Merge branch '2.2' into 2.3

Author: dunglas

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 2.3.6
 
+* /!\ Security: a vulnerability impacting the GraphQL subsystem was allowing users authorized to run mutations for a specific resource type, to execute it on any resource, of any type (CVE-2019-1000011)
 * Fix normalization of raw collections (not API resources)
 * Fix content negotiation format matching
 
@@ -84,6 +85,10 @@
 * GraphQL: Add a `totalCount` field in GraphQL paginated collections
 * JSONAPI: Allow inclusion of related resources
 
+## 2.2.10
+
+* /!\ Security: a vulnerability impacting the GraphQL subsystem was allowing users authorized to run mutations for a specific resource type, to execute it on any resource, of any type (CVE-2019-1000011)
+
 ## 2.2.9
 
 * Fix `ExistsFilter` for inverse side of OneToOne association