Update dependency graphql to v2.5.26 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
graphql (source, changelog)	2.5.22 → 2.5.26

---

GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

GHSA-3h96-34p3-xm76

More information

Details

GraphQL-Ruby's max_query_string_tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached.

In patched versions, the Ruby lexer does count these tokens.

GraphQL-CParser is not affected by this problem.

max_query_string_tokens was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76
• https://github.com/advisories/GHSA-3h96-34p3-xm76

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rmosolgo/graphql-ruby (graphql)

v2.5.26

Compare Source

v2.5.25

Compare Source

Bug fixes

• Field extensions: correctly return false through for fields with extensions that don't define after_resolve #​5610

v2.5.24

Compare Source

New features

• Continue building Execution::Next: #​5606, #​5603, #​5596, #​5604, #​5607

v2.5.23

Compare Source

New features

• Static Validations: several performance improvements #​5584, #​5585, #​5586, #​5585, #​5587, #​5591
• Continue building Execution::Next #​5589, #​5592, #​5582

Bug fixes

• Fix Dataloader state on list items #​5597

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.