Skip to Content
GraphQL Tools
ChangelogsExecutorslegacy-ws

@graphql-tools/executor-legacy-ws

2.0.1

Patch Changes

  • Updated dependencies [15efe55]:
    • @graphql-tools/utils@13.0.1

2.0.0

Major Changes

  • #8515  1d70c62 Thanks @ardatan ! - Drop GraphQL v14/v15 support and require Node.js >= 22.18.

    • graphql peer range is now ^16.0.0 || ^17.0.0.
    • engines.node is now >=22.18.0 (Node fs.glob + Babel 8).
    • Dev tooling and @graphql-tools/graphql-tag-pluck move to Babel 8 (@babel/core / parser / traverse / types).
    • The standalone cross-inspect package is discontinued. Use inspect from @graphql-tools/utils instead (Node util.inspect via process.getBuiltinModule, with a small JSON.stringify / String fallback).

    Removed @graphql-tools/utils exports

    RemovedUse instead
    getArgumentValuesimport { getArgumentValues } from 'graphql'
    coerceInputs / graphqlJSCompatgraphql@16+ APIs (getArgumentValues, etc.)
    createDeferred / createDeferredPromiseconst { promise, resolve, reject } = Promise.withResolvers()
    createGraphQLErrornew GraphQLError(message, options) from graphql
    mapMaybePromisehandleMaybePromise from @whatwg-node/promise-helpers
    isPromise / fakePromise / mapAsyncIterator / MaybePromise@whatwg-node/promise-helpers
    registerAbortSignalListener / getAbortPromiseAbortSignal APIs (throwIfAborted, addEventListener('abort', …, { once: true }), AbortSignal.any, …)
    withCancel / getAsyncIterableWithCancel / getAsyncIteratorWithCancelHandle cancellation on the async iterator’s return() (or your transport abort path)
    debugTimerStart / debugTimerEndYour own timing / console.time if needed
    PromiseWithResolvers (type)Built-in PromiseWithResolvers<T> / return type of Promise.withResolvers()

    inspect and the WeakMap memoize1…memoize2of5 helpers remain on @graphql-tools/utils (inspect is no longer re-exported from cross-inspect).

    File matching (globby → fs.glob)

    Loaders and @graphql-tools/load-files now use Node’s fs.glob through:

    import { matchFiles, matchFilesSync } from '@graphql-tools/load-files';

    Directory symlinks are followed for recursive (**) patterns:

    • On Node.js ≥26.1 (and ≥24.16 where backported), fs.glob followSymlinks is used.
    • On older engines, symlink directories are discovered only under each pattern’s literal prefix (not the whole cwd) and patterns are re-rooted.
    • Non-recursive / literal patterns skip the symlink walk entirely.

    @graphql-tools/executor hot-path caches (collectSubfields, argument coercion, @stream detection) use memoize2 / memoize3 from utils. collectSubFields in utils stays unmemoized so the executor can own a single memoize3 layer.

    Errors and other cleanup

    • Prefer new GraphQLError(message, options) from graphql. Experimental schema coordinate support remains on locatedError / relocatedError / getSchemaCoordinate.
    • Removed GraphQL versions older than 16 compatibility branches (error construction, validation rule name suffixes, URL.canParse fallback).
    • Promise helpers should be imported from @whatwg-node/promise-helpers (handleMaybePromise, isPromise, fakePromise, mapAsyncIterator, MaybePromise) rather than re-exported from utils.

Patch Changes

1.1.39

Patch Changes

1.1.38

Patch Changes

1.1.37

Patch Changes

  • Updated dependencies [19f5b33]:
    • @graphql-tools/utils@12.0.3

1.1.36

Patch Changes

  • #8480  c2f226e Thanks @ardatan ! - Security: Isolate legacy GraphQL WebSocket executions on a shared buildWSLegacyExecutor().

    A single executor reused across callers kept extensions.connectionParams for the lifetime of the closure and installed one websocket.onmessage handler. A later request could be authenticated with a previous caller’s connection_init payload (GHSA-434m-5hcj-pxf3 , CWE-613), and an overlapping subscription could receive another operation’s data frames because the handler ignored the protocol operation id (GHSA-mp66-8ww2-pcwm , CWE-200).

    Corrected behavior

    • Each execution opens its own socket. connection_init is built from the executor’s base connectionParams plus that request’s extensions.connectionParams only.
    • data, error, and complete frames are delivered only when id matches the operation that socket started.
    • Operation ids are no longer Date.now().

  • Updated dependencies [b1fbba2, 20d36a5]:

    • @graphql-tools/utils@12.0.2

1.1.35

Patch Changes

  • #8426  3831a06 Thanks @ardatan ! - Security: Enable TLS certificate validation by default for legacy GraphQL WebSocket (graphql-ws protocol) connections over wss://.

    buildWSLegacyExecutor() previously hardcoded rejectUnauthorized: false, so Node.js clients accepted any certificate (including self-signed or attacker-controlled ones). Credentials in connectionParams / headers and subscription payloads could be exposed to a network MITM. This addresses GHSA-6fw5-9hq8-w87g  (CWE-295).

    Corrected behavior

    • Default is now rejectUnauthorized: true (Node TLS verifies the peer certificate), matching secure-by-default expectations.
    • Connections to endpoints with untrusted/self-signed certificates will fail unless you opt out.

    Opt-out (trusted / local self-signed only)

    buildWSLegacyExecutor(url, WebSocket, {
  rejectUnauthorized: false,
  connectionParams: { /* ... */ },
})

    Or via UrlLoader / LoadFromUrlOptions when subscriptionsProtocol is LEGACY_WS:

    {
  subscriptionsProtocol: SubscriptionProtocol.LEGACY_WS,
  rejectUnauthorized: false,
}

    Browser WebSocket clients were never affected by this flag (browsers always validate certificates).

1.1.34

Patch Changes

1.1.33

Patch Changes

1.1.32

Patch Changes

  • Updated dependencies [e90719b]:
    • @graphql-tools/utils@11.2.2

1.1.31

Patch Changes

  • Updated dependencies [615c1a2]:
    • @graphql-tools/utils@11.2.1

1.1.30

Patch Changes

  • Updated dependencies [2609c94]:
    • @graphql-tools/utils@11.2.0

1.1.29

Patch Changes

  • Updated dependencies [981d461]:
    • @graphql-tools/utils@11.1.1

1.1.28

Patch Changes

  • Updated dependencies [a4b7dce]:
    • @graphql-tools/utils@11.1.0

1.1.27

Patch Changes

  • Updated dependencies [ae36a0e]:
    • @graphql-tools/utils@11.0.1

1.1.26

Patch Changes

1.1.25

Patch Changes

1.1.24

Patch Changes

  • Updated dependencies [2118a80]:
    • @graphql-tools/utils@10.11.0

1.1.23

Patch Changes

  • Updated dependencies [2fe123a]:
    • @graphql-tools/utils@10.10.3

1.1.22

Patch Changes

  • Updated dependencies [dddc5f6]:
    • @graphql-tools/utils@10.10.2

1.1.21

Patch Changes

  • Updated dependencies [fbb58b5]:
    • @graphql-tools/utils@10.10.1

1.1.20

Patch Changes

1.1.19

Patch Changes

  • Updated dependencies [32d0457]:
    • @graphql-tools/utils@10.9.1

1.1.18

Patch Changes

  • Updated dependencies [22af985, 53db005]:
    • @graphql-tools/utils@10.9.0

1.1.17

Patch Changes

  • Updated dependencies [d123e26]:
    • @graphql-tools/utils@10.8.6

1.1.16

Patch Changes

  • Updated dependencies [90a717e, 26518de]:
    • @graphql-tools/utils@10.8.5

1.1.15

Patch Changes

  • Updated dependencies [155944b]:
    • @graphql-tools/utils@10.8.4

1.1.14

Patch Changes

  • Updated dependencies [4a2eb14]:
    • @graphql-tools/utils@10.8.3

1.1.13

Patch Changes

  • Updated dependencies [3547bba]:
    • @graphql-tools/utils@10.8.2

1.1.12

Patch Changes

  • Updated dependencies [651a5dc]:
    • @graphql-tools/utils@10.8.1

1.1.11

Patch Changes

  • Updated dependencies [0a3e193, 357b2ee]:
    • @graphql-tools/utils@10.8.0

1.1.10

Patch Changes

  • Updated dependencies [53bb601, 53bb601]:
    • @graphql-tools/utils@10.7.2

1.1.9

Patch Changes

  • Updated dependencies [4912f19]:
    • @graphql-tools/utils@10.7.1

1.1.8

Patch Changes

  • Updated dependencies [2c70d27]:
    • @graphql-tools/utils@10.7.0

1.1.7

Patch Changes

  • Updated dependencies [6a8123b]:
    • @graphql-tools/utils@10.6.4

1.1.6

Patch Changes

  • Updated dependencies [020b9e4]:
    • @graphql-tools/utils@10.6.3

1.1.5

Patch Changes

1.1.4

Patch Changes

  • Updated dependencies [1e02935]:
    • @graphql-tools/utils@10.6.1

1.1.3

Patch Changes

  • Updated dependencies [414e404]:
    • @graphql-tools/utils@10.6.0

1.1.2

Patch Changes

  • Updated dependencies [dc5043b]:
    • @graphql-tools/utils@10.5.6

1.1.1

Patch Changes

  • Updated dependencies [cf2ce5e]:
    • @graphql-tools/utils@10.5.5

1.1.0

Minor Changes

Patch Changes

  • Updated dependencies [cacf20f]:
    • @graphql-tools/utils@10.3.0

1.0.6

Patch Changes

1.0.5

Patch Changes

1.0.4

Patch Changes

1.0.3

Patch Changes

1.0.2

Patch Changes

1.0.1

Patch Changes

1.0.0

Major Changes

Patch Changes

0.0.11

Patch Changes

0.0.10

Patch Changes

0.0.9

Patch Changes

0.0.8

Patch Changes

  • Updated dependencies [b5c8f640]:
    • @graphql-tools/utils@9.2.1

0.0.7

Patch Changes

0.0.6

Patch Changes

0.0.5

Patch Changes

  • Updated dependencies [904fe770]:
    • @graphql-tools/utils@9.1.3

0.0.4

Patch Changes

  • Updated dependencies [13c24883]:
    • @graphql-tools/utils@9.1.2

0.0.3

Patch Changes

  • Updated dependencies [7411a5e7]:
    • @graphql-tools/utils@9.1.1

0.0.2

Patch Changes

0.0.1

Patch Changes

envelopurql-exchange