Repository navigation

deps(dev): update dependency @graphql-tools/utils to v12 [security] - #346

Open

renovate[bot] wants to merge 1 commit into

mainfrom

renovate/npm-graphql-tools-utils-vulnerability

Open

deps(dev): update dependency @graphql-tools/utils to v12 [security]#346
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-graphql-tools-utils-vulnerability

renovate Bot commented Oct 12, 2026 •

edited

Loading

Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@graphql-tools/utils (source)	`8.2.3` → `12.0.1`

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

CVE-2026-104852 / GHSA-7mx3-vvmw-hjmv

More information

Details

Closed by https://github.com/ardatan/graphql-tools/pull/8423
Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600

A client can alias fields to constructor, __proto__ or prototype so that the response keys from two subgraphs collide on those names during result merging. Because mergeDeep recursed through inherited properties, the merge walked {}.constructor to Object, then Object.__proto__ to Function.prototype, and wrote a subgraph-supplied value over Function.prototype.call, breaking every subsequent request in the process until restart. This is remotely triggerable by an unauthenticated client with a single query against any supergraph that merges an object from two subgraphs, which is the ordinary @shareable or entity case, so it is a denial of service rather than a theoretical hardening issue.

{
  shared {
    fieldA
    constructor: fieldB {
      __proto__: child {
        call: value
      }
    }
  }
}

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

ardatan/graphql-tools (@graphql-tools/utils)

`v12.0.1`

Patch Changes

#8368 60db079 Thanks @ardatan! - Omit mutation/subscription from printSchemaWithDirectives when those root types are no longer present on the schema (e.g. after pruneSchema).
#8366 57e316d Thanks @ardatan! - Allow % in paths checked by isValidPath (e.g. directories from URL-encoded repo names).
#8370 1c1c5a0 Thanks @ardatan! - Clean up observableToAsyncIterable queues and unsubscribe when the observable completes, so iterators do not retain references after done. Fixes leak detection flakes related to #8057.
#8370 1c1c5a0 Thanks @ardatan! - Prefer runtime description values over stale astNode descriptions in printSchemaWithDirectives / getDescriptionNode. Fixes #5508.
#8423 0b9529f Thanks @enisdenjo! - Fix prototype pollution in mergeDeep

Source keys named __proto__, constructor or prototype are now skipped at every recursion level, and the check for an existing key uses hasOwnProperty instead of in, so inherited properties are never used as merge targets.

Previously, merging untrusted data such as JSON.parse('{"constructor":{"__proto__":{"call":"x"}}}') could reach and overwrite properties on Object.prototype or Function.prototype.

`v12.0.0`

Major Changes

#8346
2273c21
Thanks @ardatan! - This release adds GraphQL v17 support and aligns
the existing executor implementation with the latest GraphQL v17 API changes. The following
changes are included:
- getAsyncHelpers is now available on GraphQLResolveInfo. Its track method is used whenever
  waitUntil is available, as in Yoga's
  Explicit Resource Management
- getAbortSignal is now available on GraphQLResolveInfo, matching behavior that was already
  available in this executor implementation, as in Yoga's
  Execution Cancellation
- GraphQLResolveInfo automatically aligns variableValues according to the GraphQL version for
  better compatibility. In GraphQL v17 and above, variableValues follows the wrapped shape
  ({ coerced, sources }) expected by GraphQL APIs. In GraphQL v16 and below, variableValues
  remains a flat map as in previous versions.
- If your custom scalar resolvers define __serialize and __parseValue, they are automatically
  mapped to coerceOutputValue and coerceInputValue in GraphQL v17.
- BREAKING: @graphql-tools/executor's getVariableValues now returns { variableValues }
  on success, where variableValues is a VariableValues object ({ coerced, sources }). On
  failure, it returns { errors }.
- BREAKING: collectFields, shouldIncludeNode, getDeferValues, and collectSubFields now
  need a VariableValues object instead of Record<string, any> for the variableValues
  argument.
- visitResult now internally normalizes ExecutionRequest.variables into a
  VariableValues-compatible shape ({ coerced, sources }) before traversing selections.

`v11.2.2`

Patch Changes

#8302
e90719b
Thanks @pbomb! - fix mergeDeep to treat explicit undefined property
values as overrides rather than skipping them, distinct from an absent property

`v11.2.1`

Patch Changes

#8204
615c1a2
Thanks @pbomb! - fix mergeDeep to treat null property values as
explicit overrides rather than skipping them

`v11.2.0`

Minor Changes

#8226
2609c94
Thanks @eddeee888! - getDocumentNodeFromSchema: Add arg
defaultValue support for graphql@17

`v11.1.1`

Patch Changes

#8256
981d461
Thanks @twavv! - Fix mergeDeep returning undefined instead of {}
when merging two or more empty objects.

Previously the output accumulator was only initialized inside the per-key loop, so merging sources
with no own keys (e.g. mergeDeep([{}, {}])) left it undefined. This silently dropped
empty-object values during nested merges ({ data: {} } became { data: undefined }), which
could surface as "Cannot return null for non-nullable field" errors when stitching schemas. The
accumulator is now initialized as soon as an object source is encountered.

`v11.1.0`

Minor Changes

#8144
a4b7dce
Thanks @enisdenjo! - Deep merge and preserve non-enumerable
symbols

`v11.0.1`

Patch Changes

ae36a0e
Thanks @mattkrick! - Handle enum values correctly if they are
arguments of directives defined in the extensions

`v11.0.0`

Major Changes

#7685
6f3776c
Thanks @ardatan! - Support "federation/subgraph style" schemas in
astFromSchema and printSchemaWithDirectives

If a GraphQLSchema doesn't have any defined operation types, we should print the schema
definition as an extension rather than omitting it entirely. They are not a valid schema on their
own, but they are valid subgraph schemas in a federation setup, and it is possible to build such
schemas with assumeValid options.
```
// A schema without defined root types
buildSchema(
  /* GraphQL */ `
    extend schema @link(url: "https://specs.apollo.dev/federation/v2.0", import: ["@key"])

    type User @key(fields: "id") {
      id: ID!
      username: String
    }
  `,
  { assumeValid: true, assumeValidSDL: true }
)
```
POTENTIAL BREAKING CHANGE: This can be a breaking change because now the schema above will be
printed as the input, previously extend schema was converted to schema {}.

`v10.11.0`

Minor Changes

#7588
2118a80
Thanks @EmrysMyrddin! - Add optional schema coordinate in error
extensions. This extension allows to precisely identify the source of the error by automated tools
like tracing or monitoring.

This new feature is opt-in, you have to enable it using schemaCoordinateInErrors executor
option.

Caution: This feature, when enabled, will expose information about your schema. If you need to
keep your schema private and secret, you should strip this attribute at serialization time before
sending errors to the client.

import { parse } from 'graphql'
import { normalizedExecutor } from '@graphql-tools/executor'
import { getSchemaCoordinate } from '@graphql-tools/utils'
import schema from './schema'

const result = await normalizedExecutor({
  schema,
  document: parse(`...`),
  schemaCoordinateInErrors: true // enable adding schema coordinate to graphql errors
})

if (result.errors) {
  for (const error of result.errors) {
    console.log('Error in resolver ', error.coordinate, ':', error.message)
    // or with `getSchemaCoordinate` util, to workaround types if needed
    console.log('Error in resolver', getSchemaCoordinate(error), ':', error.message)
  }
}

`v10.10.3`

Patch Changes

#7683
2fe123a
Thanks @ardatan! - Revert
#7683 which can cause unexpected breaking changes so
as before the schema extension node will always be converted to a schema definition node

`v10.10.2`

Patch Changes

#7679
dddc5f6
Thanks @ardatan! - Support "federation/subgraph style" schemas in
astFromSchema and printSchemaWithDirectives

If a GraphQLSchema doesn't have any defined operation types, we should print the schema
definition as an extension rather than omitting it entirely. They are not a valid schema on their
own, but they are valid subgraph schemas in a federation setup, and it is possible to build such
schemas with assumeValid options.
```
// A schema without defined root types
buildSchema(
  /* GraphQL */ `
    extend schema @link(url: "https://specs.apollo.dev/federation/v2.0", import: ["@key"])

    type User @key(fields: "id") {
      id: ID!
      username: String
    }
  `,
  { assumeValid: true, assumeValidSDL: true }
)
```

`v10.10.1`

Patch Changes

fbb58b5
Thanks @ardatan! - Remove `dset` dependency

`v10.10.0`

Minor Changes

#5269
fded91e
Thanks @uroslates! - Add default values to the arguments

When the schema is like following;

type Query {
    getAllPages(currentPage: Int = 0, pageSize: Int = 10, pageType: getAllPages_pageType = ContentPage, sort: String = "asc"): PagesList
}

enum getAllPages_pageType {
    ContentPage
    CategoryPage
    CatalogPage
}

type PagesList {
    ...
}

The generated operation will be like following;

query getAllPages_query($currentPage: Int = 0, $pageSize: Int = 10, $pageType: getAllPages_pageType = ContentPage, $sort: String = "asc") {
    getAllPages(currentPage: $currentPage, pageSize: $pageSize, pageType: $pageType, sort: $sort) {
        ...
    }
}

Patch Changes

#7012
fd105f4
Thanks @ardatan! - Fix the bug in mergeDeep;

The following inputs and outputs are corrected;
- mergeDeep([{a:2}, undefined]) - Any nullish values should be ignored so it should return
  {a:2}
- mergeDeep([]) - no sources should return undefined
- mergeDeep([undefined]) - no sources should return undefined
#5294
3b99a9b
Thanks @n1ru4l! - Do not map builtin scalars

`v10.9.1`

Patch Changes

32d0457
Thanks @ardatan! - Fix oneOf handling

`v10.9.0`

Minor Changes

#7281
53db005
Thanks @EmrysMyrddin! - Add optional subgraphName preoperty
to the ExecutionRequest interface for usage in Gateways like Hive Gateway.

Patch Changes

#7282
22af985
Thanks @renovate! - Support @oneOf directive

`v10.8.6`

Patch Changes

d123e26
Thanks @ardatan! - Fix incomplete string escaping/encoding

`v10.8.5`

Patch Changes

#6977
90a717e
Thanks @ardatan! - In executor, do not use leaking
registerAbortSignalListener, and handle listeners inside the execution context
#7025
26518de
Thanks @ardatan! - Better handling for field name handling in
buildOperationForField

`v10.8.4`

Patch Changes

155944b
Thanks @ardatan! - Fix breaking change by adding
PromiseWithResolvers back

`v10.8.3`

Patch Changes

#6971
4a2eb14
Thanks @ardatan! - dependencies updates:
- Added dependency
  @whatwg-node/promise-helpers@^1.0.0 ↗︎
  (to dependencies)

`v10.8.2`

Patch Changes

3547bba
Thanks @ardatan! - Relax extensions type

`v10.8.1`

Patch Changes

651a5dc
Thanks @ardatan! - Fix the regression on var counting

`v10.8.0`

Minor Changes

#6921
357b2ee
Thanks @renovate! - New isUrl helper, and it uses
URL.canParse if available

Patch Changes

0a3e193
Thanks @ardatan! - Do not add _v prefix if there is only one
argument/variable

`v10.7.2`

Patch Changes

#6822
53bb601
Thanks @enisdenjo! - dependencies updates:
- Updated dependency dset@^3.1.4 ↗︎ (from ^3.1.2,
  in dependencies)
#6822
53bb601
Thanks @enisdenjo! - Bump dset dependency handling the
CVE-2024-21529

https://security.snyk.io/vuln/SNYK-JS-DSET-7116691

`v10.7.1`

Patch Changes

#6809
4912f19
Thanks @AaronMoat! - Remove use of VoidFunction type, which
requires DOM types

`v10.7.0`

Minor Changes

#6789
2c70d27
Thanks @n1ru4l! - - New helper function getAbortPromise to get a
promise rejected when AbortSignal is aborted
- New helper function registerAbortSignalListener to register a listener to abort a promise when
  AbortSignal is aborted
Instead of using .addEventListener('abort', () => {/* ... */}), we register a single listener to
avoid warnings on Node.js like
MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 abort listeners added. Use emitter.setMaxListeners() to increase limit.

`v10.6.4`

Patch Changes

#6769
6a8123b
Thanks @ardatan! - Improvements for fakePromise so it can be used
without params to create a void Promise

`v10.6.3`

Patch Changes

020b9e4
Thanks @ardatan! - `AbortSignal` in `GraphQLResolveInfo`, and
`AbortSignal` in `ExecutionRequest`

`v10.6.2`

Patch Changes

#6737
1b24656
Thanks @ardatan! - Handle array of primitives correctly

The bug was following;

mergeDeep([{ options: ['$a', '$b'] }, { options: ['$c'] }, { options: ['$d', '$e'] }])

// results in { options: [{}, {}] }

`v10.6.1`

Patch Changes

1e02935
Thanks @ardatan! - Handle parse errors correctly when loader gets a
string directly

`v10.6.0`

Minor Changes

414e404
Thanks @ardatan! - new fakePromise, mapMaybePromise and
fakeRejectPromise helper functions

`v10.5.6`

Patch Changes

#6677
dc5043b
Thanks @enisdenjo! - onError and onEnd callbacks from
mapAsyncIterator are invoked only once regardless of how many times throw/return was called
on the iterator

`v10.5.5`

Patch Changes

#6524
cf2ce5e
Thanks @kachkaev! - Make two types compatible with strict tsc
config

`v10.5.4`

Patch Changes

0286437
Thanks @ardatan! - Improve directive extraction

`v10.5.3`

Patch Changes

2124d7d
Thanks @ardatan! - Allow invalid path in `getDirectiveExtensions`

`v10.5.2`

Patch Changes

07b87ed
Thanks @ardatan! - Respect extensionASTNodes in directable
GraphQLSchema object

`v10.5.1`

Patch Changes

6291e14
Thanks @ardatan! - Add all args from extensions to the AST even if
they don't exist in the directive def

`v10.5.0`

Minor Changes

8fd7703
Thanks @ardatan! - Export getDirectiveExtensions

`v10.4.0`

Minor Changes

b8bf584
Thanks @ardatan! - Introduce `getDirectiveExtensions` and refactor
directive handling in the extensions

`v10.3.4`

Patch Changes

#6420
a867bbc
Thanks @ardatan! - mapAsyncIterator now accepts AsyncIterable

`v10.3.3`

Patch Changes

#6385
d0f7d75
Thanks @tobiasdiez! - remove generic package export
Updated dependencies
[d0f7d75]:
- cross-inspect@1.0.1

`v10.3.2`

Patch Changes

a276ba8
Thanks @ardatan! - Respect directive extensions on `pruneSchema`

`v10.3.1`

Patch Changes

#6325
9792e80
Thanks @ardatan! - Make the executor disposable optional

`v10.3.0`

Minor Changes

#6323
cacf20f
Thanks @ardatan! - Implement Symbol.dispose or Symbol.asyncDispose
to make `Executor`s `Disposable`

`v10.2.3`

Patch Changes

#6278
66c99d9
Thanks @ardatan! - Handle @defer

`v10.2.2`

Patch Changes

#6238
0f7059b
Thanks @ardatan! - If the given objects are arrays with the same
length, merge the elements.

const a = [{ a: 1 }, { b: 2 }]
const b = [{ c: 3 }, { d: 4 }]
const result = mergeDeep(a, b) // [{ a: 1, c: 3 }, { b: 2, d: 4 }]

`v10.2.1`

Patch Changes

#6194
7368829
Thanks @ardatan! - Handle interface objects in a different way
#6188
e10c13a
Thanks @ardatan! - Add respectArrayLength flag to mergeDeep so
instead of concatenating the arrays, elements of them will be merged if they have the same length

`v10.2.0`

Minor Changes

#6105
5567347
Thanks @ardatan! - Add enumValueFilter and directiveFilter to
filterSchema

Patch Changes

#6105
5567347
Thanks @ardatan! - Handle fields in unmerged types as both isolated
and non-isolated fields

`v10.1.3`

Patch Changes

#6055
4093f70
Thanks @enisdenjo! - Disallow new lines in paths when checking
with isValidPath

A string may sometimes look like a path but is not (like an SDL of a simple GraphQL schema). To
make sure we don't yield false-positives in such cases, we disallow new lines in paths (even
though most Unix systems support new lines in file names).

`v10.1.2`

Patch Changes

fff2399
Thanks @ardatan! - Respect toJSON in astFromValueUntyped

`v10.1.1`

Patch Changes

#5931
baf3c28
Thanks @henryqdineen! - fix filterSchema argument filter for
schema with non-default root types

`v10.1.0`

Minor Changes

#5924
f3ea7a5
Thanks @EmrysMyrddin! - Add onEnd on mapAsyncIterator.

`v10.0.13`

Patch Changes

#5795
f85c093
Thanks @shYkiSto! - prevent race conditions when validating
documents

`v10.0.12`

Patch Changes

5ae0394
Thanks @ardatan! - Print comments as blocks

`v10.0.11`

Patch Changes

#4886
d3fe8d8c
Thanks @ldiqual! - Print debug timer logs by respecting the filters
in DEBUG env var

`v10.0.10`

Patch Changes

a570a601
Thanks @ardatan! - Add respectArrays flag to extensions merging

`v10.0.9`

Patch Changes

e1fb8bb8
Thanks @ardatan! - Merge directives in the extensions

`v10.0.8`

Patch Changes

accd58fd
Thanks @ardatan! - Extract inspect into the new cross-inspect
package
Updated dependencies
[accd58fd]:
- cross-inspect@1.0.0

`v10.0.7`

Patch Changes

b4c17591
Thanks @ardatan! - Convert GraphQLError like originalError property
to a GraphQLError

`v10.0.6`

Patch Changes

c52de863
Thanks @ardatan! - fix isValid path regex for paths including =
#5551

`v10.0.5`

Patch Changes

a59fb765
Thanks @ardatan! - Optimizations to get better performance in query
planning

`v10.0.4`

Patch Changes

#5444
c1afb545
Thanks @kennyjwilli! - Exports the DirectableGraphQLObject
type.

`v10.0.3`

Patch Changes

#5398
be3411c7
Thanks @EmrysMyrddin! - incremental merge also merges
extensions

`v10.0.2`

Patch Changes

#5396
bb8f169e
Thanks @ardatan! - dependencies updates:
- Added dependency dset@^3.1.2 ↗︎ (to
  dependencies)
#5396
bb8f169e
Thanks @ardatan! - Move the merging logic of incremental results to
the utils package

`v10.0.1`

Patch Changes

#5795
f85c093
Thanks @shYkiSto! - prevent race conditions when validating
documents

`v10.0.0`

Major Changes

#5274
944a68e8
Thanks @ardatan! - Drop Node 14 support. Require Node.js >= 16
#5274
944a68e8
Thanks @ardatan! - AggregateError is no longer exported from
@graphql-tools/utils. You can use the native AggregateError instead.

`v9.2.1`

Patch Changes

b5c8f640
Thanks @ardatan! - Do not use a global WeakMap for memoize2of4,
and introduce memoize2of5

`v9.2.0`

Minor Changes

a94217e9
Thanks @ardatan! - Support TypedDocumentNode in ExecutionRequest

Patch Changes

#5016
62d074be
Thanks @mayrn-techdivision! - Fixes introspection query
issues when visiting field '__type'

`v9.1.4`

Patch Changes

#4961
e3ec35ed
Thanks @gilgardosh! - Bug fix: better handle array field types
used for alias field names

`v9.1.3`

Patch Changes

#4887
904fe770
Thanks @ardatan! - Fix leak on Node 14 and add cancellation to async
iterables correctly

`v9.1.2`

Patch Changes

13c24883
Thanks @ardatan! - Fix handling argument values in gateway request

`v9.1.1`

Patch Changes

#4842
[7411a5e7](

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          deps(dev): update dependency @graphql-tools/utils to v12 [security]

3bfe690

This branch has not been deployed

No deployments

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet