[TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression by mativm02 · Pull Request #8345 · TykTechnologies/tyk

mativm02 · 2026-06-23T13:15:41Z

Description

Bumps github.com/TykTechnologies/graphql-go-tools to pick up TykTechnologies/graphql-go-tools#447.

The bug

On a GraphQL Federation supergraph API, running a subscription (websocket) first and then a query over the same connection makes the query return null instead of data. Gateway logs show websocket upgrade for GraphQL engine failed: 'upgrade' token not found in 'Connection' header against the subgraphs. Regression introduced in 5.8.15 / 5.13.1 / 5.14.0 (clean on 5.8.14 and 5.13.0).

Root cause

The gateway tags an inbound websocket subscription request with a context value GraphQLIsWebSocketUpgrade=true. The library change in #446 (TT-17442) wrapped the subscription executor's context in a mergedContext that resolved values from that original request context, so the flag leaked into every subgraph fetch. The subgraphs then tried to perform a websocket handshake on plain HTTP fetches, which failed → null.

The fix (library #447)

The executor now builds its execution context without inheriting the original request's context values, while still forwarding the per-request header modifier — preserving TT-17442's per-user connection/credential isolation. See #447 for details and tests.

Scope

Bumps the v1 module only (v1.6.2-0.20260610093432-c7048b604e16 → v1.6.2-0.20260623130956-98d2c88fce43).
The gateway's graphql-go-tools/v2 pin predates TT-17442, so the v3/v2 engine path is not affected and is intentionally left unchanged.

Verification

go mod verify passes; internal/graphengine and apidef/adapter/... build against the new pin.

Draft — depends on graphql-go-tools#447, which is not merged yet. The version pin points at the #447 branch commit and must be re-pinned to the squash-merge commit once #447 lands.

Picks up TykTechnologies/graphql-go-tools#447, which stops the original websocket request context (including the "this request is a websocket upgrade" flag) from leaking into the engine's upstream/subgraph fetches. This fixes the regression where starting a GraphQL Federation subscription caused subsequent queries run over the websocket connection to return null data. Bumps the v1 module only; the gateway's graphql-go-tools/v2 pin predates TT-17442 and is not affected by this regression.

github-actions · 2026-06-23T13:16:38Z

🎯 Recommended Merge Targets

Based on JIRA ticket TT-17578: Starting a subscription on a Federation API breaks subsequent queries

Fix Version: Tyk 5.8.15

Required:

release-5.8.15 - Exact version branch for Tyk 5.8.15 - specific patch release
release-5.8 - Minor version branch for 5.8.x patches - required for creating Tyk 5.8.15
master - Main development branch - ensures fix is in all future releases

📋 Workflow

Merge this PR to master first
Cherry-pick to release branches by commenting on the merged PR:
- /release to release-5.8.15
- /release to release-5.8
Automated backport - The bot will automatically create backport PRs to the specified release branches

probelabs · 2026-06-23T13:16:55Z

This PR bumps the github.com/TykTechnologies/graphql-go-tools dependency to resolve a regression affecting GraphQL Federation APIs. The bug caused queries to return null if they were executed on the same websocket connection immediately after a subscription was established. The updated dependency corrects this by ensuring the execution context for subgraph requests is properly isolated, preventing a websocket upgrade flag from leaking from the initial subscription call to subsequent HTTP-based query calls.

Files Changed Analysis

The changes are confined to Go module files, confirming this is a dependency update with no direct code modifications in this repository:

go.mod: Updates the version of github.com/TykTechnologies/graphql-go-tools.
go.sum: Updates the checksums to reflect the new dependency version.

Architecture & Impact Assessment

What this PR accomplishes: Fixes a critical regression where GraphQL Federation queries fail after a subscription is initiated on the same client connection.
Key technical changes introduced: The sole change is the version bump of the graphql-go-tools library. The fix resides within the library and alters how the GraphQL execution context is propagated to subgraphs, preventing state leakage between operations.
Affected system components: This change impacts the GraphQL gateway, specifically its Federation engine's handling of sequential subscription and query operations over a single websocket connection.

Bug vs. Fix Flow

The following diagram illustrates how context leakage caused the failure and how the dependency update resolves it.

sequenceDiagram
    participant Client
    participant Tyk Gateway
    participant Subgraph

    note over Client, Subgraph: Old Behavior (Bug)
    rect rgb(255, 230, 230)
        Client->>+Tyk Gateway: 1. Subscription (WebSocket Upgrade)
        note right of Tyk Gateway: Context tagged: `isWebSocketUpgrade=true`
        Tyk Gateway-->>-Client: Subscription OK
        Client->>+Tyk Gateway: 2. Query (same connection)
        Tyk Gateway->>+Subgraph: 3. HTTP request with leaked context
        note right of Subgraph: Subgraph sees upgrade flag, fails HTTP request
        Subgraph-->>-Tyk Gateway: 4. Error
        Tyk Gateway-->>-Client: 5. `null` data
    end

    note over Client, Subgraph: New Behavior (Fix)
    rect rgb(230, 255, 230)
        Client->>+Tyk Gateway: 1. Subscription (WebSocket Upgrade)
        Tyk Gateway-->>-Client: Subscription OK
        Client->>+Tyk Gateway: 2. Query (same connection)
        Tyk Gateway->>+Subgraph: 3. HTTP request with clean context
        note right of Subgraph: Subgraph processes standard HTTP request
        Subgraph-->>-Tyk Gateway: 4. Query Data
        Tyk Gateway-->>-Client: 5. Correct data
    end

Scope Discovery & Context Expansion

The scope is narrow and well-defined. As stated in the PR description, the fix only applies to the v1 module of graphql-go-tools, which is the version line where the regression was introduced. The v2 module used elsewhere in the gateway is unaffected. The impact is isolated to the specific operational sequence (subscription then query) within a federated GraphQL setup, and the fix within the library requires no corresponding changes in the gateway's own codebase.

Metadata

Review Effort: 1 / 5
Primary Label: bug

Powered by Visor from Probelabs

Last updated: 2026-06-24T14:26:52.599Z | Triggered by: pr_updated | Commit: 4ec40ce

💡 TIP: You can chat with Visor using /visor ask <your question>

probelabs · 2026-06-23T13:17:08Z

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

Powered by Visor from Probelabs

Last updated: 2026-06-24T14:26:38.658Z | Triggered by: pr_updated | Commit: 4ec40ce

💡 TIP: You can chat with Visor using /visor ask <your question>

graphql-go-tools#447 is merged to master; pin to that master commit (dae0d8d8) which stops the original websocket request context (including the "this request is a websocket upgrade" flag) from leaking into the engine's upstream/subgraph fetches. Fixes the regression where a GraphQL Federation subscription caused subsequent queries over the websocket connection to return null. v1 module only; the gateway's graphql-go-tools/v2 pin predates TT-17442 and is not affected.

sentinelone-cnapp-eu1 · 2026-06-24T14:25:45Z

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

github-actions · 2026-06-24T14:26:12Z

🚨 Jira Linter Failed

Commit: 4ec40ce
Failed at: 2026-06-24 14:26:09 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details

failed to get Jira issue: failed to fetch Jira issue TT-17578: Issue does not exist or you do not have permission to see it.: request failed. Please analyze the request body for more details. Status code: 404

Next Steps

Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
Verify your PR title matches the branch's Jira ticket ID
Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

sonarqubecloud · 2026-06-24T14:54:43Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

mativm02 · 2026-06-24T17:35:08Z

/release to release-5.8

probelabs · 2026-06-24T17:35:36Z

⚠️ Cherry-pick encountered conflicts. A draft PR was created: #8357

…query null regression (#8345) Bumps `github.com/TykTechnologies/graphql-go-tools` to pick up **TykTechnologies/graphql-go-tools#447**. On a GraphQL Federation supergraph API, running a subscription (websocket) first and then a query over the same connection makes the query return `null` instead of data. Gateway logs show `websocket upgrade for GraphQL engine failed: 'upgrade' token not found in 'Connection' header` against the subgraphs. Regression introduced in 5.8.15 / 5.13.1 / 5.14.0 (clean on 5.8.14 and 5.13.0). The gateway tags an inbound websocket subscription request with a context value `GraphQLIsWebSocketUpgrade=true`. The library change in `mergedContext` that resolved values from that original request context, so the flag leaked into every subgraph fetch. The subgraphs then tried to perform a websocket handshake on plain HTTP fetches, which failed → `null`. The executor now builds its execution context without inheriting the original request's context values, while still forwarding the per-request header modifier — preserving TT-17442's per-user connection/credential isolation. See #447 for details and tests. - Bumps the **v1** module only (`v1.6.2-0.20260610093432-c7048b604e16` → `v1.6.2-0.20260623130956-98d2c88fce43`). - The gateway's `graphql-go-tools/v2` pin predates TT-17442, so the v3/v2 engine path is **not** affected and is intentionally left unchanged. - `go mod verify` passes; `internal/graphengine` and `apidef/adapter/...` build against the new pin. > Draft — depends on graphql-go-tools#447, which is not merged yet. The version pin points at the #447 branch commit and must be re-pinned to the squash-merge commit once #447 lands. [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ (cherry picked from commit 63316b3)

mativm02 · 2026-06-24T18:20:40Z

/release to release-5.8.15

probelabs · 2026-06-24T18:20:58Z

⚠️ Cherry-pick encountered conflicts. A draft PR was created: #8358

…query null regression (#8345) Bumps `github.com/TykTechnologies/graphql-go-tools` to pick up **TykTechnologies/graphql-go-tools#447**. On a GraphQL Federation supergraph API, running a subscription (websocket) first and then a query over the same connection makes the query return `null` instead of data. Gateway logs show `websocket upgrade for GraphQL engine failed: 'upgrade' token not found in 'Connection' header` against the subgraphs. Regression introduced in 5.8.15 / 5.13.1 / 5.14.0 (clean on 5.8.14 and 5.13.0). The gateway tags an inbound websocket subscription request with a context value `GraphQLIsWebSocketUpgrade=true`. The library change in `mergedContext` that resolved values from that original request context, so the flag leaked into every subgraph fetch. The subgraphs then tried to perform a websocket handshake on plain HTTP fetches, which failed → `null`. The executor now builds its execution context without inheriting the original request's context values, while still forwarding the per-request header modifier — preserving TT-17442's per-user connection/credential isolation. See #447 for details and tests. - Bumps the **v1** module only (`v1.6.2-0.20260610093432-c7048b604e16` → `v1.6.2-0.20260623130956-98d2c88fce43`). - The gateway's `graphql-go-tools/v2` pin predates TT-17442, so the v3/v2 engine path is **not** affected and is intentionally left unchanged. - `go mod verify` passes; `internal/graphengine` and `apidef/adapter/...` build against the new pin. > Draft — depends on graphql-go-tools#447, which is not merged yet. The version pin points at the #447 branch commit and must be re-pinned to the squash-merge commit once #447 lands. [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ (cherry picked from commit 63316b3)

mativm02 · 2026-06-24T18:47:45Z

/release to release-5.13

mativm02 · 2026-06-24T18:47:51Z

/release to release-5.13.1

mativm02 · 2026-06-24T18:48:03Z

/release to release-5.14

probelabs · 2026-06-24T18:48:08Z

✅ Cherry-pick successful. A PR was created: #8359

probelabs · 2026-06-24T18:48:10Z

✅ Cherry-pick successful. A PR was created: #8360

mativm02 · 2026-06-24T18:48:12Z

/release to release-5.14.1

probelabs · 2026-06-24T18:48:24Z

✅ Cherry-pick successful. A PR was created: #8361

probelabs · 2026-06-24T18:48:26Z

❌ Cherry-pick failed. Please check the workflow logs.

mativm02 · 2026-06-24T18:49:56Z

/release to release-5.14.0

probelabs · 2026-06-24T18:50:13Z

✅ Cherry-pick successful. A PR was created: #8362

…ation subscription-then-query null regression (#8345) (#8357) Cherry-pick of `63316b393a9849620dece3e7b6447f2fe066dbe2` from `master` to `release-5.8` requires manual resolution. **Conflicts detected:** 3 - go.sum Tips: - Check out this branch locally and run: `git cherry-pick -x 63316b3` - Resolve conflicts (including submodules if any), then push back to this branch. Original commit: 63316b3 --------- Co-authored-by: Tyk Bot <[email protected]> Co-authored-by: Matias <[email protected]>

…deration subscription-then-query null regression (#8345) (#8362) [TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression (#8345) ## Description Bumps `github.com/TykTechnologies/graphql-go-tools` to pick up **TykTechnologies/graphql-go-tools#447**. ### The bug On a GraphQL Federation supergraph API, running a subscription (websocket) first and then a query over the same connection makes the query return `null` instead of data. Gateway logs show `websocket upgrade for GraphQL engine failed: 'upgrade' token not found in 'Connection' header` against the subgraphs. Regression introduced in 5.8.15 / 5.13.1 / 5.14.0 (clean on 5.8.14 and 5.13.0). ### Root cause The gateway tags an inbound websocket subscription request with a context value `GraphQLIsWebSocketUpgrade=true`. The library change in #446 ([TT-17442]) wrapped the subscription executor's context in a `mergedContext` that resolved values from that original request context, so the flag leaked into every subgraph fetch. The subgraphs then tried to perform a websocket handshake on plain HTTP fetches, which failed → `null`. ### The fix (library #447) The executor now builds its execution context without inheriting the original request's context values, while still forwarding the per-request header modifier — preserving TT-17442's per-user connection/credential isolation. See #447 for details and tests. ## Scope - Bumps the **v1** module only (`v1.6.2-0.20260610093432-c7048b604e16` → `v1.6.2-0.20260623130956-98d2c88fce43`). - The gateway's `graphql-go-tools/v2` pin predates TT-17442, so the v3/v2 engine path is **not** affected and is intentionally left unchanged. ## Verification - `go mod verify` passes; `internal/graphengine` and `apidef/adapter/...` build against the new pin. > Draft — depends on graphql-go-tools#447, which is not merged yet. The version pin points at the #447 branch commit and must be re-pinned to the squash-merge commit once #447 lands. [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17578]: https://tyktech.atlassian.net/browse/TT-17578?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: Matias <[email protected]>

…ration subscription-then-query null regression (#8345) (#8361) [TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression (#8345) ## Description Bumps `github.com/TykTechnologies/graphql-go-tools` to pick up **TykTechnologies/graphql-go-tools#447**. ### The bug On a GraphQL Federation supergraph API, running a subscription (websocket) first and then a query over the same connection makes the query return `null` instead of data. Gateway logs show `websocket upgrade for GraphQL engine failed: 'upgrade' token not found in 'Connection' header` against the subgraphs. Regression introduced in 5.8.15 / 5.13.1 / 5.14.0 (clean on 5.8.14 and 5.13.0). ### Root cause The gateway tags an inbound websocket subscription request with a context value `GraphQLIsWebSocketUpgrade=true`. The library change in #446 ([TT-17442]) wrapped the subscription executor's context in a `mergedContext` that resolved values from that original request context, so the flag leaked into every subgraph fetch. The subgraphs then tried to perform a websocket handshake on plain HTTP fetches, which failed → `null`. ### The fix (library #447) The executor now builds its execution context without inheriting the original request's context values, while still forwarding the per-request header modifier — preserving TT-17442's per-user connection/credential isolation. See #447 for details and tests. ## Scope - Bumps the **v1** module only (`v1.6.2-0.20260610093432-c7048b604e16` → `v1.6.2-0.20260623130956-98d2c88fce43`). - The gateway's `graphql-go-tools/v2` pin predates TT-17442, so the v3/v2 engine path is **not** affected and is intentionally left unchanged. ## Verification - `go mod verify` passes; `internal/graphengine` and `apidef/adapter/...` build against the new pin. > Draft — depends on graphql-go-tools#447, which is not merged yet. The version pin points at the #447 branch commit and must be re-pinned to the squash-merge commit once #447 lands. [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17578]: https://tyktech.atlassian.net/browse/TT-17578?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: Matias <[email protected]>

…deration subscription-then-query null regression (#8345) (#8360) [TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression (#8345) ## Description Bumps `github.com/TykTechnologies/graphql-go-tools` to pick up **TykTechnologies/graphql-go-tools#447**. ### The bug On a GraphQL Federation supergraph API, running a subscription (websocket) first and then a query over the same connection makes the query return `null` instead of data. Gateway logs show `websocket upgrade for GraphQL engine failed: 'upgrade' token not found in 'Connection' header` against the subgraphs. Regression introduced in 5.8.15 / 5.13.1 / 5.14.0 (clean on 5.8.14 and 5.13.0). ### Root cause The gateway tags an inbound websocket subscription request with a context value `GraphQLIsWebSocketUpgrade=true`. The library change in #446 ([TT-17442]) wrapped the subscription executor's context in a `mergedContext` that resolved values from that original request context, so the flag leaked into every subgraph fetch. The subgraphs then tried to perform a websocket handshake on plain HTTP fetches, which failed → `null`. ### The fix (library #447) The executor now builds its execution context without inheriting the original request's context values, while still forwarding the per-request header modifier — preserving TT-17442's per-user connection/credential isolation. See #447 for details and tests. ## Scope - Bumps the **v1** module only (`v1.6.2-0.20260610093432-c7048b604e16` → `v1.6.2-0.20260623130956-98d2c88fce43`). - The gateway's `graphql-go-tools/v2` pin predates TT-17442, so the v3/v2 engine path is **not** affected and is intentionally left unchanged. ## Verification - `go mod verify` passes; `internal/graphengine` and `apidef/adapter/...` build against the new pin. > Draft — depends on graphql-go-tools#447, which is not merged yet. The version pin points at the #447 branch commit and must be re-pinned to the squash-merge commit once #447 lands. [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17578]: https://tyktech.atlassian.net/browse/TT-17578?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: Matias <[email protected]>

…deration subscription-then-query null regression (#8345) (#8358) Cherry-pick of `63316b393a9849620dece3e7b6447f2fe066dbe2` from `master` to `release-5.8.15` requires manual resolution. **Conflicts detected:** 3 - go.sum Tips: - Check out this branch locally and run: `git cherry-pick -x 63316b3` - Resolve conflicts (including submodules if any), then push back to this branch. Original commit: 63316b3 --------- Co-authored-by: Tyk Bot <[email protected]> Co-authored-by: Matias <[email protected]> Co-authored-by: Matias <[email protected]>

…ration subscription-then-query null regression (#8345) (#8359) [TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression (#8345) ## Description Bumps `github.com/TykTechnologies/graphql-go-tools` to pick up **TykTechnologies/graphql-go-tools#447**. ### The bug On a GraphQL Federation supergraph API, running a subscription (websocket) first and then a query over the same connection makes the query return `null` instead of data. Gateway logs show `websocket upgrade for GraphQL engine failed: 'upgrade' token not found in 'Connection' header` against the subgraphs. Regression introduced in 5.8.15 / 5.13.1 / 5.14.0 (clean on 5.8.14 and 5.13.0). ### Root cause The gateway tags an inbound websocket subscription request with a context value `GraphQLIsWebSocketUpgrade=true`. The library change in #446 ([TT-17442]) wrapped the subscription executor's context in a `mergedContext` that resolved values from that original request context, so the flag leaked into every subgraph fetch. The subgraphs then tried to perform a websocket handshake on plain HTTP fetches, which failed → `null`. ### The fix (library #447) The executor now builds its execution context without inheriting the original request's context values, while still forwarding the per-request header modifier — preserving TT-17442's per-user connection/credential isolation. See #447 for details and tests. ## Scope - Bumps the **v1** module only (`v1.6.2-0.20260610093432-c7048b604e16` → `v1.6.2-0.20260623130956-98d2c88fce43`). - The gateway's `graphql-go-tools/v2` pin predates TT-17442, so the v3/v2 engine path is **not** affected and is intentionally left unchanged. ## Verification - `go mod verify` passes; `internal/graphengine` and `apidef/adapter/...` build against the new pin. > Draft — depends on graphql-go-tools#447, which is not merged yet. The version pin points at the #447 branch commit and must be re-pinned to the squash-merge commit once #447 lands. [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17578]: https://tyktech.atlassian.net/browse/TT-17578?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: Matias <[email protected]>

mativm02 added the deps-reviewed Dependency changes reviewed and approved for CI execution label Jun 23, 2026

Merge branch 'master' into TT-17578-bump-graphql-go-tools

4b003af

mativm02 marked this pull request as ready for review June 23, 2026 13:35

mativm02 force-pushed the TT-17578-bump-graphql-go-tools branch from f0de864 to ba10993 Compare June 24, 2026 14:15

Merge branch 'master' into TT-17578-bump-graphql-go-tools

4ec40ce

vladzabolotnyi approved these changes Jun 24, 2026

View reviewed changes

mativm02 enabled auto-merge (squash) June 24, 2026 14:29

mativm02 merged commit 63316b3 into master Jun 24, 2026
41 of 56 checks passed

mativm02 deleted the TT-17578-bump-graphql-go-tools branch June 24, 2026 15:56

probelabs Bot mentioned this pull request Jun 24, 2026

Merging to release-5.13: [TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression (#8345) #8359

Merged

probelabs Bot mentioned this pull request Jun 24, 2026

Merging to release-5.13.1: [TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression (#8345) #8360

Merged

probelabs Bot mentioned this pull request Jun 24, 2026

Merging to release-5.14: [TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression (#8345) #8361

Merged

probelabs Bot mentioned this pull request Jun 24, 2026

Merging to release-5.14.0: [TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression (#8345) #8362

Merged

Uh oh!

Conversation

mativm02 commented Jun 23, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

The bug

Root cause

The fix (library #447)

Scope

Verification

Uh oh!

github-actions Bot commented Jun 23, 2026

🎯 Recommended Merge Targets

Fix Version: Tyk 5.8.15

📋 Workflow

Uh oh!

probelabs Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Files Changed Analysis

Architecture & Impact Assessment

Bug vs. Fix Flow

Scope Discovery & Context Expansion

Uh oh!

probelabs Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Security Check Passed

✅ Architecture Check Passed

✅ Performance Check Passed

Uh oh!

sentinelone-cnapp-eu1 Bot commented Jun 24, 2026

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

Uh oh!

github-actions Bot commented Jun 24, 2026

🚨 Jira Linter Failed

Next Steps

Uh oh!

sonarqubecloud Bot commented Jun 24, 2026

Quality Gate passed

Uh oh!

Uh oh!

mativm02 commented Jun 24, 2026

Uh oh!

probelabs Bot commented Jun 24, 2026

Uh oh!

mativm02 commented Jun 24, 2026

Uh oh!

probelabs Bot commented Jun 24, 2026

Uh oh!

mativm02 commented Jun 24, 2026

Uh oh!

mativm02 commented Jun 24, 2026

Uh oh!

mativm02 commented Jun 24, 2026

Uh oh!

probelabs Bot commented Jun 24, 2026

Uh oh!

probelabs Bot commented Jun 24, 2026

Uh oh!

mativm02 commented Jun 24, 2026

Uh oh!

probelabs Bot commented Jun 24, 2026

Uh oh!

probelabs Bot commented Jun 24, 2026

Uh oh!

mativm02 commented Jun 24, 2026

Uh oh!

probelabs Bot commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mativm02 commented Jun 23, 2026 •

edited by atlassian Bot

Loading

probelabs Bot commented Jun 23, 2026 •

edited

Loading

probelabs Bot commented Jun 23, 2026 •

edited

Loading