Skip to content

Commit

Permalink
Update RELEASE.md
Browse files Browse the repository at this point in the history
  • Loading branch information
patrick91 authored Jan 9, 2025
1 parent a3fd1b8 commit 01a2124
Showing 1 changed file with 4 additions and 18 deletions.
22 changes: 4 additions & 18 deletions RELEASE.md
Original file line number Diff line number Diff line change
@@ -1,21 +1,7 @@
Release type: minor

The common `node: Node` used to resolve relay nodes means we will be relying on
is_type_of to check if the returned object is in fact a subclass of the Node
interface.
This release introduces `strawberry.cast`, which can be used when returning
a non Strawberry type to tell Strawberry what GraphQL type you wanted to return.

However, integrations such as Django, SQLAlchemy and Pydantic will not return
the type itself, but instead an alike object that is later resolved to the
expected type.

In case there are more than one possible type defined for that model that is
being returned, the first one that replies True to `is_type_of` check would be
used in the resolution, meaning that when asking for `"PublicUser:123"`,
strawberry could end up returning `"User:123"`, which can lead to security
issues (such as data leakage).

In here we are introducing a new `strawberry.cast`, which will be used to mark
an object with the already known type by us, and when asking for is_type_of that
mark will be used to check instead, ensuring we will return the correct type.

That `cast` is already in place for the relay node resolution and pydantic.
This is mostly useful when using unions or interfaces and returning non Strawberry
types, like in integration like Strawberry Django, SQLAlchemy and Pydantic.

0 comments on commit 01a2124

Please sign in to comment.