Skip to content

25.2

Choose a tag to compare

View all tags
@andimarek andimarek released this 13 Nov 11:07
v25.2
9c1ef8a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is a dependency maintenance release for GraphQL Java 25.x to resolve security-scanner findings for CVE-2026-102554 in the bundled Guava dependency.

GraphQL Java's own request processing is not affected by this CVE. The vulnerability concerns native Java object deserialization, which GraphQL Java does not use to parse, validate, or execute GraphQL documents.

The release upgrades bundled Guava from 32.1.2-jre to 33.8.0-jre to remove the affected dependency version from the GraphQL Java JAR and address these scanner findings.

List of PRs

Full Changelog: v25.1...v25.2

Assets 2
Loading