Saleor 3.22.47 — Release Notes & Engineering Impact

## What's Changed - Fixed [CVE-2026-33756](https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp): Denial of service via unbounded GraphQL query batching - Fixed [CVE-2026-35401](https://github.com/saleor/saleor/security/advisories/GHSA-gqqv-xwx3-jj4h): Resource exhaustion vulnerability in GraphQL queries - Fixed [CVE-2026-35407](https://github.com/saleor/saleor/security/advisories/GHSA-hwph-9537-mc3p): Cross-account email change via unbound confirmation token - Fixed [CVE-2026-39851](https://github.com/saleor/saleor/security/advisories/GHSA-m3rm-m4vq-27x7): User enumeration vulnerability due to different error messages > [!WARNING] > Potential breaking changes are included: > > - If you use GraphQL query batching, the environment variable `GRAPHQL_BATCH_MAX_COUNT` should be increased. By default it is set to `1`, meaning only 1 query can be sent inside a single batch. You need to audit your usages and choose the correct value for your use-case. > > Example request that uses batching (JSON arrays): > > ```shell > $ json_data='[ > {"query": "{ products(first: 1) { __typename } }"}, > {"query": "{ categories(first: 1) { __typename } }"} > ]' > $ curl --json "$json_data" https://example.com/graphql/ > ``` > > - If you use GraphQL aliases, and use more than 100 of them within a single query, you need to increase `GRAPHQL_ALIAS_COUNT_LIMIT` (defaults to `100`) > > Example query using aliases: > > ```graphql > query myQuery { > products(first: 10) { > alias1: id > alias2: id > alias3: id > } > } > ``` > > - If you send more than 3 GraphQL mutation per API call, you need to increase `GRAPHQL_MUTATION_COUNT_LIMIT` (default to `3`), for example, the following GraphQL query uses **two** mutations within a single request: > > ```graphql > mutation { > productUpdate(input: {name: "my-product"}, id: "UHJvZHVjdDox") { > product { > id > } > } > > collectionUpdate(input: {name: "my-collection"}, id: "Q29sbGVjdGlvbjoy") { > collection { > id > } > } > } > ``` **Full Changelog**: https://github.com/saleor/saleor/compare/3.22.46...3.22.47