24.5
This is a dependency maintenance release for GraphQL Java 24.x to resolve security-scanner findings for CVE-2026-102554 in the bundled Guava dependency.
GraphQL Java's own request processing is not affected by this CVE. The vulnerability concerns native Java object deserialization, which GraphQL Java does not use to parse, validate, or execute GraphQL documents.
The release upgrades bundled Guava from 32.1.2-jre to 33.8.0-jre to remove the affected dependency version from the GraphQL Java JAR and address these scanner findings.
- #4553 Upgrade Guava to 33.8.0-jre for CVE-2026-102554.
Full Changelog: v24.4...v24.5
25.2
This is a dependency maintenance release for GraphQL Java 25.x to resolve security-scanner findings for CVE-2026-102554 in the bundled Guava dependency.
GraphQL Java's own request processing is not affected by this CVE. The vulnerability concerns native Java object deserialization, which GraphQL Java does not use to parse, validate, or execute GraphQL documents.
The release upgrades bundled Guava from 32.1.2-jre to 33.8.0-jre to remove the affected dependency version from the GraphQL Java JAR and address these scanner findings.
- #4554 Upgrade Guava to 33.8.0-jre for CVE-2026-102554.
Full Changelog: v25.1...v25.2
26.2
This is a dependency maintenance release for GraphQL Java 26.x to resolve security-scanner findings for CVE-2026-102554 in the bundled Guava dependency.
GraphQL Java's own request processing is not affected by this CVE. The vulnerability concerns native Java object deserialization, which GraphQL Java does not use to parse, validate, or execute GraphQL documents.
The release upgrades bundled Guava from 32.1.2-jre to 33.8.0-jre to remove the affected dependency version from the GraphQL Java JAR and address these scanner findings.
Also updates the shaded-annotation cleanup for the newer Guava, removing references to an annotation type that is not included in the published JAR.
- #4555 Upgrade Guava to 33.8.0-jre for CVE-2026-102554.
Full Changelog: v26.1...v26.2
Nightly
- [rb] download the Server jar with Selenium Manager instead of the GitHub API by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/18245
- [java] Escape quotes and backslashes in name locators sent to the driver by @Mochxd in https://github.com/SeleniumHQ/selenium/pull/18151
- [dotnet] [test] Unify assembly names for testing by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/18261
- [rb] Allocate websocket command ids atomically by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18262
- [py] Add WebDriver cookie type annotations by @adamtheturtle in https://github.com/SeleniumHQ/selenium/pull/17537
- [py] Deprecate driver.webextension by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18265
- [py] Return a protocol-neutral driver.script by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18264
- [build] run the Redis-backed Grid suites from the Java smoke matrix instead of a separate workflow by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/18267
- fix(#18263): keep Selenium Manager stderr empty in --output json by @macoladik in https://github.com/SeleniumHQ/selenium/pull/18268
- [js] hold BiDi numbers to their declared ranges by @saiyam-jain-dev in https://github.com/SeleniumHQ/selenium/pull/18272
- [build] Add weekly CI check for Plausible pageview usage by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17900
- [java] hold generated BiDi numbers to their declared ranges by @yashp676 in https://github.com/SeleniumHQ/selenium/pull/18266
- [build] use the EngFlow cache for the Java GHA smoke test job by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/18276
- [py] Support relative locators from WebElement and ShadowRoot by @gjreddy in https://github.com/SeleniumHQ/selenium/pull/18241
- [js][py][rb][java][dotnet] add the accessibility snapshot atom and the binding methods by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18232
- [grid] Spread new sessions across Nodes again by @diemol in https://github.com/SeleniumHQ/selenium/pull/18281
- [js] Add @selenium/mcp, an MCP server for coding agents (v0) by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18280
- [js] MCP v1: drag, file upload, resize, network requests, evaluate by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18284
- [rust] Fix Firefox and Electron download URLs on Windows arm64 by @dennisameling in https://github.com/SeleniumHQ/selenium/pull/18285
- [java] Escape frame ids that are not valid CSS identifiers by @Mochxd in https://github.com/SeleniumHQ/selenium/pull/18274
- [py][rb][js] Fix tests failing in the nightly CI run by @diemol in https://github.com/SeleniumHQ/selenium/pull/18289
- [js] Move selenium-mcp to the SeleniumHQ/mcp repo by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18290
- [java] Log remote-client diagnostics at a fixed FINE level by @MohabMohie in https://github.com/SeleniumHQ/selenium/pull/18254
- [rb] Allow to set environment variables when staring a browser by @y-yagi in https://github.com/SeleniumHQ/selenium/pull/17395
- [py][rb] Fix tests failing after the browser version update by @diemol in https://github.com/SeleniumHQ/selenium/pull/18294
- [js] Publish @selenium/manager in releases by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18296
- [rust] Update Rust dependencies by @bonigarcia in https://github.com/SeleniumHQ/selenium/pull/18297
- [py] narrow pytest.raises(Exception) in bidi tests by @saiyam-jain-dev in https://github.com/SeleniumHQ/selenium/pull/18286
- [java] stop reading and writing Response.status internally by @yashp676 in https://github.com/SeleniumHQ/selenium/pull/18171
- [rust] Restrict Selenium Manager stats to vetted values before sending to Plausible by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17892
- [java] Speed up JSON serialisation and parsing by @shs96c in https://github.com/SeleniumHQ/selenium/pull/17750
- [py] Fix Select escaping of trailing double quotes by @Mohsintl in https://github.com/SeleniumHQ/selenium/pull/18292
- [java] remove Response.status by @yashp676 in https://github.com/SeleniumHQ/selenium/pull/18172
- [js] Snapshot accessibility in Classic sessions too by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18308
- [py] Snapshot accessibility in Classic sessions too by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18307
- @macoladik made their first contribution in https://github.com/SeleniumHQ/selenium/pull/18268
- @Mohsintl made their first contribution in https://github.com/SeleniumHQ/selenium/pull/18292
Full Changelog: https://github.com/SeleniumHQ/selenium/compare/selenium-4.52.0...nightly