⚠️ Breaking Change
Impact Score: 7/10
Saleor 3.20.118 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: saleor · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
Breaking-change evidence from the source
Potential breaking changes are included: > > - If you use GraphQL query batching, the environment variable `GRAPHQL_BATCH_MAX_COUNT` should be increased. By default it is set to `1`, meaning only 1 query can be sent inside a single batch. You need to audit your usages and choose the correct value for your use-case.
⚡ Executive Summary (TL;DR)
Saleor 3.20.118. Source highlight: Fixed CVE-2026-33756: Denial of service via unbounded GraphQL query batching
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
⚠️ Breaking Changes & Deprecations (1)
- Potential breaking changes are included: > > - If you use GraphQL query batching, the environment variable `GRAPHQL_BATCH_MAX_COUNT` should be increased. By default it is set to `1`, meaning only 1 query can be sent inside a single batch. You need to audit your usages and choose the correct value for your use-case.
🔧 Bug Fixes & Patches (4)
- Fixed CVE-2026-33756: Denial of service via unbounded GraphQL query batching
- Fixed CVE-2026-35401: Resource exhaustion vulnerability in GraphQL queries
- Fixed CVE-2026-35407: Cross-account email change via unbound confirmation token
- Fixed CVE-2026-39851: User enumeration vulnerability due to different error messages
📄 View Raw Release Notes (Original Developer Log)
## What's Changed
- Fixed [CVE-2026-33756](https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp): Denial of service via unbounded GraphQL query batching
- Fixed [CVE-2026-35401](https://github.com/saleor/saleor/security/advisories/GHSA-gqqv-xwx3-jj4h): Resource exhaustion vulnerability in GraphQL queries
- Fixed [CVE-2026-35407](https://github.com/saleor/saleor/security/advisories/GHSA-hwph-9537-mc3p): Cross-account email change via unbound confirmation token
- Fixed [CVE-2026-39851](https://github.com/saleor/saleor/security/advisories/GHSA-m3rm-m4vq-27x7): User enumeration vulnerability due to different error messages
> [!WARNING]
> Potential breaking changes are included:
>
> - If you use GraphQL query batching, the environment variable `GRAPHQL_BATCH_MAX_COUNT` should be increased. By default it is set to `1`, meaning only 1 query can be sent inside a single batch. You need to audit your usages and choose the correct value for your use-case.
>
> Example request that uses batching (JSON arrays):
>
> ```shell
> $ json_data='[
> {"query": "{ products(first: 1) { __typename } }"},
> {"query": "{ categories(first: 1) { __typename } }"}
> ]'
> $ curl --json "$json_data" https://example.com/graphql/
> ```
>
> - If you use GraphQL aliases, and use more than 100 of them within a single query, you need to increase `GRAPHQL_ALIAS_COUNT_LIMIT` (defaults to `100`)
>
> Example query using aliases:
>
> ```graphql
> query myQuery {
> products(first: 10) {
> alias1: id
> alias2: id
> alias3: id
> }
> }
> ```
>
> - If you send more than 3 GraphQL mutation per API call, you need to increase `GRAPHQL_MUTATION_COUNT_LIMIT` (default to `3`), for example, the following GraphQL query uses **two** mutations within a single request:
>
> ```graphql
> mutation {
> productUpdate(input: {name: "my-product"}, id: "UHJvZHVjdDox") {
> product {
> id
> }
> }
>
> collectionUpdate(input: {name: "my-collection"}, id: "Q29sbGVjdGlvbjoy") {
> collection {
> id
> }
> }
> }
> ```
**Full Changelog**: https://github.com/saleor/saleor/compare/3.20.117...3.20.118