Update module github.com/vektah/gqlparser/v2 to v2.5.14 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/vektah/gqlparser/v2	v2.5.10 → v2.5.14

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

gqlparser denial of service vulnerability via the parserDirectives function

CVE-2023-49559 / GHSA-2hmf-46v7-v6fx

More information

Details

An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-49559
• https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1
• https://github.com/99designs/gqlgen/issues/3118
• https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977
• https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316
• https://github.com/advisories/GHSA-2hmf-46v7-v6fx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vektah/gqlparser (github.com/vektah/gqlparser/v2)

v2.5.14

Compare Source

What's Changed

• Add ParseQueryWithLimit by @​StevenACoffman in #​304

Full Changelog: vektah/gqlparser@v2.5.13...v2.5.14

v2.5.13

Compare Source

What's Changed

• Bump the actions-deps group in /validator/imported with 6 updates by @​dependabot in #​298
• Bump prettier from 3.2.5 to 3.3.0 in /validator/imported in the actions-deps group by @​dependabot in #​299
• Bump the actions-deps group in /validator/imported with 7 updates by @​dependabot in #​301
• Bump braces from 3.0.2 to 3.0.3 in /validator/imported by @​dependabot in #​302
• Token limit fix CVE-2023-49559 by @​uvzz in #​291

New Contributors

• @​uvzz made their first contribution in #​291

Full Changelog: vektah/gqlparser@v2.5.12...v2.5.13

v2.5.12

Compare Source

What's Changed

• Disallow empty parens (#​292). by @​yuchenshi in #​293
• WithBuiltin FormatterOption added by @​atzedus in #​294
• Redo github actions by @​StevenACoffman in #​295
• Bump github.com/stretchr/testify from 1.4.0 to 1.9.0 in the actions-deps group by @​dependabot in #​296
• Bump the actions-deps group in /validator/imported with 8 updates by @​dependabot in #​297

New Contributors

• @​yuchenshi made their first contribution in #​293

Full Changelog: vektah/gqlparser@v2.5.11...v2.5.12

v2.5.11

Compare Source

What's Changed

• Bump get-func-name from 2.0.0 to 2.0.2 in /validator/imported by @​dependabot in #​284
• Bump @​babel/traverse from 7.22.6 to 7.23.2 in /validator/imported by @​dependabot in #​285
• Fix description formatting (possible " character) by @​blmhemu in #​289
• gqlerror: implement List.Unwrap by @​emersion in #​290

New Contributors

• @​blmhemu made their first contribution in #​289
• @​emersion made their first contribution in #​290

Full Changelog: vektah/gqlparser@v2.5.10...v2.5.11

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/stretchr/testify	v1.8.4 -> v1.9.0
github.com/stretchr/objx	v0.5.0 -> v0.5.2

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/stretchr/testify	v1.8.4 -> v1.9.0
github.com/stretchr/objx	v0.5.0 -> v0.5.2