GraphQL Java 24.4

Last reviewed Sep 9, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 11110 lines · 4.6K tokens
  2. GraphQL Java 24.488 lines · 3.1K tokens
Total198 lines · 7.7K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 90
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 323
  • 327
  • 338
  • 347
  • 352
  • 354
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 494
  • 502
  • 532
  • 611
  • 613
  • 639
  • 653
  • 732
  • 770
  • 772
  • 776
  • 807
  • 829
  • 862
  • 863
  • 916
  • 918
  • 922

Prompt Preview

Apply the Java 11 baseline first. GraphQL Java 24.4 is the current bugfix release of the 24 line, builds and tests on JDK 11, ships Java 11 bytecode, and depends on java-dataloader 5.0.3. These rules cover the 24 line's built-in controls and required application protections. When Spring for GraphQL serves this line, also apply the Spring Boot 3.5 prompt for resource-server token validation.

Version scope and dependencies

  • Pin com.graphql-java:graphql-java:24.4 exactly and rebuild for each new 24 bugfix, because backports to the 24 line arrive as fresh patch releases rather than in-place fixes.
  • Do not deploy the 23 line; the maintainers warned against 23.x because DataLoader 4 kept mutative DataLoaderOptions setters that silently stopped taking effect at runtime.
  • Configure DataLoaderOptions through its builder only, since java-dataloader 5.0.0 removed those setters so that stale mutative code now fails at compile time.
  • Re-run your limit and batching tests after any GraphQL Java or transitive bump, because the ANTLR runtime is shaded into GraphQL Java and the DataLoader dispatch path can change loader behavior.
  • Review the project advisory list before adopting a release; the normalized-field denial-of-service fix first landed in 19.11, 20.9, and 21.5 and is included in 24.4.

Parser and document limits

  • Set JVM-wide ParserOptions during trusted startup rather than per request; the 24.4 operation defaults allow 1,048,576 UTF-16 code units, 15,000 grammar tokens, 200,000 whitespace tokens, rule depth 500, and 100-character numeric literals.
  • Lower