Input; the Object scalar no longer JSON-parses string variables; duplicate GraphQL type/field names are startup errors; operations declaring grpc.streaming: "client" | "bidi" now receive an async iterable of messages instead of a collected array.
Skip to main content

Changelog

4.0.0-beta.12 (2026-10-22)​

Features​

  • mcp,oauth: dynamic client registration, resource-bound tokens and insufficient_scope (#901) (#988) (f75c854)

Bug Fixes​

  • mcp: filter resources/templates/list by Get operation permission (#958) (9a1c09a), closes #912

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/workout bumped to 4.0.0-beta.6
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.12
      • @webda/core bumped to 4.0.0-beta.12
      • @webda/test bumped to 4.0.0-beta.8
      • @webda/utils bumped to 4.0.0-beta.11
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.12

4.0.0-beta.11 (2026-10-16)​

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.11
      • @webda/core bumped to 4.0.0-beta.11
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.11

4.0.0-beta.10 (2026-10-15)​

Features​

  • delegated OAuth 2.1 tokens with operation-level consent (#928) (44709d6)

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.10
      • @webda/core bumped to 4.0.0-beta.10
      • @webda/utils bumped to 4.0.0-beta.10
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.10

4.0.0-beta.9 (2026-10-14)​

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.9
      • @webda/core bumped to 4.0.0-beta.9
      • @webda/utils bumped to 4.0.0-beta.9
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.9

4.0.0-beta.8 (2026-10-12)​

Bug Fixes​

  • enable strict mode in ten small packages (#872) (ecad571)

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.8
      • @webda/core bumped to 4.0.0-beta.8
      • @webda/test bumped to 4.0.0-beta.7
      • @webda/utils bumped to 4.0.0-beta.8
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.8

4.0.0-beta.7 (2026-10-11)​

⚠ BREAKING CHANGES​

  • GraphQL now exposes every non-CRUD operation by default (opt out with exposeOperations: []); titled nested input types are renamed
  • iam: canCallOperation() from @webda/core now returns Promise so awaited operation authorizers can run. Callers must await it: a non-awaited Promise is truthy and would allow every operation.

Features​

  • iam: IAM policies for operations, evaluated with Casbin (#830) (32a84db)
  • streaming operations on gRPC, WebSocket and GraphQL (#829) (e67bfea)

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.7
      • @webda/core bumped to 4.0.0-beta.7
      • @webda/utils bumped to 4.0.0-beta.7
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.7

4.0.0-beta.6 (2026-10-09)​

⚠ BREAKING CHANGES​

  • ql: DELETE, UPDATE, SELECT, SET and WHERE are reserved uppercase keywords; Query.type is required; parse().toString() prints the canonical query instead of the source tokens; the root parse rule is now (statement | filterQuery) EOF for code walking the ANTLR tree.

Features​

  • ql: WebdaQL DELETE/UPDATE/SELECT statements, bulk deleteMany/updateMany, filter-only Query operations (#818) (add9503)

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.6
      • @webda/core bumped to 4.0.0-beta.6
      • @webda/test bumped to 4.0.0-beta.6
      • @webda/utils bumped to 4.0.0-beta.6
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.6

4.0.0-beta.5 (2026-10-08)​

⚠ BREAKING CHANGES​

  • core: models defining canAct are now enforced on REST, gRPC and MCP operations; refused calls return 403. Query pages can be shorter than their LIMIT. OwnerModel ignores a client supplied _user. ResourceAcl.canAct signature changed to (context, action) and entries need a principal.

Bug Fixes​

  • core: enforce model permissions on every transport, deny by default (#810) (24c1182)
  • packaging: point every package's repository at its monorepo folder (#812) (3717b73)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/workout bumped to 4.0.0-beta.5
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.5
      • @webda/core bumped to 4.0.0-beta.5
      • @webda/test bumped to 4.0.0-beta.5
      • @webda/utils bumped to 4.0.0-beta.5
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.5

4.0.0-beta.4 (2026-10-08)​

⚠ BREAKING CHANGES​

  • auth: redesign authentication with @webda/auth (#800)

Features​

  • auth: redesign authentication with @webda/auth (#800) (74dc5df)

Dependencies​

  • The following workspace dependencies were updated
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.4
      • @webda/core bumped to 4.0.0-beta.4
      • @webda/utils bumped to 4.0.0-beta.4
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.4

4.0.0-beta.3 (2026-10-05)​

Features​

  • mcp: map model Get/Query operations to MCP resources (2ddd34b)
  • mcp: McpService with a Streamable HTTP endpoint and per-user MCP sessions (d9f30b7)
  • mcp: run operations as the caller and convert results to MCP tool results (363c82f)
  • mcp: scaffold @webda/mcp with schema inlining and the tool registry (55a33e5)
  • mcp: serve MCP tools over stdio with webda mcp --user (e0896ff)
  • mcp: serve tools and resources through the MCP SDK server (6830dc0)
  • sample-blog-system: expose the blog over MCP and document @webda/mcp (cff8244)

Bug Fixes​

  • compiler metadata, CLI commands, cron/async hooks and long-running command lifecycle (#785) (0515715)
  • mcp: evict the least recently used MCP session at maxSessions instead of 503 (b0573c7)
  • mcp: guard the HTTP endpoint against DNS rebinding, cap MCP sessions, test 401 (5684bff)
  • mcp: honor pre-aborted signals and truncate output on a UTF-8 boundary (78eb3e8)
  • mcp: keep optional wrapped inputs optional and tolerate malformed refs (345e735)
  • mcp: keep stdout for protocol frames while webda mcp runs (70574e4)
  • mcp: mask resources/list errors and await progress notifications (1d80a8e)
  • mcp: parse the request host from the Host/X-Forwarded-Host header (f399e76)
  • mcp: stop declaring tool outputSchema, share UTF-8-safe truncation, type-check errors (0af2ba1)
  • mcp: validate cursor token type, escape only backslash and quote in queryFor, skip Query ops with mcp:false (31690c2)
  • unit test models relations (2d160f1)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/workout bumped to 4.0.0-beta.3
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.3
      • @webda/core bumped to 4.0.0-beta.3
      • @webda/test bumped to 4.0.0-beta.3
      • @webda/utils bumped to 4.0.0-beta.3
    • peerDependencies
      • @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.3