@depup/graphql-tools__delegate 12.1.3-depup.0 → 12.1.4-depup.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +5 -5
  2. package/changes.json +4 -4
  3. package/dist/index.cjs +20 -1
  4. package/dist/index.d.cts +10 -1
  5. package/dist/index.d.ts +10 -1
  6. package/dist/index.js +20 -2
  7. package/package.json +10 -10
package/README.md CHANGED
@@ -13,8 +13,8 @@ npm install @depup/graphql-tools__delegate
13
13
 
14
14
  | Field | Value |
15
15
  |-------|-------|
16
- | Original | [@graphql-tools/delegate](https://www.npmjs.com/package/@graphql-tools/delegate) @ 12.1.3 |
17
- | Processed | 2026-09-03 |
16
+ | Original | [@graphql-tools/delegate](https://www.npmjs.com/package/@graphql-tools/delegate) @ 12.1.4 |
17
+ | Processed | 2026-09-08 |
18
18
  | Smoke test | passed |
19
19
  | Deps updated | 4 |
20
20
 
@@ -22,9 +22,9 @@ npm install @depup/graphql-tools__delegate
22
22
 
23
23
  | Dependency | From | To |
24
24
  |------------|------|-----|
25
- | @graphql-tools/executor | ^1.4.13 | ^2.0.0 |
26
- | @graphql-tools/schema | ^10.0.29 | ^10.1.0 |
27
- | @graphql-tools/utils | ^11.0.0 | ^12.0.0 |
25
+ | @graphql-tools/executor | ^1.4.13 | ^2.0.1 |
26
+ | @graphql-tools/schema | ^10.0.29 | ^10.1.1 |
27
+ | @graphql-tools/utils | ^11.0.0 | ^12.0.1 |
28
28
  | @repeaterjs/repeater | ^3.0.6 | ^3.1.0 |
29
29
 
30
30
  ---
package/changes.json CHANGED
@@ -2,21 +2,21 @@
2
2
  "bumped": {
3
3
  "@graphql-tools/executor": {
4
4
  "from": "^1.4.13",
5
- "to": "^2.0.0"
5
+ "to": "^2.0.1"
6
6
  },
7
7
  "@graphql-tools/schema": {
8
8
  "from": "^10.0.29",
9
- "to": "^10.1.0"
9
+ "to": "^10.1.1"
10
10
  },
11
11
  "@graphql-tools/utils": {
12
12
  "from": "^11.0.0",
13
- "to": "^12.0.0"
13
+ "to": "^12.0.1"
14
14
  },
15
15
  "@repeaterjs/repeater": {
16
16
  "from": "^3.0.6",
17
17
  "to": "^3.1.0"
18
18
  }
19
19
  },
20
- "timestamp": "2026-09-03T16:09:43.022Z",
20
+ "timestamp": "2026-09-08T00:32:22.102Z",
21
21
  "totalUpdated": 4
22
22
  }
package/dist/index.cjs CHANGED
@@ -75,6 +75,22 @@ const prototypePollutingKeys = [
75
75
  function isPrototypePollutingKey(key) {
76
76
  return prototypePollutingKeys.includes(key);
77
77
  }
78
+ function removePrototypePollutingKeys(value) {
79
+ if (Array.isArray(value)) {
80
+ for (const item of value) {
81
+ removePrototypePollutingKeys(item);
82
+ }
83
+ } else if (value && typeof value === "object" && !(value instanceof Error)) {
84
+ for (const key of Object.keys(value)) {
85
+ if (isPrototypePollutingKey(key)) {
86
+ delete value[key];
87
+ } else {
88
+ removePrototypePollutingKeys(value[key]);
89
+ }
90
+ }
91
+ }
92
+ return value;
93
+ }
78
94
 
79
95
  const leftOverByDelegationPlan = /* @__PURE__ */ new WeakMap();
80
96
  const PLAN_LEFT_OVER = Symbol("PLAN_LEFT_OVER");
@@ -188,7 +204,9 @@ function handleResolverResult(resolverResult, subschema, selectionSet, object, c
188
204
  continue;
189
205
  }
190
206
  const existingPropValue = object[responseKey];
191
- const sourcePropValue = resolverResult[responseKey];
207
+ const sourcePropValue = removePrototypePollutingKeys(
208
+ resolverResult[responseKey]
209
+ );
192
210
  if (responseKey === "__typename" && existingPropValue !== sourcePropValue && graphql.isAbstractType(subschema.transformedSchema.getType(sourcePropValue))) {
193
211
  continue;
194
212
  }
@@ -3564,5 +3582,6 @@ exports.isSubschema = isSubschema;
3564
3582
  exports.isSubschemaConfig = isSubschemaConfig;
3565
3583
  exports.leftOverByDelegationPlan = leftOverByDelegationPlan;
3566
3584
  exports.mergeFields = mergeFields;
3585
+ exports.removePrototypePollutingKeys = removePrototypePollutingKeys;
3567
3586
  exports.resolveExternalValue = resolveExternalValue;
3568
3587
  exports.subtractSelectionSets = subtractSelectionSets;
package/dist/index.d.cts CHANGED
@@ -235,7 +235,16 @@ declare const getTypeInfoWithType: (schema: GraphQLSchema, type: Maybe<GraphQLTy
235
235
  declare const prototypePollutingKeys: readonly ["__proto__", "constructor", "prototype"];
236
236
  type PrototypePollutingKey = (typeof prototypePollutingKeys)[number];
237
237
  declare function isPrototypePollutingKey(key: string): key is PrototypePollutingKey;
238
+ /**
239
+ * Removes prototype polluting keys from the given value, in place and at every depth.
240
+ *
241
+ * Response data coming from a subgraph can contain keys such as `__proto__` or
242
+ * `constructor` when the client aliases a field to one of those names. Deep merging
243
+ * such data walks the prototype chain and can end up writing to `Object.prototype` or
244
+ * `Function.prototype`, so the keys are dropped before any merge happens.
245
+ */
246
+ declare function removePrototypePollutingKeys<T>(value: T): T;
238
247
 
239
248
  declare const handleOverrideByDelegation: (info: GraphQLResolveInfo$1, context: any, overrideHandler: OverrideHandler) => boolean;
240
249
 
241
- export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, type OverrideHandler, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
250
+ export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, type OverrideHandler, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, removePrototypePollutingKeys, resolveExternalValue, subtractSelectionSets };
package/dist/index.d.ts CHANGED
@@ -235,7 +235,16 @@ declare const getTypeInfoWithType: (schema: GraphQLSchema, type: Maybe<GraphQLTy
235
235
  declare const prototypePollutingKeys: readonly ["__proto__", "constructor", "prototype"];
236
236
  type PrototypePollutingKey = (typeof prototypePollutingKeys)[number];
237
237
  declare function isPrototypePollutingKey(key: string): key is PrototypePollutingKey;
238
+ /**
239
+ * Removes prototype polluting keys from the given value, in place and at every depth.
240
+ *
241
+ * Response data coming from a subgraph can contain keys such as `__proto__` or
242
+ * `constructor` when the client aliases a field to one of those names. Deep merging
243
+ * such data walks the prototype chain and can end up writing to `Object.prototype` or
244
+ * `Function.prototype`, so the keys are dropped before any merge happens.
245
+ */
246
+ declare function removePrototypePollutingKeys<T>(value: T): T;
238
247
 
239
248
  declare const handleOverrideByDelegation: (info: GraphQLResolveInfo$1, context: any, overrideHandler: OverrideHandler) => boolean;
240
249
 
241
- export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, type OverrideHandler, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
250
+ export { type BatchingOptions, type CreateProxyingResolverFn, type Deferred, type DelegationContext, type DelegationPlanBuilder, type DelegationPlanLeftOver, EMPTY_OBJECT, type ExternalObject, FIELD_SUBSCHEMA_MAP_SYMBOL, type ICreateProxyingResolverOptions, type ICreateRequest, type IDelegateRequestOptions, type IDelegateToSchemaOptions, type MergedFieldConfig, type MergedTypeConfig, type MergedTypeEntryPoint, type MergedTypeInfo, type MergedTypeResolver, type MergedTypeResolverOptions, OBJECT_SUBSCHEMA_SYMBOL, type OverrideHandler, PLAN_LEFT_OVER, type RequestTransform, type ResultTransform, type SchemaTransform, type StitchingInfo, Subschema, type SubschemaConfig, type Transform, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, removePrototypePollutingKeys, resolveExternalValue, subtractSelectionSets };
package/dist/index.js CHANGED
@@ -75,6 +75,22 @@ const prototypePollutingKeys = [
75
75
  function isPrototypePollutingKey(key) {
76
76
  return prototypePollutingKeys.includes(key);
77
77
  }
78
+ function removePrototypePollutingKeys(value) {
79
+ if (Array.isArray(value)) {
80
+ for (const item of value) {
81
+ removePrototypePollutingKeys(item);
82
+ }
83
+ } else if (value && typeof value === "object" && !(value instanceof Error)) {
84
+ for (const key of Object.keys(value)) {
85
+ if (isPrototypePollutingKey(key)) {
86
+ delete value[key];
87
+ } else {
88
+ removePrototypePollutingKeys(value[key]);
89
+ }
90
+ }
91
+ }
92
+ return value;
93
+ }
78
94
 
79
95
  const leftOverByDelegationPlan = /* @__PURE__ */ new WeakMap();
80
96
  const PLAN_LEFT_OVER = Symbol("PLAN_LEFT_OVER");
@@ -188,7 +204,9 @@ function handleResolverResult(resolverResult, subschema, selectionSet, object, c
188
204
  continue;
189
205
  }
190
206
  const existingPropValue = object[responseKey];
191
- const sourcePropValue = resolverResult[responseKey];
207
+ const sourcePropValue = removePrototypePollutingKeys(
208
+ resolverResult[responseKey]
209
+ );
192
210
  if (responseKey === "__typename" && existingPropValue !== sourcePropValue && isAbstractType(subschema.transformedSchema.getType(sourcePropValue))) {
193
211
  continue;
194
212
  }
@@ -3525,4 +3543,4 @@ function subtractSelectionSets(selectionSetA, selectionSetB, fragments = {}) {
3525
3543
  };
3526
3544
  }
3527
3545
 
3528
- export { EMPTY_OBJECT, FIELD_SUBSCHEMA_MAP_SYMBOL, OBJECT_SUBSCHEMA_SYMBOL, PLAN_LEFT_OVER, Subschema, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, resolveExternalValue, subtractSelectionSets };
3546
+ export { EMPTY_OBJECT, FIELD_SUBSCHEMA_MAP_SYMBOL, OBJECT_SUBSCHEMA_SYMBOL, PLAN_LEFT_OVER, Subschema, Transformer, UNPATHED_ERRORS_SYMBOL, annotateExternalObject, applySchemaTransforms, cloneSubschemaConfig, createRequest, defaultMergedResolver, delegateRequest, delegateToSchema, extractUnavailableFields, extractUnavailableFieldsFromSelectionSet, getActualFieldNodes, getDelegatingOperation, getPlanLeftOverFromParent, getSubschema, getTypeInfo, getTypeInfoWithType, getUnpathedErrors, handleOverrideByDelegation, handleResolverResult, isExternalObject, isPrototypePollutingKey, isSubschema, isSubschemaConfig, leftOverByDelegationPlan, mergeFields, removePrototypePollutingKeys, resolveExternalValue, subtractSelectionSets };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@depup/graphql-tools__delegate",
3
- "version": "12.1.3-depup.0",
3
+ "version": "12.1.4-depup.0",
4
4
  "type": "module",
5
5
  "description": "A set of utils for faster development of GraphQL tools (with updated dependencies)",
6
6
  "repository": {
@@ -39,10 +39,10 @@
39
39
  "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0"
40
40
  },
41
41
  "dependencies": {
42
- "@graphql-tools/batch-execute": "^10.0.9",
43
- "@graphql-tools/executor": "^2.0.0",
44
- "@graphql-tools/schema": "^10.1.0",
45
- "@graphql-tools/utils": "^12.0.0",
42
+ "@graphql-tools/batch-execute": "^10.1.0",
43
+ "@graphql-tools/executor": "^2.0.1",
44
+ "@graphql-tools/schema": "^10.1.1",
45
+ "@graphql-tools/utils": "^12.0.1",
46
46
  "@repeaterjs/repeater": "^3.1.0",
47
47
  "@whatwg-node/promise-helpers": "^1.3.2",
48
48
  "dataloader": "^2.2.3",
@@ -66,15 +66,15 @@
66
66
  "changes": {
67
67
  "@graphql-tools/executor": {
68
68
  "from": "^1.4.13",
69
- "to": "^2.0.0"
69
+ "to": "^2.0.1"
70
70
  },
71
71
  "@graphql-tools/schema": {
72
72
  "from": "^10.0.29",
73
- "to": "^10.1.0"
73
+ "to": "^10.1.1"
74
74
  },
75
75
  "@graphql-tools/utils": {
76
76
  "from": "^11.0.0",
77
- "to": "^12.0.0"
77
+ "to": "^12.0.1"
78
78
  },
79
79
  "@repeaterjs/repeater": {
80
80
  "from": "^3.0.6",
@@ -83,8 +83,8 @@
83
83
  },
84
84
  "depsUpdated": 4,
85
85
  "originalPackage": "@graphql-tools/delegate",
86
- "originalVersion": "12.1.3",
87
- "processedAt": "2026-09-03T16:09:50.247Z",
86
+ "originalVersion": "12.1.4",
87
+ "processedAt": "2026-09-08T00:32:30.879Z",
88
88
  "smokeTest": "passed"
89
89
  }
90
90
  }