GraphQL Java 26.1

Apply the Java 25 baseline first. These rules cover GraphQL Java 26.1 parsing, validation, execution, instrumentation, data loading, and subscriptions. When Spring for GraphQL, Quarkus, or Micronaut serves this line, also apply that framework's prompt, such as the Spring Security prompt, for token and session validation.

Parser and document limits

• Set ParserOptions during trusted startup, not per request; its default operation limits are 1,048,576 UTF-16 code units, 15,000 grammar tokens including EOF, 15,000 comment tokens counted separately, and 200,000 whitespace tokens.
• Lower the default operation grammar-rule depth of 500 and numeric-literal length of 100 for the schema's real needs.
• Configure SDL parsing separately because getDefaultSdlParserOptions() sets characters, tokens, whitespace tokens, and grammar depth to Integer.MAX_VALUE.
• Do not expose SDL parsing or schema construction to untrusted users; the JVM-wide setDefault*ParserOptions methods affect every GraphQL instance in the process.
• Keep operation parser token redaction enabled in user-facing errors; its 26.1 default is false and can echo offending token text.
• Bound HTTP request bytes and decoded variable payloads in the adapter, and cap operations per batch if it supports batching; document parser limits do not constrain these inputs.

Validation and cost controls

• Set per-request QueryComplexityLimits below the defaults of depth 100 and 100,000 fields, based on authenticated client class and operation budget; set both maxDepth and maxFieldsCount because unset