Package Health/org.springframework.graphql:spring-graphql

spring-graphql

GraphQL Support for Spring Applications

Latest 2.1.0-M1org.springframework.graphql

Maven

84%

Total Score

healthy

Healthy: active releases and strong Spring organization backing outweigh the prerelease label and workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Version stability

This is a prerelease milestone (2.1.0-M1), so compatibility may change even though the package has a stable major line and only 30% of recent releases are prereleases.

Workflow audit

All 13 workflows were analyzed with no untrusted checkout or script-injection findings, but 24 high-confidence template-injection findings and one top-level write-permission workflow are material CI hygiene concerns; the single unpinned action is only a minor issue.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-383752 spring-graphql is vulnerable to Deserialization of Untrusted Data in versions 2.0.0 - 2.0.4.	2.0.0 - 2.0.4	High
AIKIDO-2026-301335 spring-graphql is vulnerable to Denial of Service (DoS) in versions 1.2.0 - 2.0.4.	1.2.0 - 2.0.4	High
AIKIDO-2026-843860 spring-graphql is vulnerable to Information Disclosure in versions 1.0.0 - 2.0.4.	1.0.0 - 2.0.4	High
AIKIDO-2026-733044 spring-graphql is vulnerable to Denial of Service (DoS) in versions 1.3.0 - 2.0.4.	1.3.0 - 2.0.4	Medium
AIKIDO-2026-640581 spring-graphql is vulnerable to Inclusion of Functionality from Untrusted Control Sphere in versions 1.0.0 - 2.0.4.	1.0.0 - 2.0.4	High

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
com.graphql-java:graphql-java Version 26.1	—	—
io.projectreactor:reactor-core Version 3.8.7	—	—
org.springframework:spring-context Version 7.1.0-M2	—	—
io.micrometer:context-propagation Version 1.2.1	—	—