graphql 2.6.11 → 2.6.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f449cab829c8314cf4cd1b51e225e70603f5dc16dfcb221d3204aa39bd9fe2cd
-  data.tar.gz: 6fb74ee40392f0663b728c76e72239596fc82271d2222e2d9170d8ad06579f6c
+  metadata.gz: 24a0e699fe2f72dd869173b2bc6aa96ec8d40e738a293bc56b9176debca03861
+  data.tar.gz: 18b16bf0c467f5f8dc0c00ea2bcf2fbaf53283edc9f09a3789918523090a97ce
 SHA512:
-  metadata.gz: 2820887a516c9a015774633ac126924642ceb778b523d0563af9ba766f6a3bfa5fa89ad0420c9ea3ee5208fe8fcdd58101aff1777b44de98c8c12b01fd64be0d
-  data.tar.gz: 90856cb6b43ac1be362d3358820857c1c8cc038f19def34a119677a6924c7b1441eca628c9e26a2134ae52aaab7507cea3521e36cad2763614909c10d8a79577
+  metadata.gz: 74a34839ced3a300d20ca370cb37a7c88c56345ecb056e9b9caa7a424fdb7573c5a014b80a32772cc2a5eb40d83e568c5d0875d93b029b1663dda9547fc06ba1
+  data.tar.gz: 65dcfea9802c9fb682e6595ef2d2d224a256c0650ff24fa57774eac420b27e594b3c432a104d76c8e033c659a608940661ea4503e0737f63d7839ff36f5f4405

data/lib/graphql/dataloader/async_dataloader.rb

@@ -254,6 +254,8 @@ module GraphQL
           task = Async::Task.new do |root_task|
             run.root_task = root_task
             root_task.graphql_async_dataloader_run = run
+            # Tasks inherit the spawning fiber's storage; give this run its own execution state.
+            Fiber[:__graphql_runtime_info] = nil
             set_fiber_variables(fiber_vars)
 
             while first_pass || run.running? || !jobs.empty?

data/lib/graphql/dataloader.rb

@@ -263,6 +263,8 @@ module GraphQL
     def spawn_fiber
       fiber_vars = get_fiber_variables
       Fiber.new(blocking: !@nonblocking) do
+        # Fibers inherit the spawning fiber's storage; give each one its own execution state.
+        Fiber[:__graphql_runtime_info] = nil
         set_fiber_variables(fiber_vars)
         yield
       ensure

data/lib/graphql/execution/field_resolve_step.rb

@@ -2,6 +2,10 @@
 module GraphQL
   module Execution
     class FieldResolveStep
+      # Only these built-in fields on Relay connection and edge types return already-scoped items.
+      # Custom fields on those types must still be authorized normally.
+      SCOPED_RELAY_FIELD_NAMES = [:node, :nodes, :edges].freeze
+
       def initialize(parent_type:, runner:, key:, selections_step:)
         @selections_step = selections_step
         @key = key
@@ -283,7 +287,7 @@ module GraphQL
           authorized_objects = objects
         end
 
-        if @parent_type.default_relay? && authorized_objects.all? { |o| o.respond_to?(:was_authorized_by_scope_items?) && o.was_authorized_by_scope_items? }
+        if @parent_type.default_relay? && SCOPED_RELAY_FIELD_NAMES.include?(@field_definition.original_name) && authorized_objects.all? { |o| o.respond_to?(:was_authorized_by_scope_items?) && o.was_authorized_by_scope_items? }
           @was_scoped = true
         end
 
@@ -527,7 +531,7 @@ module GraphQL
           end
 
           inner_type = return_type.of_type
-          result_a = Array.new(field_result.size)
+          result_a = field_result.is_a?(Array) ? Array.new(field_result.size) : []
           field_result.each_with_index do |item, idx|
             result_a[idx] = build_leaf_result(result_a, idx, item, inner_type, ctx, true)
           end
@@ -645,11 +649,18 @@ module GraphQL
           list_result = graphql_result[key] = []
           @directive_finalizers&.each { |f| @runner.add_finalizer(@selections_step.query, list_result, nil, f) }
           i = 0
-          s = field_result.size
-          while i < s
-            inner_f_r = field_result[i]
-            build_graphql_result(list_result, i, inner_f_r, inner_type, inner_type_nn, inner_type_l, true)
-            i += 1
+          if field_result.is_a?(Array)
+            s = field_result.size
+            while i < s
+              inner_f_r = field_result[i]
+              build_graphql_result(list_result, i, inner_f_r, inner_type, inner_type_nn, inner_type_l, true)
+              i += 1
+            end
+          else
+            field_result.each do |inner_f_r|
+              build_graphql_result(list_result, i, inner_f_r, inner_type, inner_type_nn, inner_type_l, true)
+              i += 1
+            end
           end
         elsif @runner.resolves_lazies || (
                 @static_type.kind.object? ?

data/lib/graphql/execution/interpreter/runtime.rb

@@ -619,7 +619,9 @@ module GraphQL
           when Array
             # It's an array full of execution errors; add them all.
             if !value.empty? && value.all?(GraphQL::ExecutionError)
-              list_type_at_all = (field && (field.type.list?))
+              list_type = field && field.type
+              list_type = list_type.of_type if list_type && list_type.non_null?
+              list_type_at_all = list_type && list_type.list?
               if selection_result.nil? || !selection_result.graphql_dead
                 value.each_with_index do |error, index|
                   error.ast_node ||= ast_node
@@ -627,7 +629,7 @@ module GraphQL
                   context.errors << error
                 end
                 if selection_result
-                  if list_type_at_all
+                  if list_type_at_all && !list_type.of_type.non_null?
                     result_without_errors = value.map { |v| v.is_a?(GraphQL::ExecutionError) ? nil : v }
                     set_result(selection_result, result_name, result_without_errors, false, is_non_null)
                   else
@@ -798,6 +800,8 @@ module GraphQL
 
         def resolve_list_item(inner_value, inner_type, inner_type_non_null, ast_node, field, owner_object, arguments, this_idx, response_list, owner_type, was_scoped, runtime_state) # rubocop:disable Metrics/ParameterLists
           runtime_state ||= get_current_runtime_state
+          runtime_state.current_field = field
+          runtime_state.current_arguments = arguments
           runtime_state.current_result_name = this_idx
           runtime_state.current_result = response_list
           call_method_on_directives(:resolve_each, owner_object, ast_node.directives) do

data/lib/graphql/language/parser.rb

@@ -65,24 +65,25 @@ module GraphQL
       end
 
       def column_at(pos)
-        next_line_idx = lines_at.bsearch_index { |l| l >= pos } || 0
-        if next_line_idx > 0
-          line_pos = @lines_at[next_line_idx - 1]
-          pos - line_pos
+        next_line_idx = lines_at.bsearch_index { |l| l >= pos } || @lines_at.size
+        line_start = next_line_idx == 0 ? 0 : @lines_at[next_line_idx - 1] + 1
+        if @graphql_str.ascii_only?
+          pos - line_start + 1
         else
-          pos + 1
+          @graphql_str.byteslice(line_start, pos - line_start).force_encoding(Encoding::UTF_8).length + 1
         end
       end
 
       private
 
-      # @return [Array<Integer>] Positions of each line break in the original string
+      # @return [Array<Integer>] Byte offsets of each line break in the original string
       def lines_at
         @lines_at ||= begin
+          graphql_str = @graphql_str.b
           la = []
           idx = 0
           while idx
-            idx = @graphql_str.index("\n", idx)
+            idx = graphql_str.index("\n", idx)
             if idx
               la << idx
               idx += 1

data/lib/graphql/pagination/relation_connection.rb

@@ -88,7 +88,11 @@ module GraphQL
 
       # @return [Integer]
       def offset_from_cursor(cursor)
-        decode(cursor).to_i
+        offset = Integer(decode(cursor), 10, exception: false)
+        if offset.nil? || offset <= 0
+          raise GraphQL::ExecutionError, "Invalid cursor: #{cursor.inspect}"
+        end
+        offset
       end
 
       # Abstract this operation so we can always ignore inputs less than zero.
@@ -230,7 +234,7 @@ module GraphQL
       end
 
       def async_dataloader?
-        @context&.[](:dataloader).is_a?(GraphQL::Dataloader::AsyncDataloader)
+        @context&.dataloader.is_a?(GraphQL::Dataloader::AsyncDataloader)
       end
 
       # Load nodes after applying first/last/before/after,

data/lib/graphql/query/variables.rb

@@ -35,7 +35,11 @@ module GraphQL
             value_was_provided =  @provided_variables.key?(variable_name)
             max_errors = schema.validate_max_errors - @errors.count if schema.validate_max_errors
             begin
-              validation_result = variable_type.validate_input(provided_value, ctx, max_errors: max_errors)
+              validation_result = if value_was_provided || default_value.nil?
+                variable_type.validate_input(provided_value, ctx, max_errors: max_errors)
+              else
+                GraphQL::Query::InputValidationResult::VALID
+              end
               if validation_result.valid?
                 if value_was_provided
                   # Add the variable if a value was provided

data/lib/graphql/schema/visibility/profile.rb

@@ -33,30 +33,49 @@ module GraphQL
 
         def freeze
           @cached_visible.default_proc = nil
+          @cached_visible.freeze
           @cached_visible_fields.default_proc = nil
           @cached_visible_fields.each do |type, fields|
             fields.default_proc = nil
+            fields.freeze
           end
+          @cached_visible_fields.freeze
           @cached_visible_arguments.default_proc = nil
           @cached_visible_arguments.each do |type, fields|
             fields.default_proc = nil
+            fields.freeze
           end
+          @cached_visible_arguments.freeze
           @cached_parent_fields.default_proc = nil
           @cached_parent_fields.each do |type, fields|
             fields.default_proc = nil
+            fields.freeze
           end
+          @cached_parent_fields.freeze
           @cached_parent_arguments.default_proc = nil
           @cached_parent_arguments.each do |type, args|
             args.default_proc = nil
+            args.freeze
           end
+          @cached_parent_arguments.freeze
           @cached_possible_types.default_proc = nil
+          @cached_possible_types.freeze
           @cached_enum_values.default_proc = nil
+          @cached_enum_values.freeze
           @cached_fields.default_proc = nil
+          @cached_fields.freeze
           @cached_arguments.default_proc = nil
+          @cached_arguments.freeze
           @loadable_possible_types.default_proc = nil
+          @loadable_possible_types.freeze
           @cached_field_result.default_proc = nil
-          @cached_field_result.each { |_, h| h.default_proc = nil }
+          @cached_field_result.each do |_, h|
+            h.default_proc = nil
+            h.freeze
+          end
+          @cached_field_result.freeze
           @cached_type_result.default_proc = nil
+          @cached_type_result.freeze
           super
         end
 
@@ -277,10 +296,18 @@ module GraphQL
                 arguments(f).each do |arg|
                   argument(f, arg.graphql_name)
                 end
+
+                resolver_class = f.resolver
+                if resolver_class
+                  arguments(resolver_class).each do |arg|
+                    argument(resolver_class, arg.graphql_name)
+                  end
+                end
               end
               @schema.introspection_system.dynamic_fields.each do |f|
                 field(type_defn, f.graphql_name)
               end
+              interfaces(type_defn)
             elsif type_defn.kind.input_object?
               arguments(type_defn).each do |arg|
                 argument(type_defn, arg.graphql_name)
@@ -289,8 +316,9 @@ module GraphQL
               enum_values(type_defn)
             elsif type_defn.kind.union?
               loadable_possible_types(type_defn, @context)
-            elsif type_defn.kind.object? || type_defn.kind.interface?
-              interfaces(type_defn)
+              @schema.introspection_system.dynamic_fields.each do |f|
+                field(type_defn, f.graphql_name)
+              end
             end
             possible_types(type_defn)
           end
@@ -313,6 +341,20 @@ module GraphQL
               argument(directive, directive_argument.graphql_name)
             end
           end
+
+          @cached_arguments.each do |owner, args|
+            @cached_parent_arguments[owner]
+
+            args.each do |arg|
+              if (loads_type = arg.loads)
+                loadable?(loads_type, @context)
+                possible_types(loads_type)
+                if loads_type.kind.union?
+                  loadable_possible_types(loads_type, @context)
+                end
+              end
+            end
+          end
         end
 
         private

data/lib/graphql/static_validation/base_visitor.rb

@@ -16,6 +16,7 @@ module GraphQL
         @schema = context.schema
         @inline_fragment_paths = {}
         @field_unwrapped_types = {}.compare_by_identity
+        @child_positions = {}.compare_by_identity
         super(document)
       end
 
@@ -159,6 +160,7 @@ module GraphQL
           @current_argument_definition = @parent_argument_definition
           @parent_argument_definition = prev_parent
           @path_depth -= 1
+          @child_positions.delete(node)
         end
 
         def on_fragment_spread(node, parent)
@@ -171,7 +173,7 @@ module GraphQL
         def on_input_object(node, parent)
           arg_defn = @current_argument_definition
           if arg_defn && arg_defn.type.list?
-            @path[@path_depth] = parent.children.index(node)
+            @path[@path_depth] = child_positions(parent)[node]
             @path_depth += 1
             super
             @path_depth -= 1
@@ -180,6 +182,14 @@ module GraphQL
           end
         end
 
+        def child_positions(parent)
+          @child_positions[parent] ||= begin
+            positions = {}.compare_by_identity
+            parent.children.each_with_index { |child, index| positions[child] ||= index }
+            positions
+          end
+        end
+
         # @return [GraphQL::BaseType] The current object type
         def type_definition
           @current_object_type

data/lib/graphql/static_validation/rules/subscription_root_exists_and_single_subscription_selection.rb

@@ -9,18 +9,53 @@ module GraphQL
               'Schema is not configured for subscriptions',
               nodes: node
             ))
-          elsif node.selections.size != 1
-            add_error(GraphQL::StaticValidation::NotSingleSubscriptionError.new(
-              'A subscription operation may only have one selection',
-              nodes: node,
-            ))
           else
+            root_fields = subscription_root_fields(node)
+            if root_fields.map { |field| field.alias || field.name }.uniq.size != 1
+              add_error(GraphQL::StaticValidation::NotSingleSubscriptionError.new(
+                'A subscription operation may only have one selection',
+                nodes: node,
+              ))
+            elsif root_fields.any? { |field| field.name.start_with?("__") }
+              add_error(GraphQL::StaticValidation::NotSingleSubscriptionError.new(
+                'A subscription operation may not select an introspection field',
+                nodes: node,
+              ))
+            end
             super
           end
         else
           super
         end
       end
+
+      private
+
+      def subscription_root_fields(node)
+        root_type = context.types.subscription_root
+        fields = []
+        selections = node.selections.dup
+        visited_fragments = {}
+
+        while (selection = selections.pop)
+          case selection
+          when GraphQL::Language::Nodes::Field
+            fields << selection
+          when GraphQL::Language::Nodes::FragmentSpread
+            next if visited_fragments[selection.name]
+            visited_fragments[selection.name] = true
+            fragment = context.fragments[selection.name]
+            selections << fragment if fragment
+          when GraphQL::Language::Nodes::InlineFragment, GraphQL::Language::Nodes::FragmentDefinition
+            fragment_type = selection.type ? @types.type(selection.type.name) : root_type
+            if fragment_type && fragment_type.kind.composite? && @types.possible_types(fragment_type).include?(root_type)
+              selections.concat(selection.selections)
+            end
+          end
+        end
+
+        fields
+      end
     end
   end
 end

data/lib/graphql/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module GraphQL
-  VERSION = "2.6.11"
+  VERSION = "2.6.12"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: graphql
 version: !ruby/object:Gem::Version
-  version: 2.6.11
+  version: 2.6.12
 platform: ruby
 authors:
 - Robert Mosolgo
 bindir: bin
 cert_chain: []
-date: 2026-09-21 00:00:00.000000000 Z
+date: 2026-10-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64