May 26, 2026

graphql-modules@3.1.2

Patch Changes

• #2607 3274c04 Thanks @renovate! - dependencies updates:

  • Updated dependency ramda@^0.31.0 ↗︎ (from ^0.30.0, in dependencies)

• #2626 68c2cb4 Thanks @renovate! - dependencies updates:

  • Updated dependency @graphql-tools/wrap@^11.0.0 ↗︎ (from ^10.0.0, in dependencies)

• #2642 dac3288 Thanks @renovate! - dependencies updates:

  • Updated dependency ramda@^0.32.0 ↗︎ (from ^0.31.0, in dependencies)

• #2681 8ed0406 Thanks @dotansimha! - Fix memory leak: per-operation context was retained forever when any long-lived async resource (a global setTimeout/setInterval, a telemetry exporter, undici's module-scoped timer, …) snapshotted the current AsyncContextFrame during execution. Since nodejs/node#48528, every async resource scheduled inside an AsyncLocalStorage.run(...) captures a kAsyncContextFrame snapshot, and the value stored in our internal AsyncLocalStorage was a pair of closures that captured context — so the snapshot pinned the entire operation context (potentially multiple MBs).

  The fix routes every per-operation reference to context through a mutable holder (refs.context / refs.appContext). sharedContext (exposed as env.context) and the cached CONTEXT injector value are now getter-based views over refs.context instead of shallow spreads, so they hold no user data of their own. ɵdestroy only nulls the holder slots — public-facing identities (env.context, ɵinjector) stay intact and continue to work, but the heavy user payload becomes unreachable from the (still-pinned) closure scope.

• #2681 8ed0406 Thanks @dotansimha! - Fix @ExecutionContext() leaking across concurrent controller-backed operations: in createExecution/createSubscription the controller branch called perform(options.controller) directly, skipping runWithContext, so reads after an await fell through to the shared appInjector getter and resolved to the most recently created operation's context.

  The controller now exposes its runWithContext as ɵrunWithContext and both execution paths wrap perform in it, giving controller-backed executions the same per-operation ALS isolation the non-controller path already had.