LaWebcapsule/d9 v12.0.25 on GitHub

Security

#483 aacdd03 - security: bump nodemailer to 10.2.1 (GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-85x2-q946-cp5h)
#479 41ead8b - security: bump sanitize-html to 2.18.1 (GHSA-cv27-6wvh-8x7j / CVE-2026-113661, GHSA-x3q4-9hxx-gx8m / CVE-2026-113654, GHSA-374f-7chj-9948 / CVE-2026-113657)
#465 ff27c30 - security: the authorization and cookie headers and the access_token query parameter of the request that triggers a (GHSA-f24x-rm6g-3w5v) webhook or manual flow are redacted in the log operation and in the flow logs, so that admins can't hijack the session of the user (GHSA-f24x-rm6g-3w5v)
#476 86ade75 - security: when the rate limiter is enabled, a GraphQL request consumes one point per root field of the executed (GHSA-ph52-67fq-75wj, CVE-2026-35441) operation instead of one point per request, so repeating expensive reads under aliases with different arguments counts against the client IP's budget (GHSA-ph52-67fq-75wj). Raise RATE_LIMITER_POINTS if your clients send documents with many root fields.
#468 cfb05b8 - security: a GraphQL query field returning a scalar, repeated under several aliases with the same arguments, is only (GHSA-6q22-g298-grjh) resolved once per request, to prevent amplifying expensive resolvers such as server_health (GHSA-6q22-g298-grjh)
#475 7914db7 - security: add a metadata-only asset resolution for HEAD requests, only open the storage read stream once an image (CVE-2025-30350, GHSA-rv78-qqrq-73m5, CVE-2025-30225, GHSA-j8xj-7jff-46mx) transformation has been validated, and release per-read S3 clients when their stream closes, preventing repeated requests from exhausting the S3 connections and making all assets unavailable (GHSA-rv78-qqrq-73m5, GHSA-j8xj-7jff-46mx)
#483 aacdd03 - security: bump undici to 7.30.1 (GHSA-xjj6-f33q-929c / CVE-2026-109869, GHSA-4qv8-2p9j-2685 / CVE-2026-109924, GHSA-f72v-6w45-q472 / CVE-2026-109841)

@wbce-d9/api 12.7.3

Patch Changes

#483
aacdd03 - security: bump
nodemailer to 10.2.1 (GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-85x2-q946-cp5h)
#479
41ead8b - security: bump
sanitize-html to 2.18.1 (GHSA-cv27-6wvh-8x7j / CVE-2026-113661, GHSA-x3q4-9hxx-gx8m / CVE-2026-113654,
GHSA-374f-7chj-9948 / CVE-2026-113657)
#465
ff27c30 - security: the
authorization and cookie headers and the access_token query parameter of the request that triggers a
(GHSA-f24x-rm6g-3w5v) webhook or manual flow are redacted in the log operation and in the flow logs, so that admins
can't hijack the session of the user (GHSA-f24x-rm6g-3w5v)
#476
86ade75 - security: when the
rate limiter is enabled, a GraphQL request consumes one point per root field of the executed (GHSA-ph52-67fq-75wj,
CVE-2026-35441) operation instead of one point per request, so repeating expensive reads under aliases with different
arguments counts against the client IP's budget (GHSA-ph52-67fq-75wj). Raise RATE_LIMITER_POINTS if your clients
send documents with many root fields.
#468
cfb05b8 - security: a GraphQL
query field returning a scalar, repeated under several aliases with the same arguments, is only (GHSA-6q22-g298-grjh)
resolved once per request, to prevent amplifying expensive resolvers such as server_health (GHSA-6q22-g298-grjh)
#475
7914db7 - security: add a
metadata-only asset resolution for HEAD requests, only open the storage read stream once an image (CVE-2025-30350,
GHSA-rv78-qqrq-73m5, CVE-2025-30225, GHSA-j8xj-7jff-46mx) transformation has been validated, and release per-read S3
clients when their stream closes, preventing repeated requests from exhausting the S3 connections and making all
assets unavailable (GHSA-rv78-qqrq-73m5, GHSA-j8xj-7jff-46mx)
Updated dependencies [aacdd03,
be77810,
7914db7]:
- @wbce-d9/storage-driver-cloudinary@10.0.7
- @wbce-d9/update-check@10.0.5
- @wbce-d9/app@11.3.1
- @wbce-d9/storage-driver-s3@10.0.6

@wbce-d9/app 11.3.1

Patch Changes

#473
be77810 - Optimize the
animated crystal background on public pages by caching rendered crystals, capping rendering at 60 FPS, coalescing
resize updates and pausing the animation while it is not visible.

@wbce-d9/storage-driver-cloudinary 10.0.7

Patch Changes

#483
aacdd03 - security: bump
undici to 7.30.1 (GHSA-xjj6-f33q-929c / CVE-2026-109869, GHSA-4qv8-2p9j-2685 / CVE-2026-109924, GHSA-f72v-6w45-q472 /
CVE-2026-109841)

@wbce-d9/storage-driver-s3 10.0.6

Patch Changes

#475
7914db7 - security: add a
metadata-only asset resolution for HEAD requests, only open the storage read stream once an image (CVE-2025-30350,
GHSA-rv78-qqrq-73m5, CVE-2025-30225, GHSA-j8xj-7jff-46mx) transformation has been validated, and release per-read S3
clients when their stream closes, preventing repeated requests from exhausting the S3 connections and making all
assets unavailable (GHSA-rv78-qqrq-73m5, GHSA-j8xj-7jff-46mx)

@wbce-d9/update-check 10.0.5

Patch Changes

#483
aacdd03 - security: bump
undici to 7.30.1 (GHSA-xjj6-f33q-929c / CVE-2026-109869, GHSA-4qv8-2p9j-2685 / CVE-2026-109924, GHSA-f72v-6w45-q472 /
CVE-2026-109841)

Dependency updates only: @wbce-d9/directus9@12.0.25