From 7fa04922a7b728ce3a09cb69d60c3499b9dfaf2b Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 14:00:55 +0800 Subject: [PATCH 01/12] Fix privilege escalation through the user meta mutations Update the GatoGraphQL submodule with the fix rejecting protected user meta keys (role/capabilities, user level, session tokens, application passwords) in the user meta mutations. --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index 742b0a9b..7942a08b 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit 742b0a9b2041b47a542476e8eb7160e738de9418 +Subproject commit 7942a08bf1e3430d9d335f668eeebc3af78c7727 From 1ecafb54d3dd45b3efd7cd2965764479c29a2859 Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 15:14:18 +0800 Subject: [PATCH 02/12] Exclude admins from meta-key restriction, extend it to other entities, and restrict option reads Update the GatoGraphQL submodule. --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index 7942a08b..c63165e2 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit 7942a08bf1e3430d9d335f668eeebc3af78c7727 +Subproject commit c63165e2a7802df1b62476a80e63270d42721570 From fa806af2c44de1ea4513cbe7a55028febcd0bcae Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 15:25:29 +0800 Subject: [PATCH 03/12] Update translations for the changed settings descriptions Update the GatoGraphQL submodule. --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index c63165e2..66131388 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit c63165e2a7802df1b62476a80e63270d42721570 +Subproject commit 66131388037a5c54ff3b0a94fdfac9fc7bddd2d7 From 8d25b956670070017f214de8db4608da2f18f793 Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 15:45:12 +0800 Subject: [PATCH 04/12] Point the changelog entries at the actual PR number Update the GatoGraphQL submodule. --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index 66131388..abe8d9b9 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit 66131388037a5c54ff3b0a94fdfac9fc7bddd2d7 +Subproject commit abe8d9b9989c8623a3f36ae82d2b3a16241b72b7 From b8458d73b6c518a64d75392fffe1e6f1e4a4386b Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 16:14:18 +0800 Subject: [PATCH 05/12] Restrict reading protected meta keys to administrators Update the GatoGraphQL submodule. --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index abe8d9b9..b90af8b9 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit abe8d9b9989c8623a3f36ae82d2b3a16241b72b7 +Subproject commit b90af8b96ae3a030fa35942423b08305002b06f7 From df65e43a4e7f966e48d1e798def2091b31c999cc Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 17:25:38 +0800 Subject: [PATCH 06/12] Update GatoGraphQL: scope meta read-protection to user meta only --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index b90af8b9..c2c9e8e5 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit b90af8b96ae3a030fa35942423b08305002b06f7 +Subproject commit c2c9e8e5a17594c1dd600e987cfe4965d9676220 From 0493f08f6bb05e7bc54b960d9c097386ba526bb7 Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 18:26:25 +0800 Subject: [PATCH 07/12] Update GatoGraphQL: enforce meta read-protection at the resolution layer --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index c2c9e8e5..5f77f206 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit c2c9e8e5a17594c1dd600e987cfe4965d9676220 +Subproject commit 5f77f206342429ccbd9d390280b4ecce1598cdd8 From 7433edfeaeb0fd08e917d7c67e684e3f6e9682db Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 18:58:14 +0800 Subject: [PATCH 08/12] Update GatoGraphQL: re-extract POT to refresh source line references --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index 5f77f206..1857ddeb 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit 5f77f206342429ccbd9d390280b4ecce1598cdd8 +Subproject commit 1857ddeb0040dcb57f604c69dbc10927aa8fec43 From 66598f673020e244761be0ad724286226d220edb Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 19:41:21 +0800 Subject: [PATCH 09/12] Update GatoGraphQL: run option allow/denylist tests as a non-administrator --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index 1857ddeb..d489c532 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit 1857ddeb0040dcb57f604c69dbc10927aa8fec43 +Subproject commit d489c532f259512f5082fc15b7e48afb3b134b74 From 428dceed571a291c7d73a1b453908ae16fdf1241 Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 20:26:15 +0800 Subject: [PATCH 10/12] Update GatoGraphQL: option-test user-switching + admin schema read test --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index d489c532..2f02289c 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit d489c532f259512f5082fc15b7e48afb3b134b74 +Subproject commit 2f02289cf008087a626e0869dcdbc2120f5c4c66 From 95e8ecbd0ead9141455ca41dc6e13d82e38f7eb4 Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 20:30:42 +0800 Subject: [PATCH 11/12] Update GatoGraphQL: show denied option read in anon schema test --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index 2f02289c..1def5941 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit 2f02289cf008087a626e0869dcdbc2120f5c4c66 +Subproject commit 1def5941ab6fca690eab1c84dcea839d9a23a0aa From 75ad3d367eedafa2a4cc14e45b38e48e1ad6f7cf Mon Sep 17 00:00:00 2001 From: leoloso Date: Wed, 2 Sep 2026 20:31:18 +0800 Subject: [PATCH 12/12] Update GatoGraphQL: drop field alias in anon schema test --- submodules/GatoGraphQL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/GatoGraphQL b/submodules/GatoGraphQL index 1def5941..39768a1d 160000 --- a/submodules/GatoGraphQL +++ b/submodules/GatoGraphQL @@ -1 +1 @@ -Subproject commit 1def5941ab6fca690eab1c84dcea839d9a23a0aa +Subproject commit 39768a1d6b8886b55e523dcae73249677b6ea60e