Graphene 3.4

Apply the Python 3 prompt first. These rules cover the Graphene 3.4 line with graphql-core 3.2 and were checked against Graphene 3.4.3. Graphene's tagged classifiers and test matrix cover Python 3.8–3.13; choose a maintained interpreter within that range and verify the complete stack before adopting a newer Python. Apply the chosen web framework and ORM adapter's controls separately: Graphene core supplies neither an HTTP/WebSocket server nor authentication, CSRF protection, or database transactions.

Version and schema boundary

• Keep graphql-core on its 3.2 line, the newest line Graphene's declared >=3.1,<3.3 range allows and one graphql-core still patches, and refresh it in the lock file whenever you change Graphene, because that range also admits graphql-core releases with published parser and validation denial-of-service flaws. Keep the standard validation rules enabled, including OverlappingFieldsCanBeMergedRule, which the specification requires, and don't raise MAX_FIELD_COMPARISONS in graphql.validation.rules.overlapping_fields_can_be_merged. Keep graphql-relay within Graphene's declared >=3.1,<3.3 range.
• On graphql-core 3.1.0 through 3.2.11, which predate the 3.2.12 fix for both flaws, overlapping-field validation has no comparison budget, and max_tokens, where it exists, doesn't count comments, so a highly compressible document a few kilobytes long on the wire can pin a worker for minutes or inflate memory. On those releases, cap the decompressed document at the size of your largest real operation before parse() and validate() run.