Input; the Object scalar no longer JSON-parses string variables; duplicate GraphQL type/field names are startup errors; operations declaring grpc.streaming: "client" | "bidi" now receive an async iterable of messages instead of a collected array.
Skip to main content

Changelog

4.0.0-rc.1 (2026-11-14)​

Features​

  • core: client queries are not HTML-sanitized, their literals are per attribute (#1081) (83f6be0)
  • first release candidate of Webda 4.0, npm version badge in package READMEs (#1083) (0cf8a55)
  • ql: SELECT field lists at runtime (partial results) (#1075) (fdbf962)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/utils bumped to 4.0.0-rc.1
      • @webda/workout bumped to 4.0.0-rc.1
    • devDependencies
      • @webda/compiler bumped to 4.0.0-rc.1
      • @webda/core bumped to 4.0.0-rc.1
      • @webda/test bumped to 4.0.0-rc.1
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-rc.1

4.0.0-beta.14 (2026-11-10)​

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/utils bumped to 4.0.0-beta.13
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.14
      • @webda/core bumped to 4.0.0-beta.14
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.14

4.0.0-beta.13 (2026-11-04)​

⚠ BREAKING CHANGES​

  • otel: @webda/otel no longer honors an incoming traceparent from any caller: list upstream services in trustedTraceSources (default []) or cross-service traces split. traceExporter.sampling now applies to the auto-instrumented HTTP and database spans (ParentBased ratio sampler). The HTTP instrumentation's incoming SERVER spans and the router span are replaced by Webda's SERVER span on every entry point. The Router emits CORS response headers for the origins of the website parameter and the CORS filters; Lambda OPTIONS without Origin no longer gets Access-Control-Max-Age/Allow-Headers. See the Upgrading section of packages/otel/README.md.

Features​

  • core: feature flags on operations (#766) (#909) (e016771)
  • core: refuse to start when a @webda package is loaded twice (#965) (b67f2d4)
  • otel: on-demand web tracing (W3C trace context, X-Webda-Trace token, every entry point) (#1029) (3d5387b)

Bug Fixes​

  • remediate CodeQL security and quality alerts (#995) (3ce3fb3)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/utils bumped to 4.0.0-beta.12
      • @webda/workout bumped to 4.0.0-beta.7
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.13
      • @webda/core bumped to 4.0.0-beta.13
      • @webda/test bumped to 4.0.0-beta.9
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.13

4.0.0-beta.12 (2026-10-22)​

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/utils bumped to 4.0.0-beta.11
      • @webda/workout bumped to 4.0.0-beta.6
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.12
      • @webda/core bumped to 4.0.0-beta.12
      • @webda/test bumped to 4.0.0-beta.8
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.12

4.0.0-beta.11 (2026-10-16)​

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.11
      • @webda/core bumped to 4.0.0-beta.11
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.11

4.0.0-beta.10 (2026-10-15)​

Features​

  • auth: TLS client certificate (mTLS) authentication (#834) (#899) (5bf7996)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/utils bumped to 4.0.0-beta.10
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.10
      • @webda/core bumped to 4.0.0-beta.10
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.10

4.0.0-beta.9 (2026-10-14)​

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/utils bumped to 4.0.0-beta.9
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.9
      • @webda/core bumped to 4.0.0-beta.9
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.9

4.0.0-beta.8 (2026-10-12)​

Bug Fixes​

  • enable strict mode in ten small packages (#872) (ecad571)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/utils bumped to 4.0.0-beta.8
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.8
      • @webda/core bumped to 4.0.0-beta.8
      • @webda/test bumped to 4.0.0-beta.7
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.8

4.0.0-beta.7 (2026-10-11)​

⚠ BREAKING CHANGES​

  • GraphQL now exposes every non-CRUD operation by default (opt out with exposeOperations: []); titled nested input types are renamed

Features​

  • streaming operations on gRPC, WebSocket and GraphQL (#829) (e67bfea)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/utils bumped to 4.0.0-beta.7
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.7
      • @webda/core bumped to 4.0.0-beta.7
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.7

4.0.0-beta.6 (2026-10-09)​

⚠ BREAKING CHANGES​

  • ql: DELETE, UPDATE, SELECT, SET and WHERE are reserved uppercase keywords; Query.type is required; parse().toString() prints the canonical query instead of the source tokens; the root parse rule is now (statement | filterQuery) EOF for code walking the ANTLR tree.

Features​

  • ql: WebdaQL DELETE/UPDATE/SELECT statements, bulk deleteMany/updateMany, filter-only Query operations (#818) (add9503)

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.6
      • @webda/core bumped to 4.0.0-beta.6
      • @webda/test bumped to 4.0.0-beta.6
      • @webda/utils bumped to 4.0.0-beta.6
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.6

4.0.0-beta.5 (2026-10-08)​

⚠ BREAKING CHANGES​

  • core: models defining canAct are now enforced on REST, gRPC and MCP operations; refused calls return 403. Query pages can be shorter than their LIMIT. OwnerModel ignores a client supplied _user. ResourceAcl.canAct signature changed to (context, action) and entries need a principal.

Bug Fixes​

  • core: enforce model permissions on every transport, deny by default (#810) (24c1182)
  • packaging: point every package's repository at its monorepo folder (#812) (3717b73)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/workout bumped to 4.0.0-beta.5
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.5
      • @webda/core bumped to 4.0.0-beta.5
      • @webda/test bumped to 4.0.0-beta.5
      • @webda/utils bumped to 4.0.0-beta.5
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.5

4.0.0-beta.4 (2026-10-08)​

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.4
      • @webda/core bumped to 4.0.0-beta.4
      • @webda/utils bumped to 4.0.0-beta.4
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.4

4.0.0-beta.3 (2026-10-05)​

⚠ BREAKING CHANGES​

  • compiler: the accessors, loadParameters and unserializer modules are removed. They wrote into the sources what webdac build now generates through @webda/content-mapper, or methods nothing calls. The unused webdac build --code flag is removed too.
  • @webda/ts-plugin and the tsc-esm binary are removed, and applications now build with TypeScript 7.1. Generated code changes where TypeScript 6 was wrong, each verified against the shipped output:
    • AuditEntry.timestamp, declared number, is no longer coerced to Date;
    • AbstractOwnerModel no longer emits new ModelLink(T), a ReferenceError on first raw-uuid assignment;
    • sample-app's User extends WebdaUser is now treated as a model (TS6's base-chain guard was keyed on class name), so its relations are initialised and coerced;
    • imports use the specifier the author wrote, not monorepo-relative paths that only resolve inside this repository;
    • the emitted .d.ts is valid (TS6 referenced PrimaryKeyType unimported and wrote BelongTo without its type argument). A build that cannot write its module now fails; under TS6 a strict file-naming violation was logged and the build still reported success.
  • compiler: model relations are now type: "string" in Input, Output and Stored schemas instead of an object with no properties, and six services gain the type property they inherit from ServiceParameters. Anything generated from these schemas — API validation, client types — changes with them.

Features​

  • add build hooks (97016bc)
  • add grpc module and sample-app webui (#756) (4a7df9a)
  • blog-system Binary/Binaries demo + e2e suite, with framework fixes (#771) (fe7e187)
  • build on TypeScript 7.1; delete @webda/ts-plugin and ts-patch (0008e97)
  • compiler: generate schemas with @webda/content-mapper (af3b7c5)
  • content-mapper: TypeScript 7.1 content mapper package (9b57565)
  • enhance debug panels (#759) (63e6e0c)
  • WebdaQLString<T> branded type + ts-plugin compile-time validator (#772) (f0c14c1)

Bug Fixes​

  • compiler metadata, CLI commands, cron/async hooks and long-running command lifecycle (#785) (0515715)
  • compiler: make webdac code a working migration tool (578ca7b)
  • unit test models relations (2d160f1)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/workout bumped to 4.0.0-beta.3
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.3
      • @webda/core bumped to 4.0.0-beta.3
      • @webda/test bumped to 4.0.0-beta.3
      • @webda/utils bumped to 4.0.0-beta.3
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.3