fix(deps): update dependency com.graphql-java:graphql-java to v17.6

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
com.graphql-java:graphql-java	17.2 -> 17.6

---

Release Notes

graphql-java/graphql-java (com.graphql-java:graphql-java)

v17.6: 17.6

Compare Source

This is a security bugfix release containing only one PR: #​3160

This adds a limit to the number of characters used in an operation.

Full details can be found here: #​3148

What's Changed

• Backport max chars fix to v17 by @​dondonz in https://github.com/graphql-java/graphql-java/pull/3160

Full Changelog: graphql-java/graphql-java@v17.5...v17.6

v17.5: 17.5

Compare Source

This is a security bugfix release containing only one PR: #​3139

This adds a limit to the depth of grammar rules, to prevent stack overflow.

Full details can be found here: #​3112

What's Changed

• Backported deep DOS parse attack into 17.x branch by @​bbakerman in https://github.com/graphql-java/graphql-java/pull/3139

Full Changelog: graphql-java/graphql-java@v17.4...v17.5

v17.4: 17.4

Compare Source

This is a security bugfix release containing only one PR: https://github.com/graphql-java/graphql-java/pull/2902

GraphQL Java has a max token limit per request preventing DOS attacks. But in some circumstances it was not enough to prevent malicious requests. This release fixes this problem.

All details can be found here: https://github.com/graphql-java/graphql-java/pull/2892

v17.3: 17.3

Compare Source

This bug fix version of graphql-java provides new limits to help prevent Denial Of Service attacks induced by over parsing and validation.

Attackers can craft queries that consume lot of resources to parse and validate, which which ultimately invalid can deny real queries from being serviced.

https://github.com/graphql-java/graphql-java/pull/2549

https://github.com/graphql-java/graphql-java/pull/2553

There are new limits imposed by default. Parsing will be terminated after 1500 tokens and only 100 validation errors will be captured.

We chose to put in defaults so that people will get some amount of bad query parse and validate DOS protection out of the box.

There are JVM wide methods to change the default on these if that's problematic for your implementation.

There is also a small fix in the ValueResolver

graphql-java/graphql-java@8530366

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.