v3.3.1

Patch-release GraphQL-core v3.3.1, based on GraphQL.js v17.0.2.

This patch-release supports Python 3.10 to 3.15.

This is a security release. It fixes a denial-of-service vulnerability in the validator. Upgrading is recommended for all users of GraphQL-core 3.3.

Security fix:

• Fixed a memory leak that could be used for a denial of service (see the security advisory). When a validation was aborted because the document had more errors than allowed by max_errors (100 by default), the same error object was raised every time. Its traceback grew with each aborted validation and kept the frames of all these validations alive, including their documents. Any client could exhaust the memory of a server by sending documents with more than 100 validation errors. Now a new error is created for every aborted validation (#287). GraphQL-core 3.2 is not affected.

Bug fixes:

• The memoization of collected subfields used the ids of objects that could be freed and reused during execution. Therefore, a field could be resolved with the selection set of another field. The cache now uses the identity of the field list like GraphQL.js and keeps the list alive during execution (#284). This was a regression in 3.3.
• Closing a subscription did not close the source iterator if the __aiter__ method of the source returned a different object, such as an async generator (#283). This was a regression in 3.3.
• Decimal, Fraction and NumPy scalar values, as returned by database drivers, ORMs and NumPy/pandas, can be serialized as Int, Float and Boolean again (#280). This was a regression in 3.3. Different from 3.2, non-integer values such as Decimal("2.5") are rejected as Int instead of being truncated.
• If input values of different types shared the same default value, e.g. after extend_schema(), the default was coerced for the type that was used first (#279). Coerced default values are now memoized on the argument or input field like in GraphQL.js. Schemas that were pickled with 3.3.0 can still be unpickled.

Behavior changes:

• A GraphQLError created while another exception is handled does not take over the traceback of that exception anymore. If the error is raised, it gets its own traceback, and the handled exception becomes its context. Errors of incremental computations and reasons of abort signals do not accumulate tracebacks anymore when they are raised repeatedly.
• validation_aborted_error has been removed from graphql.validation.validate. It was not exported.

Other changes:

• Improved performance when coercing literal arguments, and added a benchmark for executing fields with arguments.

Thanks to @riodw for reporting the memory leak and to @Fire162 for submitting a first fix (#288), to @abraira85 for reporting and analyzing the issue with the subfields and to @jadenfix for fixing it, to @patrick91 for fixing the shared default values and improving performance, to @AryanRG for fixing the subscription iterator, and to @gabor-lbl for reporting the serialization issue.

Thanks to @jkimbo for sponsoring this project.