API Platform v4.4.7 and v5.0.6 are out with 3 security fixes (securityPostDenormalize bypasses, GraphQL mutation flush, attribute cache leak in worker mode), please upgrade!
github.com/api-platform...
github.com/api-platform...
Release v5.0.6 · api-platform/core
What's Changed
fix(graphql): update existing object on nested input id by @soyuka in #8786
fix(jsonapi): declare type: object on JSON:API resource schemas by @ousamabenyounes in #8724
fix(state): ...
github.com
November 6, 2026 at 1:09 PM
API Platform v4.4.7 and v5.0.6 are out with 3 security fixes (securityPostDenormalize bypasses, GraphQL mutation flush, attribute cache leak in worker mode), please upgrade!
github.com/api-platform...
github.com/api-platform...
jsonapi 1.14.4 [updated]
Fully functional JSONAPI V1 Serializer as well as a QueryParser for Plug based projects and applications.
Licenses: MIT
Fully functional JSONAPI V1 Serializer as well as a QueryParser for Plug based projects and applications.
Licenses: MIT
November 2, 2026 at 2:30 PM
jsonapi 1.14.4 [updated]
Fully functional JSONAPI V1 Serializer as well as a QueryParser for Plug based projects and applications.
Licenses: MIT
Fully functional JSONAPI V1 Serializer as well as a QueryParser for Plug based projects and applications.
Licenses: MIT
🚨 EUVD-2026-107872
📊 n/a
🏢 Drupal
📝 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107872
#cybersecurity #infosec #cve #euvd
📊 n/a
🏢 Drupal
📝 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107872
#cybersecurity #infosec #cve #euvd
October 22, 2026 at 3:05 AM
🚨 EUVD-2026-107872
📊 n/a
🏢 Drupal
📝 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107872
#cybersecurity #infosec #cve #euvd
📊 n/a
🏢 Drupal
📝 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107872
#cybersecurity #infosec #cve #euvd
📦 alexfigures/symfony-jsonapi-bundle v1.0.0
JSON:API 1.1 bundle for Symfony with Doctrine and custom persistence
🔗 https://github.com/AlexFigures/jsonapi-symfony
JSON:API 1.1 bundle for Symfony with Doctrine and custom persistence
🔗 https://github.com/AlexFigures/jsonapi-symfony
October 8, 2026 at 12:36 PM
📦 alexfigures/symfony-jsonapi-bundle v1.0.0
JSON:API 1.1 bundle for Symfony with Doctrine and custom persistence
🔗 https://github.com/AlexFigures/jsonapi-symfony
JSON:API 1.1 bundle for Symfony with Doctrine and custom persistence
🔗 https://github.com/AlexFigures/jsonapi-symfony
📦 webservco/jsonapi-application v2.0.1
A PHP component/library.
🔗 https://github.com/webservco/jsonapi-application
A PHP component/library.
🔗 https://github.com/webservco/jsonapi-application
October 4, 2026 at 11:34 AM
📦 webservco/jsonapi-application v2.0.1
A PHP component/library.
🔗 https://github.com/webservco/jsonapi-application
A PHP component/library.
🔗 https://github.com/webservco/jsonapi-application
#Drupal security advisory: Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 (2026-09-02) #PHP. See https://www.drupal.org/sa-contrib-2026-127
September 2, 2026 at 5:00 PM
#Drupal security advisory: Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 (2026-09-02) #PHP. See https://www.drupal.org/sa-contrib-2026-127
📦 serhiikamolov/laravel-jsonapi v4.4.0
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
August 31, 2026 at 7:58 PM
📦 serhiikamolov/laravel-jsonapi v4.4.0
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
I took over a bit of security maintenance for #Drupal entity API module.
If you use it with JSONAPI you should upgrade.
Thanks @berdir for the collaboration 😍
drupal.org/sa-contrib-2026-113…
If you use it with JSONAPI you should upgrade.
Thanks @berdir for the collaboration 😍
drupal.org/sa-contrib-2026-113…
August 26, 2026 at 6:30 PM
I took over a bit of security maintenance for #Drupal entity API module.
If you use it with JSONAPI you should upgrade.
Thanks @berdir for the collaboration 😍
drupal.org/sa-contrib-2026-113…
If you use it with JSONAPI you should upgrade.
Thanks @berdir for the collaboration 😍
drupal.org/sa-contrib-2026-113…
📦 alsvanzelf/jsonapi v3.0.2
Human-friendly library to implement JSON:API without needing to know the specification.
🔗 https://github.com/lode/jsonapi
Human-friendly library to implement JSON:API without needing to know the specification.
🔗 https://github.com/lode/jsonapi
August 22, 2026 at 8:01 AM
📦 alsvanzelf/jsonapi v3.0.2
Human-friendly library to implement JSON:API without needing to know the specification.
🔗 https://github.com/lode/jsonapi
Human-friendly library to implement JSON:API without needing to know the specification.
🔗 https://github.com/lode/jsonapi
One small test for this Controller, a big step for @conjoon: Sparse Fieldsets and related resources included with the response on our mission to reach @jsonapi compliance
#javascript #programming #coding #jsonapi #conjoon
#javascript #programming #coding #jsonapi #conjoon
March 9, 2025 at 7:03 PM
One small test for this Controller, a big step for @conjoon: Sparse Fieldsets and related resources included with the response on our mission to reach @jsonapi compliance
#javascript #programming #coding #jsonapi #conjoon
#javascript #programming #coding #jsonapi #conjoon
💻 Working with the @jsonapi and adjusting @conjoon 's #REST #API to comply with its specs is helping me to be more clear about the API's intention, to eliminate implementation bloat and to throw ambiguous code over board. Great learning process along the way. ⛵️
March 9, 2025 at 7:03 PM
💻 Working with the @jsonapi and adjusting @conjoon 's #REST #API to comply with its specs is helping me to be more clear about the API's intention, to eliminate implementation bloat and to throw ambiguous code over board. Great learning process along the way. ⛵️
#butterflyeffect in full swing. #refactor one line of code, discover other areas that could be improved, and #poof. Happy about the progress of @conjoon, though. #jsonapi #rest #javascript
March 9, 2025 at 7:03 PM
#butterflyeffect in full swing. #refactor one line of code, discover other areas that could be improved, and #poof. Happy about the progress of @conjoon, though. #jsonapi #rest #javascript
✍️ I have updated the draft for the #relfield-extension for the @jsonapi - most notable change is the removal of the "extends on" wording regarding the sparse fieldsets specification. Also, more examples!
https://github.com/ThorstenSuckow/relfield
#jsonapi #development #rest
https://github.com/ThorstenSuckow/relfield
#jsonapi #development #rest
March 9, 2025 at 7:03 PM
✍️ I have updated the draft for the #relfield-extension for the @jsonapi - most notable change is the removal of the "extends on" wording regarding the sparse fieldsets specification. Also, more examples!
https://github.com/ThorstenSuckow/relfield
#jsonapi #development #rest
https://github.com/ThorstenSuckow/relfield
#jsonapi #development #rest
Still boggles my mind that outside of jsonapi there’s not a single serviceable spec of rest/rest-ish out there. People blame REST for a lot of problems that are really just lack-of-spec.
November 8, 2025 at 5:12 AM
Still boggles my mind that outside of jsonapi there’s not a single serviceable spec of rest/rest-ish out there. People blame REST for a lot of problems that are really just lack-of-spec.
Woke up to a curious inquiry that spoke to my inner nerd. 🤓
The JSON response is mine, last link cut off in the screenshot goes here: violetrollergirl.com/faq/booking/...
Unfortunately, txt delivery is always shitty. Please use @signal.org to message providers! violetrollergirl.com/resources/fo...
The JSON response is mine, last link cut off in the screenshot goes here: violetrollergirl.com/faq/booking/...
Unfortunately, txt delivery is always shitty. Please use @signal.org to message providers! violetrollergirl.com/resources/fo...
![Screenshot of a text exchange between an anonymized sender and Violet. The sender writes:
"Hi Violet, my name is Keith. I found you on Tryst and I expect any response back to be in json. script kiddies are cool but go build an enterprise API platform. anyway. in steamboat tonight and happened upon you. are you available?"
Violet responds:
{
"jsonapi":{
"version":"1.0",
"meta":{
"links":{
"self":{
"href":"https://violetrollergirl.com/colophon/"
}
}
}
},
"errors":[
{
"title":"Service (Was Temporarily) Unavailable",
"status":"503",
"detail":"I would love to see you but was not available at the exact time you texted. Please see the links included in this response or try again today.",
"links":{
"info":{
"href":"https://violetrollergirl.com/faq/booking/are-you-available-right-now/"
}
}
}
]
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:wkcjjssofbmslfdbqkvqllyj/bafkreib2o75mphhd3ehzty5ir7pblhvybddsrrbtmgqxkns6er6j3yt7wm)
March 1, 2026 at 5:45 PM
Woke up to a curious inquiry that spoke to my inner nerd. 🤓
The JSON response is mine, last link cut off in the screenshot goes here: violetrollergirl.com/faq/booking/...
Unfortunately, txt delivery is always shitty. Please use @signal.org to message providers! violetrollergirl.com/resources/fo...
The JSON response is mine, last link cut off in the screenshot goes here: violetrollergirl.com/faq/booking/...
Unfortunately, txt delivery is always shitty. Please use @signal.org to message providers! violetrollergirl.com/resources/fo...
Is jsonapi still a thing? I don't see much work on it anymore. I guess people have moved on?
September 8, 2025 at 10:25 AM
Is jsonapi still a thing? I don't see much work on it anymore. I guess people have moved on?
"Why we don't use GraphQL" from Drunomics
This blog post provides great and valid insights about why they don't use GraphQL.
Link: https://drunomics.com/en/blog/why-we-dont-use-graphql-206
How do you expose Drupal's API through GraphQL or JSON API?
#drupal #jsonapi #graphql
This blog post provides great and valid insights about why they don't use GraphQL.
Link: https://drunomics.com/en/blog/why-we-dont-use-graphql-206
How do you expose Drupal's API through GraphQL or JSON API?
#drupal #jsonapi #graphql
November 28, 2024 at 8:36 AM
"Why we don't use GraphQL" from Drunomics
This blog post provides great and valid insights about why they don't use GraphQL.
Link: https://drunomics.com/en/blog/why-we-dont-use-graphql-206
How do you expose Drupal's API through GraphQL or JSON API?
#drupal #jsonapi #graphql
This blog post provides great and valid insights about why they don't use GraphQL.
Link: https://drunomics.com/en/blog/why-we-dont-use-graphql-206
How do you expose Drupal's API through GraphQL or JSON API?
#drupal #jsonapi #graphql
JSON:API Views 8.x-1.2 fixes cache metadata, route-build performance, preview URLs, numeric bundle routing and OpenAPI discovery. A stable contrib update for decoupled Drupal using Views over JSON:API.
##Drupal #JSONAPI #DecoupledDrupal #DrupalViews
https://bit.ly/4zeaoca
##Drupal #JSONAPI #DecoupledDrupal #DrupalViews
https://bit.ly/4zeaoca
August 13, 2026 at 2:34 PM
JSON:API Views 8.x-1.2 fixes cache metadata, route-build performance, preview URLs, numeric bundle routing and OpenAPI discovery. A stable contrib update for decoupled Drupal using Views over JSON:API.
##Drupal #JSONAPI #DecoupledDrupal #DrupalViews
https://bit.ly/4zeaoca
##Drupal #JSONAPI #DecoupledDrupal #DrupalViews
https://bit.ly/4zeaoca
Drupal Security Team published eight advisories on 17 June: five for core, three for contrib.
Core fixes cover JSON:API, oEmbed, image upload validation, and deserialization risks.
https://bit.ly/4oBXorV
##Drupal #DrupalSecurity #JSONAPI #DrupalCore
Core fixes cover JSON:API, oEmbed, image upload validation, and deserialization risks.
https://bit.ly/4oBXorV
##Drupal #DrupalSecurity #JSONAPI #DrupalCore
June 18, 2026 at 2:45 PM
Drupal Security Team published eight advisories on 17 June: five for core, three for contrib.
Core fixes cover JSON:API, oEmbed, image upload validation, and deserialization risks.
https://bit.ly/4oBXorV
##Drupal #DrupalSecurity #JSONAPI #DrupalCore
Core fixes cover JSON:API, oEmbed, image upload validation, and deserialization risks.
https://bit.ly/4oBXorV
##Drupal #DrupalSecurity #JSONAPI #DrupalCore
F5 Labs reports scanner activity targeting Drupal CVE-2026-9082 after disclosure.
Observed probes focused on JSON:API node endpoints and used blind SQL injection patterns, with defensive advice centred on logs and access review.
https://bit.ly/4gobUS4
##Drupal #Cybersecurity #JSONAPI
Observed probes focused on JSON:API node endpoints and used blind SQL injection patterns, with defensive advice centred on logs and access review.
https://bit.ly/4gobUS4
##Drupal #Cybersecurity #JSONAPI
F5 Labs Details Drupal CVE-2026-9082 Scanning Patterns
F5 Labs’ Sensor Intel report adds sensor-level evidence to the CVE-2026-9082 response, documenting how scanners probed Drupal JSON:API endpoints after disclosure rather than revisiting the advisory itself. Its useful contribution is the traffic patte...
bit.ly
June 16, 2026 at 2:03 PM
F5 Labs reports scanner activity targeting Drupal CVE-2026-9082 after disclosure.
Observed probes focused on JSON:API node endpoints and used blind SQL injection patterns, with defensive advice centred on logs and access review.
https://bit.ly/4gobUS4
##Drupal #Cybersecurity #JSONAPI
Observed probes focused on JSON:API node endpoints and used blind SQL injection patterns, with defensive advice centred on logs and access review.
https://bit.ly/4gobUS4
##Drupal #Cybersecurity #JSONAPI
DrupalRX’s Darrell Green examines why JSON:API responses can slow down headless Drupal projects.
The article highlights payload size, broad includes, deep relationships, caching gaps, serialisation work, and frontend request behaviour.
https://bit.ly/4ghQqGm
##JSONAPI #HeadlessDrupal #Performance
The article highlights payload size, broad includes, deep relationships, caching gaps, serialisation work, and frontend request behaviour.
https://bit.ly/4ghQqGm
##JSONAPI #HeadlessDrupal #Performance
DrupalRX Article Examines JSON:API Performance Issues in Headless Drupal
DrupalRX has published a technical article on common causes of slow JSON:API responses in headless Drupal projects. The post argues that teams should examine payload size, includes, relationship depth, caching, serialization costs, and frontend reque...
bit.ly
June 10, 2026 at 4:48 PM
DrupalRX’s Darrell Green examines why JSON:API responses can slow down headless Drupal projects.
The article highlights payload size, broad includes, deep relationships, caching gaps, serialisation work, and frontend request behaviour.
https://bit.ly/4ghQqGm
##JSONAPI #HeadlessDrupal #Performance
The article highlights payload size, broad includes, deep relationships, caching gaps, serialisation work, and frontend request behaviour.
https://bit.ly/4ghQqGm
##JSONAPI #HeadlessDrupal #Performance
Drupal Canvas currently limits Views to block-only integration with minimal configuration. A workaround using HTMX + JSON:API restores dynamic behavior.
Read more: https://bit.ly/3Qt3ONb
##Drupal #DrupalCanvas #HTMX #JSONAPI
Read more: https://bit.ly/3Qt3ONb
##Drupal #DrupalCanvas #HTMX #JSONAPI
Drupal Canvas Views Limitations and Workaround with HTMX Explained
A blog post shows how developers handle dynamic content in Drupal Canvas using HTMX and code components due to current Views limitations.
bit.ly
April 24, 2026 at 1:26 PM
Drupal Canvas currently limits Views to block-only integration with minimal configuration. A workaround using HTMX + JSON:API restores dynamic behavior.
Read more: https://bit.ly/3Qt3ONb
##Drupal #DrupalCanvas #HTMX #JSONAPI
Read more: https://bit.ly/3Qt3ONb
##Drupal #DrupalCanvas #HTMX #JSONAPI
A new Drupal architecture article explores hardening JSON:API for headless platforms.
The solution uses a custom normaliser to handle missing entity references and prevent API failures.
https://bit.ly/40uhI3w
##Drupal #HeadlessDrupal #JSONAPI #DrupalDev
The solution uses a custom normaliser to handle missing entity references and prevent API failures.
https://bit.ly/40uhI3w
##Drupal #HeadlessDrupal #JSONAPI #DrupalDev
Hardening Drupal JSON:API for Reliable Headless Platforms
Victor Jimenez shares how strengthening Drupal’s JSON:API layer prevented critical failures in a decoupled travel platform and ensured stable communication between Drupal and a React-based frontend.
bit.ly
March 13, 2026 at 4:47 PM
A new Drupal architecture article explores hardening JSON:API for headless platforms.
The solution uses a custom normaliser to handle missing entity references and prevent API failures.
https://bit.ly/40uhI3w
##Drupal #HeadlessDrupal #JSONAPI #DrupalDev
The solution uses a custom normaliser to handle missing entity references and prevent API failures.
https://bit.ly/40uhI3w
##Drupal #HeadlessDrupal #JSONAPI #DrupalDev