What are some reasons unpublished content is visible to anonymous users? The anonymous user role has no permissions to view/edit unpublished content. I'm wondering what kind of tests I can use to locate the bug, there is one module calling hook_node_access, but it returns AccessResult::allowed(); on update operations $op == 'update' so it should not be affecting view operations. I'm stumped.
The issue was a bug in node_view_permissions, updating to 8.x-1.2 solved the problem.