Skip to content

Update dependency graphql to v16 [SECURITY] - #165

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/subscriptions-npm-graphql-vulnerability
Open

Update dependency graphql to v16 [SECURITY]#165
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/subscriptions-npm-graphql-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Apr 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
graphql ^15.5.1 → ^16.0.0 age confidence

graphql Uncontrolled Resource Consumption vulnerability

CVE-2023-26144 / GHSA-9pv7-vfvm-6vr7

More information

Details

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.

Note: It was not proven that this vulnerability can crash the process.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

graphql/graphql-js (graphql)

v16.8.1

Compare Source

v16.8.1 (2023-09-19)

Bug Fix 🐞
Committers: 1

v16.8.0

Compare Source

v16.8.0 (2023-08-14)

New Feature 🚀
Committers: 1

v16.7.1

Compare Source

v16.7.1 (2023-06-22)

📢 Big shout out to @​phryneas, who managed to reproduce this issue and come up with this fix.

Bug Fix 🐞
Committers: 1

v16.7.0

Compare Source

v16.7.0 (2023-06-21)

New Feature 🚀
Bug Fix 🐞
Committers: 3

v16.6.0

Compare Source

v16.6.0 (2022-08-16)
New Feature 🚀
Bug Fix 🐞
Committers: 2

v16.5.0

Compare Source

v16.5.0 (2022-05-09)
New Feature 🚀
Committers: 1

v16.4.0

Compare Source

v16.4.0 (2022-04-25)
New Feature 🚀
Bug Fix 🐞
Docs 📝
2 PRs were merged
Polish 💅
3 PRs were merged
Internal 🏠
26 PRs were merged
Dependency 📦
2 PRs were merged
Committers: 7

v16.3.0

Compare Source

v16.3.0 (2022-01-26)
New Feature 🚀
Bug Fix 🐞
Docs 📝
2 PRs were merged
Polish 💅
7 PRs were merged
Internal 🏠
5 PRs were merged
Dependency 📦
4 PRs were merged
Committers: 6

v16.2.0

Compare Source

v16.2.0 (2021-12-17)
New Feature 🚀
Docs 📝
Polish 💅
Internal 🏠
2 PRs were merged
Committers: 2

v16.1.0

Compare Source

v16.1.0 (2021-12-07)
New Feature 🚀
Bug Fix 🐞
Docs 📝
Polish 💅
9 PRs were merged
Internal 🏠
9 PRs were merged
Dependency 📦
4 PRs were merged
Committers: 5

v16.0.1

Compare Source

v16.0.1 (2021-11-01)
Bug Fix 🐞
Polish 💅
Internal 🏠
Committers: 1

v16.0.0

Compare Source

v16.0.0 (2021-10-28)
Breaking Change 💥
Deprecation ⚠
New Feature 🚀
Bug Fix 🐞
Docs 📝
5 PRs were merged
Polish 💅
119 PRs were merged

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner April 15, 2026 10:03
@renovate

renovate Bot commented Apr 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: apollo-server/v3/subscriptions/package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @graphql-tools/schema@7.1.5
npm error Found: graphql@16.14.2
npm error node_modules/graphql
npm error   graphql@"^16.0.0" from the root project
npm error   peer graphql@"14.x || 15.x || 16.x" from @apollo/utils.dropunuseddefinitions@1.1.0
npm error   node_modules/@apollo/utils.dropunuseddefinitions
npm error     @apollo/utils.dropunuseddefinitions@"^1.1.0" from @apollo/utils.usagereporting@1.0.1
npm error     node_modules/@apollo/utils.usagereporting
npm error       @apollo/utils.usagereporting@"^1.0.0" from apollo-server-core@3.12.0
npm error       node_modules/apollo-server-core
npm error         apollo-server-core@"^3.12.0" from apollo-server-express@3.12.0
npm error         node_modules/apollo-server-express
npm error   22 more (@apollo/utils.printwithreducedwhitespace, ...)
npm error
npm error Could not resolve dependency:
npm error peer graphql@"^14.0.0 || ^15.0.0" from @graphql-tools/schema@7.1.5
npm error node_modules/@graphql-tools/schema
npm error   @graphql-tools/schema@"^7.1.5" from the root project
npm error
npm error Conflicting peer dependency: graphql@15.10.3
npm error node_modules/graphql
npm error   peer graphql@"^14.0.0 || ^15.0.0" from @graphql-tools/schema@7.1.5
npm error   node_modules/@graphql-tools/schema
npm error     @graphql-tools/schema@"^7.1.5" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-15T14_46_27_727Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-15T14_46_27_727Z-debug-0.log
File name: apollo-server/v2/subscriptions/package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @apollographql/graphql-upload-8-fork@8.1.4
npm warn Found: graphql@16.14.2
npm warn node_modules/graphql
npm warn   graphql@"^16.0.0" from the root project
npm warn   3 more (@apollographql/apollo-tools, graphql-tag, subscriptions-transport-ws)
npm warn
npm warn Could not resolve dependency:
npm warn peer graphql@"0.13.1 - 15" from @apollographql/graphql-upload-8-fork@8.1.4
npm warn node_modules/@apollographql/graphql-upload-8-fork
npm warn   @apollographql/graphql-upload-8-fork@"^8.1.4" from apollo-server-core@2.26.1
npm warn   node_modules/apollo-server-core
npm warn
npm warn Conflicting peer dependency: graphql@15.10.3
npm warn node_modules/graphql
npm warn   peer graphql@"0.13.1 - 15" from @apollographql/graphql-upload-8-fork@8.1.4
npm warn   node_modules/@apollographql/graphql-upload-8-fork
npm warn     @apollographql/graphql-upload-8-fork@"^8.1.4" from apollo-server-core@2.26.1
npm warn     node_modules/apollo-server-core
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: apollo-cache-control@0.15.0
npm warn Found: graphql@16.14.2
npm warn node_modules/graphql
npm warn   graphql@"^16.0.0" from the root project
npm warn   3 more (@apollographql/apollo-tools, graphql-tag, subscriptions-transport-ws)
npm warn
npm warn Could not resolve dependency:
npm warn peer graphql@"^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0" from apollo-cache-control@0.15.0
npm warn node_modules/apollo-cache-control
npm warn   apollo-cache-control@"^0.15.0" from apollo-server-core@2.26.1
npm warn   node_modules/apollo-server-core
npm warn
npm warn Conflicting peer dependency: graphql@15.10.3
npm warn node_modules/graphql
npm warn   peer graphql@"^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0" from apollo-cache-control@0.15.0
npm warn   node_modules/apollo-cache-control
npm warn     apollo-cache-control@"^0.15.0" from apollo-server-core@2.26.1
npm warn     node_modules/apollo-server-core
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: apollo-graphql@0.9.7
npm warn Found: graphql@16.14.2
npm warn node_modules/graphql
npm warn   graphql@"^16.0.0" from the root project
npm warn   3 more (@apollographql/apollo-tools, graphql-tag, subscriptions-transport-ws)
npm warn
npm warn Could not resolve dependency:
npm warn peer graphql@"^14.2.1 || ^15.0.0" from apollo-graphql@0.9.7
npm warn node_modules/apollo-graphql
npm warn   apollo-graphql@"^0.9.0" from apollo-server-core@2.26.1
npm warn   node_modules/apollo-server-core
npm warn
npm warn Conflicting peer dependency: graphql@15.10.3
npm warn node_modules/graphql
npm warn   peer graphql@"^14.2.1 || ^15.0.0" from apollo-graphql@0.9.7
npm warn   node_modules/apollo-graphql
npm warn     apollo-graphql@"^0.9.0" from apollo-server-core@2.26.1
npm warn     node_modules/apollo-server-core
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: apollo-link@1.2.14
npm warn Found: graphql@16.14.2
npm warn node_modules/graphql
npm warn   graphql@"^16.0.0" from the root project
npm warn   3 more (@apollographql/apollo-tools, graphql-tag, subscriptions-transport-ws)
npm warn
npm warn Could not resolve dependency:
npm warn peer graphql@"^0.11.3 || ^0.12.3 || ^0.13.0 || ^14.0.0 || ^15.0.0" from apollo-link@1.2.14
npm warn node_modules/apollo-link
npm warn   apollo-link@"^1.2.14" from graphql-tools@4.0.8
npm warn   node_modules/graphql-tools
npm warn
npm warn Conflicting peer dependency: graphql@15.10.3
npm warn node_modules/graphql
npm warn   peer graphql@"^0.11.3 || ^0.12.3 || ^0.13.0 || ^14.0.0 || ^15.0.0" from apollo-link@1.2.14
npm warn   node_modules/apollo-link
npm warn     apollo-link@"^1.2.14" from graphql-tools@4.0.8
npm warn     node_modules/graphql-tools
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: apollo-server@2.26.1
npm error Found: graphql@16.14.2
npm error node_modules/graphql
npm error   graphql@"^16.0.0" from the root project
npm error   peer graphql@"^14.2.1 || ^15.0.0 || ^16.0.0" from @apollographql/apollo-tools@0.5.4
npm error   node_modules/@apollographql/apollo-tools
npm error     @apollographql/apollo-tools@"^0.5.0" from apollo-server-core@2.26.1
npm error     node_modules/apollo-server-core
npm error       apollo-server-core@"^2.26.1" from apollo-server@2.26.1
npm error       node_modules/apollo-server
npm error         apollo-server@"^2.25.4" from the root project
npm error       1 more (apollo-server-express)
npm error     @apollographql/apollo-tools@"^0.5.0" from graphql-extensions@0.16.0
npm error     node_modules/graphql-extensions
npm error       graphql-extensions@"^0.16.0" from apollo-server-core@2.26.1
npm error       node_modules/apollo-server-core
npm error         apollo-server-core@"^2.26.1" from apollo-server@2.26.1
npm error         node_modules/apollo-server
npm error         1 more (apollo-server-express)
npm error   2 more (graphql-tag, subscriptions-transport-ws)
npm error
npm error Could not resolve dependency:
npm error peer graphql@"^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0" from apollo-server@2.26.1
npm error node_modules/apollo-server
npm error   apollo-server@"^2.25.4" from the root project
npm error
npm error Conflicting peer dependency: graphql@15.10.3
npm error node_modules/graphql
npm error   peer graphql@"^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0" from apollo-server@2.26.1
npm error   node_modules/apollo-server
npm error     apollo-server@"^2.25.4" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-15T14_46_28_719Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-15T14_46_28_719Z-debug-0.log

@renovate renovate Bot changed the title Update dependency graphql to v16 [SECURITY] Update dependency graphql to v16 [SECURITY] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate
renovate Bot deleted the renovate/subscriptions-npm-graphql-vulnerability branch April 27, 2026 19:17
@renovate renovate Bot changed the title Update dependency graphql to v16 [SECURITY] - autoclosed Update dependency graphql to v16 [SECURITY] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/subscriptions-npm-graphql-vulnerability branch 2 times, most recently from b7a0c78 to 301af83 Compare April 27, 2026 22:18
@renovate renovate Bot changed the title Update dependency graphql to v16 [SECURITY] Update dependency graphql to v16 [SECURITY] - autoclosed May 23, 2026
@renovate renovate Bot closed this May 23, 2026
@renovate renovate Bot changed the title Update dependency graphql to v16 [SECURITY] - autoclosed Update dependency graphql to v16 [SECURITY] May 23, 2026
@renovate renovate Bot reopened this May 23, 2026
@renovate
renovate Bot force-pushed the renovate/subscriptions-npm-graphql-vulnerability branch 2 times, most recently from 301af83 to f00ce0e Compare May 23, 2026 17:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants