What wp-graphql/wp-graphql shipped
Written by FoxPlug from public releases; not affiliated with Wpgraphql. An automatic summary of the public release, pull request and commit data of github.com/wp-graphql/wp-graphql. Wpgraphql did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Released wp-graphql 2.23.1 with tightened media item update authorization for GHSA-4h2c-85f8-g3jh. Release
- Fixed media item update authorization to properly enforce access controls as described in GHSA-4h2c-85f8-g3jh. Pull request #4353
- Fixed framework cache layer preventing content edits from reaching wpgraphql.com. Pull request #4364
- Fixed client-side loading of @docsearch/react to prevent WordPress-backed pages from freezing. Pull request #4363
- Added SEO metadata including title, description, canonical, Open Graph, Twitter cards, and JSON-LD to wpgraphql.com. Pull request #4359
- Fixed JSON-LD origin rewrite to use the configured WordPress URL instead of the CMS origin. Pull request #4361
- Improved logging for /api/revalidate endpoint to show which paths were rebuilt and fixed two dead documentation URLs. Pull request #4367
- Allowlisted Jetpack Site Accelerator hosts for next/image to support media URLs from the WordPress.com-hosted CMS. Pull request #4358
- Updated website CI and image defaults to point at the migrated CMS origin instead of the retiring WP Engine install. Pull request #4356
- Moved 23 recipe screenshot images into the repository to prevent 404s after the WP Engine install termination. Pull request #4357
Why it matters
A security fix in 2.23.1 tightens media item authorization. The website saw a major incident where content edits stopped appearing due to caching and loading issues, now resolved. The project also migrated its CMS from WP Engine and added SEO metadata to improve site discoverability.
Changelog entry
- 2.23.1 - tighten media item update authorization (GHSA-4h2c-85f8-g3jh) Release
wp-graphql 2.23.1 is out with a media authorization security fix. Website incidents from framework caching and loading issues are resolved. SEO metadata now live on wpgraphql.com.
wp-graphql 2.23.1 released with security fix for media item update authorization (GHSA-4h2c-85f8-g3jh). The project addressed a critical website incident where content edits weren't reaching the live site due to framework cache and component loading issues. Site now includes full SEO metadata and has successfully migrated its CMS away from WP Engine.
Week of September 14, 2026
What shipped
- wp-graphql core 2.23.0 released with updated WordPress component dependencies from 38.0.0 to 39.0.0 and dev dependency updates. Release
- wp-graphql-ide 5.6.0 released with WordPress component dependency updates and npm package updates. Release
- wp-graphql-smart-cache 2.3.2 released with a security fix requiring persisted query ids to match the query hash and auditing stored documents. Pull request #4332
- Smart Cache fix to prevent fatal errors on option updates when WPGraphQL core is older than 2.18.0. Pull request #4333
- wp-graphql-smart-cache 2.3.2 released with updates to wp-graphql-stubs dev dependencies. Release
- Unit test coverage added for helper methods in the WPGraphQL Utils class. Pull request #4321
- Plugin documentation directories excluded from release-please versioning to prevent unrelated changes from triggering version bumps. Pull request #4335
Why it matters
This week includes three stable releases across the core wp-graphql project and two related plugins. A security fix in Smart Cache addresses query persistence validation, while version compatibility fixes ensure the plugin works with older core versions. Dependency updates keep the ecosystem current with WordPress component libraries.
Changelog entry
- wp-graphql 2.23.0: deps bump @wordpress/components from 38.0.0 to 39.0.0 Release
- wp-graphql-ide 5.6.0: deps bump @wordpress/components from 37.0.0 to 39.0.0 Release
- wp-graphql-smart-cache 2.3.2: fix persisted query ids validation and audit stored documents (GHSA-r844-6gqh-59qj) Pull request #4332
- wp-graphql-smart-cache: prevent fatal error on option updates for WPGraphQL core older than 2.18.0 Pull request #4333
- Add comprehensive unit test coverage for WPGraphQL Utils helper methods Pull request #4321
wp-graphql 2.23.0, wp-graphql-ide 5.6.0, and Smart Cache 2.3.2 are now available. Smart Cache includes a security fix for persisted queries and improved compatibility with older core versions.
This week we shipped stable releases across the wp-graphql ecosystem. wp-graphql 2.23.0 and wp-graphql-ide 5.6.0 update dependencies to latest WordPress components. wp-graphql-smart-cache 2.3.2 includes security improvements for persisted query validation and fixes compatibility issues with older wp-graphql core versions. All packages are ready for production use.