

Minor Changes

• #447
  490e25e - The default art of
  the login and other public pages is now an animated "crystal" background tinted with the project color, instead of the
  static waves. A custom public background set in Settings still replaces it, and the animation stays still for users
  who prefer reduced motion.

• #445
  2db4d1d - Clicking the empty
  area below the sections of the open sidebar now closes it, as clicking the closed sidebar opens it. A thin line marks
  where that area starts.

• #434
  20fc79d - The resizable edge
  of the navigation panel now shows a small grip, so it can be found without hovering. On hover (after the same short
  delay as before) and while dragging, the grip and a thinner 2px line light up in the primary color.

• #445
  2db4d1d - The sidebar on the
  right can now be resized from its left edge, like the navigation panel: drag between 150px and the room left for the
  page, double-click to reset to 280px; the width is remembered per browser. Dragging it further toward the window edge
  closes it. Its edge shows the same grip as the navigation panel. The navigation panel can now also be made narrower,
  down to 150px (its default stays 220px).

Patch Changes

• #433
  aba4181 - Fixed the sidebar
  showing every section collapsed after navigating to another page while it was open. The first section (usually
  "Information") is now shown open right away, without the expand animation.

• #446
  0a82510 - Header action
  buttons no longer collapse behind an expand button on every window narrower than 960px. They now collapse only when
  they would take more than half of the header width, which stays reserved for the title.

• #449
  f95759f - Fixed the header
  action buttons collapsing in a band of window widths just above 600px and expanding again below it. Only the buttons
  are now compared with half of the header width, so they collapse at a single window width.

Dependency updates only: @wbce-d9/directus9@12.0.22