CVE-2021-41248

Advisory

Graphene-django 3.0.1 updates its NPM dependency 'graphiql' to v1.4.7 to fix a potential vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* Fix custom foreignkey resolvers by syrusakbary in https://github.com/graphql-python/graphene-django/pull/1361
* 👷 Add pre-commit by nikolaik in https://github.com/graphql-python/graphene-django/pull/1336
* Fix broken UT due to pytest import error by yuekui in https://github.com/graphql-python/graphene-django/pull/1368
* Clarify cookbook example READMEs by axm2 in https://github.com/graphql-python/graphene-django/pull/1360
* Update pre-commit tools by ulgens in https://github.com/graphql-python/graphene-django/pull/1364
* graphiql v1.4.7 security update by kiendang in https://github.com/graphql-python/graphene-django/pull/1382
* Remove promise based debug middleware by jaw9c in https://github.com/graphql-python/graphene-django/pull/1388
* Fix schema print with `-.graphql` by bendike in https://github.com/graphql-python/graphene-django/pull/1377
* Update GraphiQL to 2.4.1 by kiendang in https://github.com/graphql-python/graphene-django/pull/1396
* Update django-filter URL's in filtering docs by firaskafri in https://github.com/graphql-python/graphene-django/pull/1399

New Contributors
* yuekui made their first contribution in https://github.com/graphql-python/graphene-django/pull/1368
* axm2 made their first contribution in https://github.com/graphql-python/graphene-django/pull/1360
* kiendang made their first contribution in https://github.com/graphql-python/graphene-django/pull/1382
* bendike made their first contribution in https://github.com/graphql-python/graphene-django/pull/1377

**Full Changelog**: https://github.com/graphql-python/graphene-django/compare/v3.0.0...v3.0.1

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41248