Contrib.social

Possible break of Thunder GraphQL schema with drupal/graphql:4.6.0

Open on Drupal.org →
Created on 13 November 2023, about 1 year ago
Updated 16 May 2024, 6 months ago

Problem/Motivation

With recent security fixes in drupal/graphql module 4.6.0 there could be a breaking change with defined Thunder GraphQL schema.

The https://www.drupal.org/sa-contrib-2023-050 → for drupal/graphql change its entity label dataproducer in a way, that when user do not have access to an entity it is also not showing its entity label anymore to such user and fall back to NULL. This is currently not allowed with defined Thunder GraphQL schema and could produce fatal errors in your GraphQL based applications.

Steps to reproduce

  1. Update to drupal/graphql:4.6.0 or higher
  2. Add an unpublished channel taxonomy_term entity
  3. Add a published article which is using this unpublished channel taxonomy_term entity via field_channel
  4. Request data of article with channel information as non-logged-in user via GraphQL

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Fixed

Version

7.1

Component

Code

Created by

🇩🇪Germany IT-Cru Munich

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024