Skip to content

HotChocolate.Language 13.9.14 vulnerability in EntityGraphQL 5.7.1 #512

Closed

Description

@samyonr

https://www.nuget.org/packages/HotChocolate.Language/13.9.14:

This package has at least one vulnerability with critical severity. It may lead to specific problems in your project. Try updating the package version.

GHSA-qr3m-xw4c-jqw3

ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents

I know that in here: 6f3b018#diff-df78dacd21d69c60c0de17015d3681d48b98ddf3810c16cbab712c1ea2b46f0e you've already removed the dependency from 13.9.14, but there's no version release yet.

For now, I've added <PackageReference Include="HotChocolate.Language" Version="13.9.16" /> directly to my project to overcome that vulnerability. I think it's worth releasing 5.7.2 with HotChocolate.Language 13.9.16 until version 6 is ready.

Activity

  1. added a commit that references this issue on Apr 20, 2026
  2. lukemurray commented on Apr 20, 2026

    @lukemurray
    Collaborator

    Thanks have pushed a release

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions