graphql 2.6.7 → 2.6.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 75192ceea307d33645d2d511db98530f8021c8af45af33fc75e86dcd69f53952
-  data.tar.gz: ff3ee9e77876ad45fb67491fb5076df4614ab086ecfa15e476b3d35bca2e3b22
+  metadata.gz: 6a359d53729477046ffd6b51ef9345099defcdc95521579711fffe5ab79c0b5e
+  data.tar.gz: 4c88aecd90fb26e02198f21f4bdf7a73f577ec37ac9ea9eb6c840c8a2957fc7a
 SHA512:
-  metadata.gz: 50bc8591ece79fc8070b4c3a6a3611f29e9a4ad84a94e6f310a5fd2c00ac0d10b6db5ebe44474e1d5f002a76615d6a25dd4dbfc2a8f56ec1c2d0d88972ce95e2
-  data.tar.gz: b28b83923ac25bb605d7fe1e9b25a64e37aa8173a64c958849287cdd0c87cc419deea25f36b4d525a6ea17088b7a02cb0a51011750c568337a6274b0373ff43b
+  metadata.gz: d40bb56d8b5e77ca6f126f1528e2a074bbf679996dfb8ea5a12d646d028d547848dc36dea3a5fb73273fb7252135a5c7e904ec7d0a38790fe05164c5e81701b5
+  data.tar.gz: e486b9492693cdc69375f8d3bc662e075a71ff45642f62cb2fd741959b2a2d1f9105fa14718b992ef2d3b3a809fd0f0d94ec66abf509137b3a7af05877527c23

data/lib/generators/graphql/templates/schema.erb

@@ -26,7 +26,8 @@ class <%= schema_name %> < GraphQL::Schema
     raise(GraphQL::RequiredImplementationMissingError)
   end
 
-  # Limit the size of incoming queries:
+  # Limit the depth and size of incoming queries:
+  max_depth(15)
   max_query_string_tokens(5000)
 
   # Stop validating when it encounters this many errors:

data/lib/graphql/dashboard/application_controller.rb

@@ -22,7 +22,11 @@ module Graphql
 
       def schema_class
         @schema_class ||= begin
-          schema_param = request.query_parameters["schema"] || params[:schema]
+          configured_schemas = Array(request.path_parameters[:schema] || request.path_parameters["schema"])
+          schema_param = request.query_parameters["schema"]
+          schema_param = configured_schemas.find { |schema| schema.to_s == schema_param } if schema_param
+          schema_param ||= configured_schemas.first
+
           case schema_param
           when Class
             schema_param

data/lib/graphql/dashboard.rb

@@ -10,6 +10,9 @@ module Graphql
   # @example Mounting the Dashboard in your app
   #   mount GraphQL::Dashboard, at: "graphql_dashboard", schema: "MySchema"
   #
+  # Pass an array to allow selecting from multiple schemas with the `schema` query parameter.
+  #   mount GraphQL::Dashboard, at: "graphql_dashboard", schema: ["MySchema", "OtherSchema"]
+  #
   # @example Authenticating the Dashboard with HTTP Basic Auth
   #   # config/initializers/graphql_dashboard.rb
   #   GraphQL::Dashboard.middleware.use(Rack::Auth::Basic) do |username, password|

data/lib/graphql/execution/field_resolve_step.rb

@@ -130,7 +130,7 @@ module GraphQL
         highest_nulled_depth = path.size
         highest_list_depth = nil
         current_field_step = self
-        while current_field_step
+        while current_field_step && current_field_step.field_definition
           return_type = current_field_step.field_definition.type
           if propagating_null && return_type.non_null?
             highest_nulled_depth = current_field_step.path.size
@@ -147,7 +147,7 @@ module GraphQL
 
         if highest_list_depth.nil? || highest_nulled_depth <= highest_list_depth
           kill_field_step = self
-          while kill_field_step && highest_nulled_depth <= kill_field_step.path.size
+          while kill_field_step && kill_field_step.field_definition && highest_nulled_depth <= kill_field_step.path.size
             kill_field_step.selections_step.killed = true
             kill_field_step = kill_field_step.selections_step.field_resolve_step
           end

data/lib/graphql/execution/interpreter.rb

@@ -119,6 +119,12 @@ module GraphQL
               end
 
               results
+            rescue SystemStackError => err
+              queries.map do |query|
+                schema.query_stack_error(query, err)
+                query.result_values ||= { "errors" => query.context.errors.map(&:to_h) }
+                query.result
+              end
             rescue Exception
               # TODO rescue at a higher level so it will catch errors in analysis, too
               # Assign values here so that the query's `@executed` becomes true

data/lib/graphql/execution/runner.rb

@@ -5,7 +5,6 @@ module GraphQL
       def initialize(multiplex)
         @multiplex = multiplex
         @schema = multiplex.schema
-        @steps_queue = []
         @runtime_type_at = {}.compare_by_identity
         @static_type_at = {}.compare_by_identity
         @finalizers = nil
@@ -53,7 +52,7 @@ module GraphQL
         @dataloader.append_job(step)
       end
 
-      attr_reader :steps_queue, :schema, :variables, :dataloader, :resolves_lazies, :authorizes, :static_type_at, :runtime_type_at, :finalizers, :input_values
+      attr_reader :schema, :variables, :dataloader, :resolves_lazies, :authorizes, :static_type_at, :runtime_type_at, :finalizers, :input_values
 
       # @return [void]
       def add_finalizer(query, result_value, key, finalizer)

data/lib/graphql/language/block_string.rb

@@ -21,17 +21,12 @@ module GraphQL
             next
           end
           line_length = line.size
-          line_indent = if line.match?(/\A  [^ ]/)
-            2
-          elsif line.match?(/\A    [^ ]/)
-            4
-          elsif line.match?(/\A[^ ]/)
-            0
-          else
-            line[/\A */].size
+          leading = 0
+          while leading < line_length && line.getbyte(leading) == 32
+            leading += 1
           end
-          if line_indent < line_length && (common_indent.nil? || line_indent < common_indent)
-            common_indent = line_indent
+          if leading < line_length && (common_indent.nil? || leading < common_indent)
+            common_indent = leading
           end
         end
 
@@ -41,7 +36,7 @@ module GraphQL
             if idx == 0
               next
             else
-              line.slice!(0, common_indent)
+              line[0, common_indent] = ""
             end
           end
         end

data/lib/graphql/language/cache.rb

@@ -2,6 +2,9 @@
 
 require 'graphql/version'
 require 'digest/sha2'
+require 'openssl'
+require 'securerandom'
+require 'tempfile'
 
 module GraphQL
   module Language
@@ -9,7 +12,11 @@ module GraphQL
     #
     # With Rails, parser caching may enabled by setting `config.graphql.parser_cache = true` in your Rails application.
     #
-    # The cache may be manually built by assigning `GraphQL::Language::Parser.cache = GraphQL::Language::Cache.new("some_dir")`.
+    # The cache may be manually built by assigning `GraphQL::Language::Parser.cache = GraphQL::Language::Cache.new(Pathname.new("some_dir"), secret: ENV.fetch("GRAPHQL_CACHE_SECRET"))`.
+    # The `secret` should be a stable value stored outside of the cache directory.
+    # When it isn't provided, a process-local secret is generated and cache entries
+    # are rebuilt after the process restarts. Pass `secret: nil` to disable cache
+    # signing. This should only be used when the cache directory is trusted.
     # This will create a directory (`tmp/cache/graphql` by default) that stores a cache of parsed files.
     #
     # Much like [bootsnap](https://github.com/Shopify/bootsnap), the parser cache needs to be cleaned up manually.
@@ -18,32 +25,95 @@ module GraphQL
     #
     # @see GraphQL::Railtie for simple Rails integration
     class Cache
-      def initialize(path)
+      # @param path [Pathname] The directory where cache entries are stored.
+      # @param secret [String, nil] A stable secret for verifying cache entries. When omitted,
+      #   a process-local secret is generated. Pass `nil` to disable cache signing.
+      def initialize(path, secret: SecureRandom.random_bytes(32))
         @path = path
+        @secret = secret
       end
 
       DIGEST = Digest::SHA256.new << GraphQL::VERSION
+      HMAC_SIZE = OpenSSL::Digest::SHA256.new.digest_length
+      InvalidCache = Class.new(StandardError)
+      private_constant :InvalidCache
 
       def fetch(filename)
-        hash = DIGEST.dup << filename
+        cache_key = cache_key_for(filename)
+        return yield unless cache_key
+
+        cache_path = @path.join(cache_key)
+
+        begin
+          return load_cache(cache_path, cache_key) if cache_path.file?
+        rescue InvalidCache, SystemCallError
+          # Rebuild caches created by older versions or with an invalid signature.
+        end
+
+        payload = yield
         begin
-          hash << File.mtime(filename).to_i.to_s
+          write_cache(cache_path, cache_key, payload)
         rescue SystemCallError
-          return yield
+          # Parser caching is best-effort; return the parsed payload if the cache cannot be written.
         end
-        cache_path = @path.join(hash.to_s)
+        payload
+      end
+
+      private
+
+      def cache_key_for(filename)
+        content_digest = Digest::SHA256.file(filename).hexdigest
+        (DIGEST.dup << filename << content_digest).to_s
+      rescue SystemCallError
+        nil
+      end
+
+      def load_cache(cache_path, cache_key)
+        cache_data = cache_path.binread
+        return Marshal.load(cache_data) unless @secret
+
+        signature = cache_data.byteslice(0, HMAC_SIZE)
+        payload = cache_data.byteslice(HMAC_SIZE..-1)
+        raise InvalidCache unless signature && payload
 
-        if cache_path.exist?
-          Marshal.load(cache_path.read)
+        expected_signature = signature_for(cache_key, payload)
+        unless secure_compare(signature, expected_signature)
+          raise InvalidCache
+        end
+        Marshal.load(payload)
+      end
+
+      def write_cache(cache_path, cache_key, payload)
+        @path.mkpath
+        serialized_payload = Marshal.dump(payload)
+        cache_data = if @secret
+          signature_for(cache_key, serialized_payload) + serialized_payload
         else
-          payload = yield
-          tmp_path = "#{cache_path}.#{rand}"
+          serialized_payload
+        end
+
+        Tempfile.create(['graphql-cache-', '.tmp'], @path.to_s) do |tempfile|
+          tempfile.binmode
+          tempfile.write(cache_data)
+          tempfile.flush
+          tempfile.fsync
+          tempfile.close
+          File.rename(tempfile.path, cache_path.to_s)
+        end
+      end
+
+      def signature_for(cache_key, payload)
+        OpenSSL::HMAC.digest('SHA256', @secret, cache_key + payload)
+      end
+
+      def secure_compare(left, right)
+        return false unless left.bytesize == right.bytesize
 
-          @path.mkpath
-          File.binwrite(tmp_path, Marshal.dump(payload))
-          File.rename(tmp_path, cache_path.to_s)
-          payload
+        result = 0
+        left.bytes.each_with_index do |byte, index|
+          result |= byte ^ right.getbyte(index)
         end
+        result.zero?
       end
     end
   end

data/lib/graphql/language/lexer.rb

@@ -175,11 +175,14 @@ module GraphQL
       end
 
       def line_number
-        @scanner.string[0..@pos].count("\n") + 1
+        @scanner.string.byteslice(0, @pos).b.count("\n".b) + 1
       end
 
       def column_number
-        @scanner.string[0..@pos].split("\n").last.length
+        line_prefix = @scanner.string.byteslice(0, @pos)
+        line_prefix = line_prefix.b unless line_prefix.valid_encoding?
+        newline_index = line_prefix.rindex("\n")
+        newline_index ? line_prefix.length - newline_index : line_prefix.length + 1
       end
 
       def raise_parse_error(message, line = line_number, col = column_number)

data/lib/graphql/language/nodes.rb

@@ -304,7 +304,8 @@ module GraphQL
                 children_method_names.map { |m| "#{m}: NO_CHILDREN" } +
                 DEFAULT_INITIALIZE_OPTIONS
 
-              assignments = scalar_method_names.map { |m| "@#{m} = #{m}"} +
+              # Intern descriptions so identical strings across SDL documents share one frozen object.
+              assignments = scalar_method_names.map { |m| m == :description ? "@#{m} = #{m} && -#{m}" : "@#{m} = #{m}" } +
                 children_method_names.map { |m| "@#{m} = #{m}.freeze" }
 
               if name.end_with?("Definition") && name != "FragmentDefinition"

data/lib/graphql/language.rb

@@ -31,7 +31,7 @@ module GraphQL
 
         "[#{serialized_array}]"
       else
-        JSON.generate(value, quirks_mode: true)
+        JSON.generate(value)
       end
     rescue JSON::GeneratorError
       if Float::INFINITY == value

data/lib/graphql/railtie.rb

@@ -15,7 +15,8 @@ module GraphQL
     initializer("graphql.cache") do |app|
       if config.graphql.parser_cache
         Language::Parser.cache ||= Language::Cache.new(
-          app.root.join("tmp/cache/graphql")
+          app.root.join("tmp/cache/graphql"),
+          secret: app.secret_key_base
         )
       end
     end

data/lib/graphql/schema/input_object.rb

@@ -172,12 +172,12 @@ module GraphQL
           types = ctx.types
 
           if input.is_a?(Array)
-            return GraphQL::Query::InputValidationResult.from_problem(INVALID_OBJECT_MESSAGE % { object: JSON.generate(input, quirks_mode: true) })
+            return GraphQL::Query::InputValidationResult.from_problem(INVALID_OBJECT_MESSAGE % { object: JSON.generate(input) })
           end
 
           if !(input.respond_to?(:to_h) || input.respond_to?(:to_unsafe_h))
             # We're not sure it'll act like a hash, so reject it:
-            return GraphQL::Query::InputValidationResult.from_problem(INVALID_OBJECT_MESSAGE % { object: JSON.generate(input, quirks_mode: true) })
+            return GraphQL::Query::InputValidationResult.from_problem(INVALID_OBJECT_MESSAGE % { object: JSON.generate(input) })
           end
 
 

data/lib/graphql/subscriptions/serialize.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require "date"
 require "set"
 module GraphQL
   class Subscriptions
@@ -10,6 +11,7 @@ module GraphQL
       SYMBOL_KEYS_KEY = "__sym_keys__"
       TIMESTAMP_KEY = "__timestamp__"
       TIMESTAMP_FORMAT = "%Y-%m-%d %H:%M:%S.%N%z" # eg '2020-01-01 23:59:59.123456789+05:00'
+      TIMESTAMP_CLASS_NAMES = ["Date", "DateTime", "Time"].freeze
       OPEN_STRUCT_KEY = "__ostruct__"
 
       module_function
@@ -24,7 +26,7 @@ module GraphQL
       # @param obj [Object] Some subscription-related data to dump
       # @return [String] The stringified object
       def dump(obj)
-        JSON.generate(dump_value(obj), quirks_mode: true)
+        JSON.generate(dump_value(obj))
       end
 
       # This is for turning objects into subscription scopes.
@@ -72,15 +74,19 @@ module GraphQL
                 value[SYMBOL_KEY].to_sym
               when TIMESTAMP_KEY
                 timestamp_class_name, *timestamp_args = value[TIMESTAMP_KEY]
-                timestamp_class = Object.const_get(timestamp_class_name)
-                if defined?(ActiveSupport::TimeWithZone) && timestamp_class <= ActiveSupport::TimeWithZone
+                timestamp_class = if TIMESTAMP_CLASS_NAMES.include?(timestamp_class_name)
+                  Object.const_get(timestamp_class_name, false)
+                end
+                if defined?(ActiveSupport::TimeWithZone) && timestamp_class_name == ActiveSupport::TimeWithZone.name
                   zone_name, timestamp_s = timestamp_args
                   zone = ActiveSupport::TimeZone[zone_name]
                   raise "Zone #{zone_name} not found, unable to deserialize" unless zone
                   zone.strptime(timestamp_s, TIMESTAMP_FORMAT)
-                else
+                elsif timestamp_class
                   timestamp_s = timestamp_args.first
                   timestamp_class.strptime(timestamp_s, TIMESTAMP_FORMAT)
+                else
+                  raise ArgumentError, "Unsupported timestamp class: #{timestamp_class_name.inspect}"
                 end
               when OPEN_STRUCT_KEY
                 ostruct_values = load_value(value[OPEN_STRUCT_KEY])

data/lib/graphql/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module GraphQL
-  VERSION = "2.6.7"
+  VERSION = "2.6.9"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: graphql
 version: !ruby/object:Gem::Version
-  version: 2.6.7
+  version: 2.6.9
 platform: ruby
 authors:
 - Robert Mosolgo
 bindir: bin
 cert_chain: []
-date: 2026-07-28 00:00:00.000000000 Z
+date: 2026-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64