Bump @graphql-tools/executor-legacy-ws from 1.0.6 to 1.1.38 in /backstage

[dependabot]

Bumps @graphql-tools/executor-legacy-ws from 1.0.6 to 1.1.38.

Changelog

Sourced from @​graphql-tools/executor-legacy-ws's changelog.

1.1.38

Patch Changes

• #8485 b81e412 Thanks @​dependabot! - dependencies updates:
  • Updated dependency @types/ws@^8.18.2 ↗︎ (from ^8.0.0, in dependencies)
• Updated dependencies [fd95dc9]:
  • @​graphql-tools/utils@​12.0.4

1.1.37

Patch Changes

• Updated dependencies [19f5b33]:
  • @​graphql-tools/utils@​12.0.3

1.1.36

Patch Changes

• #8480 c2f226e Thanks @​ardatan! - Security: Isolate legacy GraphQL WebSocket executions on a shared buildWSLegacyExecutor().

  A single executor reused across callers kept extensions.connectionParams for the lifetime of the closure and installed one websocket.onmessage handler. A later request could be authenticated with a previous caller's connection_init payload (GHSA-434m-5hcj-pxf3, CWE-613), and an overlapping subscription could receive another operation's data frames because the handler ignored the protocol operation id (GHSA-mp66-8ww2-pcwm, CWE-200).

  Corrected behavior

  • Each execution opens its own socket. connection_init is built from the executor's base connectionParams plus that request's extensions.connectionParams only.
  • data, error, and complete frames are delivered only when id matches the operation that socket started.
  • Operation ids are no longer Date.now().

• Updated dependencies [b1fbba2, 20d36a5]:

  • @​graphql-tools/utils@​12.0.2

1.1.35

Patch Changes

• #8426 3831a06 Thanks @​ardatan! - Security: Enable TLS certificate validation by default for legacy GraphQL WebSocket (graphql-ws protocol) connections over wss://.

  buildWSLegacyExecutor() previously hardcoded rejectUnauthorized: false, so Node.js clients accepted any certificate (including self-signed or attacker-controlled ones). Credentials in connectionParams / headers and subscription payloads could be exposed to a network MITM. This addresses GHSA-6fw5-9hq8-w87g (CWE-295).

  Corrected behavior

  • Default is now rejectUnauthorized: true (Node TLS verifies the peer certificate), matching secure-by-default expectations.
  • Connections to endpoints with untrusted/self-signed certificates will fail unless you opt out.

  Opt-out (trusted / local self-signed only)

  buildWSLegacyExecutor(url, WebSocket, {
    rejectUnauthorized: false,
    connectionParams: { /* ... */ },

... (truncated)

Commits

• 28d08e8 chore(release): update monorepo packages versions (#8486)
• b81e412 build(deps): bump the actions-deps group with 4 updates (#8485)
• 944121e Upcoming Release Changes (#8483)
• 3a43b4b Upcoming Release Changes (#8460)
• c2f226e fix(executor-legacy-ws): isolate per-request auth and subscription results (#...
• 01167f3 chore(release): update monorepo packages versions (#8427)
• 3831a06 fix(executor-legacy-ws): enable TLS cert validation by default (GHSA-6fw5-9hq...
• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
• 9feabd9 chore(release): update monorepo packages versions (#8327)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​graphql-tools/executor-legacy-ws since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.