Bump @graphql-tools/executor-legacy-ws from 1.1.26 to 1.1.37

[dependabot]

Bumps @graphql-tools/executor-legacy-ws from 1.1.26 to 1.1.37.

Changelog

Sourced from @​graphql-tools/executor-legacy-ws's changelog.

1.1.37

Patch Changes

• Updated dependencies [19f5b33]:
  • @​graphql-tools/utils@​12.0.3

1.1.36

Patch Changes

• #8480 c2f226e Thanks @​ardatan! - Security: Isolate legacy GraphQL WebSocket executions on a shared buildWSLegacyExecutor().

  A single executor reused across callers kept extensions.connectionParams for the lifetime of the closure and installed one websocket.onmessage handler. A later request could be authenticated with a previous caller's connection_init payload (GHSA-434m-5hcj-pxf3, CWE-613), and an overlapping subscription could receive another operation's data frames because the handler ignored the protocol operation id (GHSA-mp66-8ww2-pcwm, CWE-200).

  Corrected behavior

  • Each execution opens its own socket. connection_init is built from the executor's base connectionParams plus that request's extensions.connectionParams only.
  • data, error, and complete frames are delivered only when id matches the operation that socket started.
  • Operation ids are no longer Date.now().

• Updated dependencies [b1fbba2, 20d36a5]:

  • @​graphql-tools/utils@​12.0.2

1.1.35

Patch Changes

• #8426 3831a06 Thanks @​ardatan! - Security: Enable TLS certificate validation by default for legacy GraphQL WebSocket (graphql-ws protocol) connections over wss://.

  buildWSLegacyExecutor() previously hardcoded rejectUnauthorized: false, so Node.js clients accepted any certificate (including self-signed or attacker-controlled ones). Credentials in connectionParams / headers and subscription payloads could be exposed to a network MITM. This addresses GHSA-6fw5-9hq8-w87g (CWE-295).

  Corrected behavior

  • Default is now rejectUnauthorized: true (Node TLS verifies the peer certificate), matching secure-by-default expectations.
  • Connections to endpoints with untrusted/self-signed certificates will fail unless you opt out.

  Opt-out (trusted / local self-signed only)

  buildWSLegacyExecutor(url, WebSocket, {
    rejectUnauthorized: false,
    connectionParams: { /* ... */ },
  })

  Or via UrlLoader / LoadFromUrlOptions when subscriptionsProtocol is LEGACY_WS:

  {
    subscriptionsProtocol: SubscriptionProtocol.LEGACY_WS,
    rejectUnauthorized: false,

... (truncated)

Commits

• 944121e Upcoming Release Changes (#8483)
• 3a43b4b Upcoming Release Changes (#8460)
• c2f226e fix(executor-legacy-ws): isolate per-request auth and subscription results (#...
• 01167f3 chore(release): update monorepo packages versions (#8427)
• 3831a06 fix(executor-legacy-ws): enable TLS cert validation by default (GHSA-6fw5-9hq...
• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
• 9feabd9 chore(release): update monorepo packages versions (#8327)
• 07cd760 build(deps): bump the actions-deps group across 1 directory with 7 updates (#...
• 755d699 build(deps): bump the actions-deps group with 4 updates (#8353)
• Additional commits viewable in compare view