v3.0 master tracking: remove deprecations & improve type safety

Master tracking issue for the 3.0 major. Consolidates #3370 (planning, decisions, and type-safety scope).

How this gets done

All breaking changes land on the long-lived next branch (the 3.0 integration line), not main. next cuts release candidates (3.0.0-rc.N) via release-please; see .github/workflows/README.md → Prerelease line (next branch). Land one feat!: PR per group/subsystem so each gets a clean changelog + upgrade-notice entry.

Merge-back reminder (3.0 GA): when next merges into main, revert wp-graphql's prerelease back to false in release-please-config.json.

Decisions & process (carried from #3370)

• Approval to remove existing deprecations in v3.0 — granted (#3370 comment).
• Deprecation cutoff date — tentatively "end of 2025" (#3370); that window has lapsed, so there's no hard-deadline pressure. The inventory below is the working plan, not a locked spec — still open to input and refinement (e.g. from @justlevine, or additional deprecation candidates) before each removal lands. Net-new deprecations will generally be slated for after 3.0.
• Ensure all existing deprecations log a 3.0-removal message (most already do — verify during removal).
• Write the v3.0 announcement / upgrade-guide post.
• (Optional) Leverage #3292 for an upgrade-compatibility report.

---

1. GraphQL schema-facing removals (user-visible — each needs a migration note)

• SendPasswordResetEmailPayload.user → select success only — in progress (#3899)
• MenuItem.connectedObject → connectedNode (Deprecated.php:120)
• {PostType}By root fields (postBy, pageBy, …) → canonical node queries (Deprecated.php:200)
• Deprecated post-type parent/preview fields (Deprecated.php:339, :389)
• TermObjects connection — taxonomy/termTaxonomyId deprecation (Type/Connection/TermObjects.php:234)
• Comments connection deprecations (Type/Connection/Comments.php)
• MediaItem.sourceUrl(size:) → sourceUrlBySize (Model/Post.php:855)
• #997 — type integer-ID inputs as ID instead of Int/String (non-where-arg portion only, e.g. mutation inputs like CommentCreate.commentOn; the where-arg portion is deferred to the filter/sort redesign #1385)
• Triage remaining deprecationReason fields — see Open decisions below

2. Deprecated PHP classes (deprecated/ dir — 14 files)

• Remove deprecated/ classes (Comments, MenuItems, MenuItemObjectUnion, PostObject, PostObjects, Taxonomies, TermObject, TermObjects, Types, Users, wp-cli) + the union types (MenuItemObjectUnion, PostObjectUnion, TermObjectUnion) and their registration in Deprecated.php:107-115

3. Deprecated PHP methods/APIs (internal)

• AppContext: getLoader / getConnectionArgs / getCurrentConnection (AppContext.php:239/309/340)
• AbstractConnectionResolver: 8 deprecated methods (:1529–1688)
• DataSource: 5 deprecated methods (:648–763)
• AbstractDataLoader: 3 deprecated methods (:472–528)
• Cursor classes: deprecated WP_Query-object first-arg + methods (AbstractCursor, PostObjectCursor, TermObjectCursor, UserCursor, CommentObjectCursor)
• Router: deprecated method (Router.php:642)
• WPGraphQL: deprecated $args argument (WPGraphQL.php:711)

4. Deprecated filters/hooks (remove apply_filters_deprecated shims)

• graphql_object_type_interfaces → graphql_type_interfaces (Deprecated.php:47)
• graphql_return_modeled_data → graphql_model_prepare_fields (Deprecated.php:73)
• graphql_resolve_menu_item → graphql_pre_resolve_menu_item_connected_node (Deprecated.php:154)
• graphql_cursor_offset → graphql_before/after_cursor (AbstractCursor.php:84)

5. Type safety & access-level changes (from #3370 — needs per-item discussion)

• Mark appropriate classes final
• Tighten method/property visibility (reduce the overly-large access surface)
• Consolidate duplicate hooks that serve the same purpose
• #2925 — remove unused function parameters from public/protected method signatures and re-enable the Generic.CodeAnalysis.UnusedFunctionParameter PHPCS sniff (exclusion at phpcs.xml.dist:77)
• (Bonus) Relocate remaining deprecations into their own namespace

6. 4.0 early-deprecation candidates (from #3370)

• Audit for things to deprecate now (in a 3.x) so devs can handle them alongside the required 3.0 changes, ahead of 4.0.

7. Minimum version requirements

• #3304 — bump the WordPress floor to 6.6 (currently 6.0). Unblocks the bulk of the @wordpress/* dev-dependency updates and lets the React back-compat shim from #3301 be dropped. Should follow the support policy in #3925 (publish the policy and ship the advance deprecation warning first).
• PHP floor — decide alongside the support policy (#3925); also informed by the graphql-php v16 spike (#3923), since v16 would raise the PHP floor.

8. Authorization behavior for restricted inputs

• #4338: inputs a user isn't allowed to use (e.g. connection filters for statuses they can't see) return an error on that field instead of quietly returning empty results. Comments and posts switch together. Uses the argument-level capability / validate config from #3930 if it's ready in time, otherwise the existing checks switch to errors directly.

9. Stricter default settings

• #1896: apply the security-related defaults (query depth limiting first, then batch limits and complexity limiting from #3922) to every site, not just new installs. Before 3.0 only new installs get them.
• Settings wizard shown on new installs and on upgrade to 3.0, so site owners confirm these defaults deliberately. Design still open.
• Upgrade-guide note listing each changed default and how to change it back.

---

Open decisions (follow-up)

Keep vs. remove triage for Group 1. Not every field carrying a deprecationReason is necessarily slated for 3.0 removal — some are deprecated-but-kept for compatibility. Before removing any Group 1 field beyond those already marked @todo remove in 3.0.0, we need a field-by-field keep/remove decision across the ~17 files that use deprecationReason. These decisions to be made and recorded in this issue before those removals land.

---

Scope (Groups 1–4): 35 @todo remove in 3.0.0 markers across ~12 files, 14 deprecated classes, ~20 deprecated methods, 4 filter shims (all in plugins/wp-graphql/). Groups 5–6 carried from #3370.

Start by selecting one explicitly scoped item from the inventory, then read the referenced entry point such as Deprecated.php, AppContext.php, AbstractConnectionResolver.php, or the relevant connection class. Confirm the per-item keep/remove decision in this issue before changing anything; done requires the scoped change to land on the next branch with its required migration note, changelog, and upgrade notice.