hive@11.7.2

Patch Changes

• #8166
  b1f17e2
  Thanks @AreebEhsan! - Include contract changes in the GitHub CI
  schema-check summary. Previously, a schema:check --github run on a composite/federation project
  that changed only a contract (while the core composed schema was unchanged) was reported as "No
  changes". The summary now reports the changed contracts and their changes, and "No changes" is
  only shown when neither the core schema nor any contract changed.

• #8275
  e967f76
  Thanks @jdolle! - Upgrade @theguild/federation-composition to
  support oneOf directive in public sdl

  https://github.com/graphql-hive/federation-composition/releases/tag/v0.23.3

• #8268
  7d21f6c
  Thanks @n1ru4l! - Address vulnerability
  GHSA-mv8w-475r-vwqw.

• #8268
  7d21f6c
  Thanks @n1ru4l! - Address vulnerability
  GHSA-8pvw-jcv7-9cmj and
  GHSA-83w8-p2f5-377r.

• #8256
  0727b91
  Thanks @jdolle! - Track schema composition worker memory usage; add
  to schema service dashboard

• #8262
  3925da7
  Thanks @n1ru4l! - Address vulnerabilities
  GHSA-45rx-2jwx-cxfr, and
  GHSA-c96f-x56v-gq3h.

• #7966
  477bf11
  Thanks @cosmincatalin! - Add Azure Workload Identity
  Federation support for OIDC SSO in self-hosted deployments. Enabled organizations use the
  projected Azure token as a client assertion instead of an OIDC client secret.

  For example, enable federation for an organization with:

  OIDC_WORKLOAD_FEDERATION_IDENTITY_PROVIDER=azure
  AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token
  OIDC_WORKLOAD_FEDERATION_ORGANIZATION_IDS=00000000-0000-4000-8000-000000000000

  This will effectively override the client secret configured for that organization to use the OIDC
  provider.

• #8259
  359ca59
  Thanks @jdolle! - Optimize memory for composition worker stitching
  schemas. Don't store or build the schemas if there are stitched errors