ardatan/graphql-tools release-1790803932000

September 30, 2026

on GitHub

@graphql-tools/executor@2.0.2

Patch Changes

• #8455 e0cce45 Thanks @renovate! - dependencies updates:

  • Updated dependency @whatwg-node/disposablestack@^0.1.0 ↗︎ (from ^0.0.6, in dependencies)

• #8456 b1fbba2 Thanks @renovate! - dependencies updates:

  • Updated dependency @whatwg-node/promise-helpers@^2.0.0 ↗︎ (from ^1.0.0, in dependencies)

• Updated dependencies [b1fbba2, 20d36a5]:

  • @graphql-tools/utils@12.0.2

@graphql-tools/executor-apollo-link@2.0.15

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

@graphql-tools/executor-envelop@4.0.15

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

@graphql-tools/executor-legacy-ws@1.1.36

Patch Changes

• #8480 c2f226e Thanks @ardatan! - Security: Isolate legacy GraphQL WebSocket executions on a shared buildWSLegacyExecutor().

  A single executor reused across callers kept extensions.connectionParams for the lifetime of the closure and installed one websocket.onmessage handler. A later request could be authenticated with a previous caller's connection_init payload (GHSA-434m-5hcj-pxf3, CWE-613), and an overlapping subscription could receive another operation's data frames because the handler ignored the protocol operation id (GHSA-mp66-8ww2-pcwm, CWE-200).

  Corrected behavior

  • Each execution opens its own socket. connection_init is built from the executor's base connectionParams plus that request's extensions.connectionParams only.
  • data, error, and complete frames are delivered only when id matches the operation that socket started.
  • Operation ids are no longer Date.now().

• Updated dependencies [b1fbba2, 20d36a5]:

  • @graphql-tools/utils@12.0.2

@graphql-tools/executor-urql-exchange@1.0.37

Patch Changes

• #8456 b1fbba2 Thanks @renovate! - dependencies updates:
  • Updated dependency @whatwg-node/promise-helpers@^2.0.0 ↗︎ (from ^1.2.4, in dependencies)
• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

@graphql-tools/executor-yoga@3.0.45

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2
  • @graphql-tools/executor-envelop@4.0.15

@graphql-tools/graphql-tag-pluck@8.3.38

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

graphql-tools@9.0.36

Patch Changes

• Updated dependencies []:
  • @graphql-tools/schema@10.1.2

@graphql-tools/import@7.2.1

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

@graphql-tools/links@10.0.15

Patch Changes

• #8455 e0cce45 Thanks @renovate! - dependencies updates:
  • Updated dependency @whatwg-node/fetch@^0.12.0 ↗︎ (from ^0.10.13, in dependencies)
• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

@graphql-tools/load@8.1.18

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2
  • @graphql-tools/schema@10.1.2

@graphql-tools/apollo-engine-loader@8.0.37

Patch Changes

• #8455 e0cce45 Thanks @renovate! - dependencies updates:

  • Updated dependency @whatwg-node/fetch@^0.12.0 ↗︎ (from ^0.10.13, in dependencies)

• #8459 724cf60 Thanks @dependabot! - dependencies updates:

  • Updated dependency sync-fetch@0.7.1 ↗︎ (from 0.6.0, in dependencies)

• Updated dependencies [b1fbba2, 20d36a5]:

  • @graphql-tools/utils@12.0.2

@graphql-tools/code-file-loader@8.1.40

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2
  • @graphql-tools/graphql-tag-pluck@8.3.38

@graphql-tools/git-loader@8.0.43

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2
  • @graphql-tools/graphql-tag-pluck@8.3.38

@graphql-tools/github-loader@9.1.10

Patch Changes

• #8455 e0cce45 Thanks @renovate! - dependencies updates:

  • Updated dependency @whatwg-node/fetch@^0.12.0 ↗︎ (from ^0.10.13, in dependencies)

• #8456 b1fbba2 Thanks @renovate! - dependencies updates:

  • Updated dependency @whatwg-node/promise-helpers@^2.0.0 ↗︎ (from ^1.0.0, in dependencies)

• #8459 724cf60 Thanks @dependabot! - dependencies updates:

  • Updated dependency sync-fetch@0.7.1 ↗︎ (from 0.6.0, in dependencies)

• Updated dependencies [b1fbba2, 20d36a5]:

  • @graphql-tools/utils@12.0.2
  • @graphql-tools/graphql-tag-pluck@8.3.38

@graphql-tools/graphql-file-loader@8.1.21

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2
  • @graphql-tools/import@7.2.1

@graphql-tools/json-file-loader@8.0.35

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

@graphql-tools/module-loader@8.0.35

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

@graphql-tools/url-loader@9.1.11

Patch Changes

• #8455 e0cce45 Thanks @renovate! - dependencies updates:

  • Updated dependency @whatwg-node/fetch@^0.12.0 ↗︎ (from ^0.10.13, in dependencies)

• #8456 b1fbba2 Thanks @renovate! - dependencies updates:

  • Updated dependency @whatwg-node/promise-helpers@^2.0.0 ↗︎ (from ^1.0.0, in dependencies)

• #8459 724cf60 Thanks @dependabot! - dependencies updates:

  • Updated dependency sync-fetch@0.7.1 ↗︎ (from 0.6.0, in dependencies)

• Updated dependencies [b1fbba2, c2f226e, 20d36a5]:

  • @graphql-tools/utils@12.0.2
  • @graphql-tools/executor-legacy-ws@1.1.36

@graphql-tools/merge@9.2.5

Patch Changes

• #8467 20d36a5 Thanks @ardatan! - Fix prototype pollution in mergeIncrementalResult

  Path segments are now rejected unless they are primitive strings or numbers, and keys named __proto__, constructor or prototype are still blocked. Previously a non-primitive segment such as ["__proto__"] bypassed the string equality guard and was coerced into a write on Object.prototype.

  Also exports shared isSafeObjectKey / isDangerousObjectKey helpers used by this path walker and other package call sites. @graphql-tools/merge and @graphql-tools/mock are patched so they ship with the new imports; updateInternalDependencies raises their utils floor when 12.0.2 is versioned.

• Updated dependencies [b1fbba2, 20d36a5]:

  • @graphql-tools/utils@12.0.2

@graphql-tools/mock@9.1.15

Patch Changes

• #8467 20d36a5 Thanks @ardatan! - Fix prototype pollution in mergeIncrementalResult

  Path segments are now rejected unless they are primitive strings or numbers, and keys named __proto__, constructor or prototype are still blocked. Previously a non-primitive segment such as ["__proto__"] bypassed the string equality guard and was coerced into a write on Object.prototype.

  Also exports shared isSafeObjectKey / isDangerousObjectKey helpers used by this path walker and other package call sites. @graphql-tools/merge and @graphql-tools/mock are patched so they ship with the new imports; updateInternalDependencies raises their utils floor when 12.0.2 is versioned.

• Updated dependencies [b1fbba2, 20d36a5]:

  • @graphql-tools/utils@12.0.2
  • @graphql-tools/schema@10.1.2

@graphql-tools/node-require@7.0.47

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2
  • @graphql-tools/load@8.1.18
  • @graphql-tools/graphql-file-loader@8.1.21

@graphql-tools/relay-operation-optimizer@7.1.11

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

@graphql-tools/resolvers-composition@7.0.38

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2

@graphql-tools/schema@10.1.2

Patch Changes

• Updated dependencies [b1fbba2, 20d36a5]:
  • @graphql-tools/utils@12.0.2
  • @graphql-tools/merge@9.2.5

@graphql-tools/utils@12.0.2

Patch Changes

• #8456 b1fbba2 Thanks @renovate! - dependencies updates:

  • Updated dependency @whatwg-node/promise-helpers@^2.0.0 ↗︎ (from ^1.0.0, in dependencies)

• #8467 20d36a5 Thanks @ardatan! - Fix prototype pollution in mergeIncrementalResult

  Path segments are now rejected unless they are primitive strings or numbers, and keys named __proto__, constructor or prototype are still blocked. Previously a non-primitive segment such as ["__proto__"] bypassed the string equality guard and was coerced into a write on Object.prototype.

  Also exports shared isSafeObjectKey / isDangerousObjectKey helpers used by this path walker and other package call sites. @graphql-tools/merge and @graphql-tools/mock are patched so they ship with the new imports; updateInternalDependencies raises their utils floor when 12.0.2 is versioned.