keystonejs/keystone 2026-10-27 on GitHub

The following packages have been updated

@keystone-6/auth@10.0.6
@keystone-6/cloudinary@10.0.6
@keystone-6/core@8.2.0
@keystone-6/fields-document@11.0.6

[cloudinary, core, fields-document] Optimises database queries to fetch only required columns. Adds selectItem, g.itemField and g.fieldTypeOutput to declare field selections, and db.requireItemSelection to enforce them. (#10044) @emmatown
[core] Add access.filter.query.{one,many,count} to filter each kind of query separately. Shared access.filter.query callbacks now receive kind: 'one' | 'many' | 'count'. This matches access.operation.query.{one,many,count} (#10057) @emmatown

[core] Fixes bigInt validation bounds rejecting valid bigint configuration values at startup and not being enforced on create or update. (#10051) @kerdofficial
[auth] Removes unnecessary next peer dependency (#10061) @emmatown
[core] Fixes cursor pagination revealing the existence of items hidden by list query access filters (#10067) @emmatown
[core] Fixes decimal fields comparing validation.min and validation.max as strings at startup, which rejected valid bounds like min: '2', max: '10' and accepted a max smaller than min (#10056) @RaphaelFakhri
[core] Avoids allocating promises for synchronous field read access and output resolution (#10054) @emmatown
[core] Fixes item form briefly being replaced with a loading spinner when saving an item (#10052) @emmatown

We have identified and fixed 1 security vulnerability

GHSA-8p2p-6579-wxmq - findMany queries using cursor can reveal the existence of items hidden by access.filter.query through unique fields that the caller can filter by, such as an email address or ID. Hidden items themselves are not returned. Found and reported by Dylan McGuinness (@dylanzonix), Ambit Security.

Thanks to the following developers for making their first contributions to the project!

See 2026-08-31...2026-10-27 to compare with our previous release.

keystonejs/keystone 2026-10-27 27 October 2026 on GitHub