[dependabot]

Bumps @graphql-tools/executor-legacy-ws from 1.1.21 to 1.1.37.

Changelog

Sourced from @​graphql-tools/executor-legacy-ws's changelog.

1.1.37

Patch Changes

• Updated dependencies [19f5b33]:
  • @​graphql-tools/utils@​12.0.3

1.1.36

Patch Changes

• #8480 c2f226e Thanks @​ardatan! - Security: Isolate legacy GraphQL WebSocket executions on a shared buildWSLegacyExecutor().

  A single executor reused across callers kept extensions.connectionParams for the lifetime of the closure and installed one websocket.onmessage handler. A later request could be authenticated with a previous caller's connection_init payload (GHSA-434m-5hcj-pxf3, CWE-613), and an overlapping subscription could receive another operation's data frames because the handler ignored the protocol operation id (GHSA-mp66-8ww2-pcwm, CWE-200).

  Corrected behavior

  • Each execution opens its own socket. connection_init is built from the executor's base connectionParams plus that request's extensions.connectionParams only.
  • data, error, and complete frames are delivered only when id matches the operation that socket started.
  • Operation ids are no longer Date.now().

• Updated dependencies [b1fbba2, 20d36a5]:

  • @​graphql-tools/utils@​12.0.2

1.1.35

Patch Changes

• #8426 3831a06 Thanks @​ardatan! - Security: Enable TLS certificate validation by default for legacy GraphQL WebSocket (graphql-ws protocol) connections over wss://.

  buildWSLegacyExecutor() previously hardcoded rejectUnauthorized: false, so Node.js clients accepted any certificate (including self-signed or attacker-controlled ones). Credentials in connectionParams / headers and subscription payloads could be exposed to a network MITM. This addresses GHSA-6fw5-9hq8-w87g (CWE-295).

  Corrected behavior

  • Default is now rejectUnauthorized: true (Node TLS verifies the peer certificate), matching secure-by-default expectations.
  • Connections to endpoints with untrusted/self-signed certificates will fail unless you opt out.

  Opt-out (trusted / local self-signed only)

  buildWSLegacyExecutor(url, WebSocket, {
    rejectUnauthorized: false,
    connectionParams: { /* ... */ },
  })

  Or via UrlLoader / LoadFromUrlOptions when subscriptionsProtocol is LEGACY_WS:

  {
    subscriptionsProtocol: SubscriptionProtocol.LEGACY_WS,
    rejectUnauthorized: false,

... (truncated)

Commits

• 944121e Upcoming Release Changes (#8483)
• 3a43b4b Upcoming Release Changes (#8460)
• c2f226e fix(executor-legacy-ws): isolate per-request auth and subscription results (#...
• 01167f3 chore(release): update monorepo packages versions (#8427)
• 3831a06 fix(executor-legacy-ws): enable TLS cert validation by default (GHSA-6fw5-9hq...
• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
• 9feabd9 chore(release): update monorepo packages versions (#8327)
• 07cd760 build(deps): bump the actions-deps group across 1 directory with 7 updates (#...
• 755d699 build(deps): bump the actions-deps group with 4 updates (#8353)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​graphql-tools/executor-legacy-ws since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[claude]

Review: lockfile-only Dependabot bump (@graphql-tools/executor-legacy-ws 1.1.21 → 1.1.37)

• Scope: only frontend/yarn.lock changes. package.json is untouched. The package is transitive (pulled in through @graphql-tools/url-loader, i.e. the GraphQL tooling chain at yarn.lock:1157), so it isn't in the app's runtime bundle.
• Security: the bump includes fixes for GHSA-6fw5-9hq8-w87g (TLS validation was off by default), GHSA-434m-5hcj-pxf3 and GHSA-mp66-8ww2-pcwm (cross-request auth and subscription frame leakage). This is worth merging.
• Behavior change: TLS verification is now on by default for wss:// in the legacy-ws executor. This only matters if a dev script or codegen introspects a self-signed wss:// endpoint. I found no such use in this repo, and codegen normally runs over HTTP against localhost.
• New transitive deps: @graphql-tools/utils@12.0.3, @whatwg-node/promise-helpers@2 and ws@8.22.0. They sit beside the existing v10 utils and ws 8.21.0, so the lockfile has some duplication. That's harmless, but yarn dedupe could trim it later.
• Tests and changelog: no code changed, so no new tests are needed. I did not run yarn install --frozen-lockfile, yarn build or codegen myself. Please confirm CI is green on those. A changelog fragment is optional for a dev-dependency bump.

LGTM once CI passes.

[claude]

Review

Overall this looks good to merge, assuming CI is green on Node 24.

What I checked

• All node-version: "20" pins in .github/workflows/ (11 occurrences across 5 files) now use "24". A grep finds no remaining Node 20 pins.
• frontend/Dockerfile and frontend/.nvmrc are updated. The .nvmrc was a stale v16.19.1, so fixing it is a real improvement.
• The lockfile change is consistent with the bump. executor-legacy-ws goes to 1.1.37 and pulls in utils@12, promise-helpers@2 and ws@8.22.0. This is a dev-only transitive of @graphql-codegen/cli.
• The changelog fragment follows the changelog.d/ convention and explains why the toolchain bump was needed.

Suggestions (non-blocking)

1. frontend/.github/workflows/playwright.yml uses node-version: lts/*. That is probably an unused leftover (GitHub only runs workflows from the root .github/). Consider deleting it or pinning it to 24 so the repo has one Node version everywhere.
2. Add an engines field ("node": ">=22.15") to frontend/package.json, or an .nvmrc check. Contributors on Node 20 would then get a clear failure instead of a confusing yarn engine error.
3. The Dockerfile uses a floating node:24-alpine tag. That is fine and matches the previous style. Check that native deps (e.g. the build's sharp/esbuild) still install on alpine with Node 24.
4. The 1.1.35 TLS change (rejectUnauthorized now defaults to true) only matters if codegen introspects a wss:// endpoint with a self-signed certificate. I saw nothing in the repo that does this, but run yarn codegen if you use it locally.

No security, test or backend concerns. The security fixes (GHSA-6fw5-9hq8-w87g, GHSA-434m-5hcj-pxf3, GHSA-mp66-8ww2-pcwm) are a good reason to take this.

[claude]

Review

Small, coherent change: a dependency bump plus the Node toolchain bump the new transitive engine requirement forces. No blocking issues.

What checks out

• Every pinned Node 20 reference I could find is updated: 5 workflows (8 setup-node steps) and frontend/Dockerfile. A repo-wide grep finds no leftover node:20 or node-version: "20".
• The engines.node >=22.15.0 field matches @whatwg-node/promise-helpers@2, so a contributor on an older Node gets a clear top-level error.
• The lockfile changes are limited to the expected new entries (utils@12.0.3, promise-helpers@2.0.0, ws@8.22.0).
• The changelog fragment follows the changelog.d/ convention and explains why no lockfile-only fix exists.
• The security fixes are relevant: TLS verification is now on by default (GHSA-6fw5-9hq8-w87g), and per-request auth and subscription isolation are fixed. The package is a dev-only transitive of @graphql-codegen/cli, so real exposure is low.
• Deleting frontend/.github/workflows/playwright.yml is correct. GitHub only runs workflows from the repo-root .github/.

Suggestions (non-blocking)

1. Pin consistency. CI, the Dockerfile and .nvmrc use floating 24, while engines says >=22.15.0. That is fine, but a CI job on a Node 24 minor that regresses would fail without any repo change. Consider documenting 24 as the supported version in the frontend docs or README if Node is mentioned there.
2. Yarn-on-24 and the Dockerfile. npm install -g yarn on Node 24 installs Yarn 1.x, which is fine for --frozen-lockfile. The node:24-alpine build is not exercised by this PR's CI, so confirm the Docker build and yarn build pass on 24 (Vite and Playwright CT should be fine, but I couldn't run them here).
3. Codegen check. Since @graphql-codegen/cli is the consumer, confirm yarn codegen (if used) still produces identical output with utils@12.
4. Dev environment. Anyone with a Node 20 or 22.0–22.14 local setup will now hit an engines error on yarn install. That is intended, but a short note in the changelog or contributor docs would help.

Tests: No application code changed. The CI frontend jobs (unit, component, E2E) running green on Node 24 is the right validation, so please wait for those before merging.

LGTM once CI is green.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!