fix(deps): update dependency graphql to v16.8.1 [security] by renovate[bot] · Pull Request #1816 · 1-Platform/one-platform

renovate · 2026-10-03T23:27:32Z

This PR contains the following updates:

Package	Change	Age	Confidence
graphql	`16.0.1` → `16.8.1`
graphql	`14.7.0` → `16.8.1`
graphql	`16.3.0` → `16.8.1`
graphql	`^15.5.1` → `^16.0.0`
graphql	`15.5.0` → `16.8.1`
graphql	`^15.6.1` → `^16.0.0`
graphql	`^15.8.0` → `^16.0.0`
graphql	`15.6.0` → `16.8.1`
graphql	`16.4.0` → `16.8.1`
graphql	`^15.6.1` → `^16.0.0`

graphql Uncontrolled Resource Consumption vulnerability

CVE-2023-26144 / GHSA-9pv7-vfvm-6vr7

More information

Details

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.

Note: It was not proven that this vulnerability can crash the process.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

graphql/graphql-js (graphql)

`v16.8.1`

Compare Source

v16.8.1 (2023-09-19)

Bug Fix 🐞

#3967 OverlappingFieldsCanBeMergedRule: Fix performance degradation (@AaronMoat)

Committers: 1

Aaron Moat(@AaronMoat)

`v16.8.0`

Compare Source

v16.8.0 (2023-08-14)

New Feature 🚀

#3950 Support fourfold nested lists (@gschulze)

Committers: 1

Gunnar Schulze(@gschulze)

`v16.7.1`

Compare Source

v16.7.1 (2023-06-22)

📢 Big shout out to @phryneas, who managed to reproduce this issue and come up with this fix.

Bug Fix 🐞

#3923 instanceOf: workaround bundler issue with process.env (@IvanGoncharov)

Committers: 1

Ivan Goncharov(@IvanGoncharov)

`v16.7.0`

Compare Source

v16.7.0 (2023-06-21)

New Feature 🚀

#3887 check "globalThis.process" before accessing it (@kettanaito)

Bug Fix 🐞

#3707 Fix crash in node when mixing sync/async resolvers (backport of #3706) (@chrskrchr)
#3838 Fix/invalid error propagation custom scalars (backport for 16.x.x) (@stenreijers)

Committers: 3

Artem Zakharchenko(@kettanaito)
Chris Karcher(@chrskrchr)
Sten Reijers(@stenreijers)

`v16.6.0`

Compare Source

v16.6.0 (2022-08-16)

New Feature 🚀

#3645 createSourceEventStream: introduce named arguments and deprecate positional arguments (@yaacovCR)
#3702 parser: limit maximum number of tokens (@IvanGoncharov)

Bug Fix 🐞

#3686 Workaround for codesandbox having bug with TS enums (@IvanGoncharov)
#3701 Parser: allow 'options' to explicitly accept undefined (@IvanGoncharov)

Committers: 2

Ivan Goncharov(@IvanGoncharov)
Yaacov Rydzinski (@yaacovCR)

`v16.5.0`

Compare Source

v16.5.0 (2022-05-09)

New Feature 🚀

#3565 Expose GraphQLErrorOptions type (#3554) (@IvanGoncharov)

Committers: 1

Ivan Goncharov(@IvanGoncharov)

`v16.4.0`

Compare Source

v16.4.0 (2022-04-25)

New Feature 🚀

#3465 refactor: use object for GraphQLError constructor (@n1ru4l)
#3487 feat: expose getArgumentValues (@saihaj)

Bug Fix 🐞

#3514 GraphQLError: switch constructor overload order (@glasser)

Docs 📝

2 PRs were merged

#3505 correct outdated documentation (@Ginhing)
#3512 Update documentation on deprecated formatError(..) (@dwelch2344)

Polish 💅

3 PRs were merged

#3522 tests(execution): add missing new lines (@IvanGoncharov)
#3524 tests(printSchema): test omitting schema of common names (@IvanGoncharov)
#3537 ESLint: disallow using node globals in src/tests (@IvanGoncharov)

Internal 🏠

26 PRs were merged

#3468 ci: add stub action for canary releases on PRs (@IvanGoncharov)
#3470 ci: implement canary releases on PRs (@IvanGoncharov)
#3472 ci: remove NPM caching on canary release script (@IvanGoncharov)
#3473 ci: Pass 'GITHUB_TOKEN' to GitHub CLI (@IvanGoncharov)
#3475 ci: checkout repo in canary workflow (@IvanGoncharov)
#3477 ci: fix & cleanup script for modifying NPM package into canary (@IvanGoncharov)
#3479 ci: Add missing require to canary script (@IvanGoncharov)
#3481 ci: fix missing PR number in canary release workflow (@IvanGoncharov)
#3483 ci: fix missing PR number in canary release workflow (@IvanGoncharov)
#3484 ci: Moving GH Action template syntax to env variables (@IvanGoncharov)
#3486 ci: improve comment on canary releases (@IvanGoncharov)
#3488 ci: Extract branch publishing into separate workflow (@IvanGoncharov)
#3489 ci: use '.node-version' file to configure node version used for CI (@IvanGoncharov)
#3491 ci: use separate workflows for 'push' and 'pull_request' (@IvanGoncharov)
#3493 ci: remove unused 'workflow_id' input (@IvanGoncharov)
#3496 ci: fix deprecation of canary package (@IvanGoncharov)
#3497 ci: use environments to track deployments (@IvanGoncharov)
#3502 ci: fix deployments of npm & deno branches (@IvanGoncharov)
#3503 ci: Add '@github-actions' bot (@IvanGoncharov)
#3523 github-actions-bot: replace 'octokit/request-action' action (@IvanGoncharov)
#3525 github-actions-bot: Fix collapsing of unrelated comments (@IvanGoncharov)
#3530 integrationTests/node: fix crash on Mac with M1 by using docker (@IvanGoncharov)
#3534 github-actions-bot: fix publishing of canary releases (@IvanGoncharov)
#3536 github-actions-bot: fix usage of NPM_CANARY_PR_PUBLISH_TOKEN (@IvanGoncharov)
#3538 github-actions-bot: fix reply on commands (@IvanGoncharov)
#3543 pass valid value to codecov config (@is2ei)

Dependency 📦

2 PRs were merged

#3485 Update deps (@IvanGoncharov)
#3533 Update deps (@IvanGoncharov)

Committers: 7

David Glasser(@glasser)
David Welch(@dwelch2344)
Ginhing(@Ginhing)
Horie Issei(@is2ei)
Ivan Goncharov(@IvanGoncharov)
Laurin Quast(@n1ru4l)
Saihajpreet Singh(@saihaj)

`v16.3.0`

Compare Source

v16.3.0 (2022-01-26)

New Feature 🚀

#3454 feat: allow providing an object to the GraphQLError constructor (@n1ru4l)
#3464 Expose getArgumentValues as public API (@IvanGoncharov)

Bug Fix 🐞

#3442 Prevent Infinite Loop in OverlappingFieldsCanBeMergedRule (@nicolaslt)
#3455 OverlappingFieldsCanBeMerged: sort argument values before comparing (@IvanGoncharov)

Docs 📝

2 PRs were merged

#3269 feat: setup docs site (@saihaj)
#3437 CONTRIBUTING.md: remove reference to Facebook bug bounty program (@IvanGoncharov)

Polish 💅

7 PRs were merged

#3441 UniqueArgumentDefinitionNamesRule: Improve tests (@Cito)
#3446 Use 'eslint-plugin-simple-import-sort' to sort imports (@IvanGoncharov)
#3447 Fix index.ts files to be compatible with Typedoc (@IvanGoncharov)
#3452 validation-test.ts: various grammar fixes (@spawnia)
#3457 OverlappingFieldsCanBeMergedRule: simplify argument comparison (@IvanGoncharov)
#3459 blockString-tests: remove duplicate test, fix grammar (@Cito)
#3461 visit: simplify handling of root node (@IvanGoncharov)

Internal 🏠

5 PRs were merged

#3433 gh/actions: refactor out action to deploy branches (@IvanGoncharov)
#3434 gh/actions: remove 'npm dedupe' check since it unexpectadly do update (@IvanGoncharov)
#3435 gh/actions: run benchmark & diff-npm-package only on PRs (@IvanGoncharov)
#3436 gh/actions: make all cloned repo read-only (@IvanGoncharov)
#3443 ci/checkPackageLock: update only package-lock.json (@IvanGoncharov)

Dependency 📦

4 PRs were merged

#3438 Update deps (@IvanGoncharov)
#3444 Update deps (@IvanGoncharov)
#3462 Update deps (@IvanGoncharov)
#3463 Update deps + fix 'npm audit' (@IvanGoncharov)

Committers: 6

Benedikt Franke(@spawnia)
Christoph Zwerschke(@Cito)
Ivan Goncharov(@IvanGoncharov)
Laurin Quast(@n1ru4l)
Nicolas Lagoutte(@nicolaslt)
Saihajpreet Singh(@saihaj)

`v16.2.0`

Compare Source

v16.2.0 (2021-12-17)

New Feature 🚀

#3426 type/definition: export resolve*Thunk functions (@IvanGoncharov)

Docs 📝

#3422 Minor grammar fixes in collectFields documentation (@Cito)

Polish 💅

#3423 assertName-test: test new instead of deprecated function (@Cito)

Internal 🏠

2 PRs were merged

#3420 resources/utils: extract 'writeGeneratedFile' to utils (@IvanGoncharov)
#3427 gh/actions: run benchmark and NPM diff on correct base commits (@IvanGoncharov)

Committers: 2

Christoph Zwerschke(@Cito)
Ivan Goncharov(@IvanGoncharov)

`v16.1.0`

Compare Source

v16.1.0 (2021-12-07)

New Feature 🚀

#3355 Export GRAPHQL_MAX_INT and GRAPHQL_MIN_INT (@tofran)
#3384 Preserve non-error values thrown from resolvers (@IvanGoncharov)

Bug Fix 🐞

#3375 printSchema: handle descriptions that are non-printable as block strings (@IvanGoncharov)

Docs 📝

#3393 Update doc examples to reflect the current API (@paulserraino)

Polish 💅

9 PRs were merged

#3365 Add devAssert about removal of positional arguments (@IvanGoncharov)
#3376 execute: fix spec section names in comments (@twof)
#3377 lexer-tests: Use tildas as invalid characters (@twof)
#3391 Enable '@typescript-eslint/switch-exhaustiveness-check' rule (@IvanGoncharov)
#3392 Remove $FlowFixMe comments (@IvanGoncharov)
#3396 typeFromAST: use exhaustive switch and remove invariant (@IvanGoncharov)
#3400 expectJSON: improve readability (@IvanGoncharov)
#3401 tests: Improve formating of strings with 'dedent' tag (@IvanGoncharov)
#3406 Simplify code by replacing Object.entries with Object.keys (@IvanGoncharov)

Internal 🏠

9 PRs were merged

#3386 Add support for Node17 (@IvanGoncharov)
#3388 Drop "eslint-plugin-istanbul" and implement as internal ESLint rule (@IvanGoncharov)
#3398 Switch coverage from nyc to c8 (@IvanGoncharov)
#3403 ci: add check that 'package-lock.json' doesn't have conflicts (@IvanGoncharov)
#3404 github/workflows: simplify npm cache setup (@IvanGoncharov)
#3405 Use for '--ignore-scripts' for all npm ci & npm install (@IvanGoncharov)
#3407 ci: add check for unnecessary duplicates in package-lock.json (@IvanGoncharov)
#3416 fix c8 ignore decorator typos (@yaacovCR)
#3417 package.json: Specify NPM release tag explicitly (@IvanGoncharov)

Dependency 📦

4 PRs were merged

#3387 Update package-lock.json (@IvanGoncharov)
#3389 package.json: Drop unused '@babel/eslint-parser' (@IvanGoncharov)
#3390 Update deps (@IvanGoncharov)
#3399 Update deps (@IvanGoncharov)

Committers: 5

Alex Reilly(@twof)
Francisco Marques(@tofran)
Ivan Goncharov(@IvanGoncharov)
Paul Serraino(@paulserraino)
Yaacov Rydzinski (@yaacovCR)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): update dependency graphql to v16.8.1 [security]

47b604f

Navigation Menu

Repository navigation

fix(deps): update dependency graphql to v16.8.1 [security] - #1816

fix(deps): update dependency graphql to v16.8.1 [security]#1816
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-graphql-vulnerability

renovate Bot commented Oct 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 3, 2026

graphql Uncontrolled Resource Consumption vulnerability

Details

Severity

References

Release Notes

v16.8.1 (2023-09-19)

Bug Fix 🐞

Committers: 1

v16.8.0 (2023-08-14)

New Feature 🚀

Committers: 1

v16.7.1 (2023-06-22)

Bug Fix 🐞

Committers: 1

v16.7.0 (2023-06-21)

New Feature 🚀

Bug Fix 🐞

Committers: 3

v16.6.0 (2022-08-16)

New Feature 🚀

Bug Fix 🐞

Committers: 2

v16.5.0 (2022-05-09)

New Feature 🚀

Committers: 1

v16.4.0 (2022-04-25)

New Feature 🚀

Bug Fix 🐞

Docs 📝

Polish 💅

Internal 🏠

Dependency 📦

Committers: 7

v16.3.0 (2022-01-26)

New Feature 🚀

Bug Fix 🐞

Docs 📝

Polish 💅

Internal 🏠

Dependency 📦

Committers: 6

v16.2.0 (2021-12-17)

New Feature 🚀

Docs 📝

Polish 💅

Internal 🏠

Committers: 2

v16.1.0 (2021-12-07)

New Feature 🚀

Bug Fix 🐞

Docs 📝

Polish 💅

Internal 🏠

Dependency 📦

Committers: 5

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants