You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Memory leak: the shared validation_aborted_error keeps every traceback it is raised through #287
Since aab6d50 (first released in 3.3.0a3), validate() raises one shared, module-level ValidationAbortedError once max_errors is reached. When an existing exception object is raised again, Python adds the new frames to its existing __traceback__. So every aborted validation lengthens the singleton's traceback, and that traceback keeps those frames, and with them each request's document and validation context, alive for the life of the process.
Any client can trigger this by sending a query with more than 100 validation errors. In a long-running server, memory grows with every such request.
That is about 124 KiB more per aborted validation, with no upper limit. The same script on 3.2.13, which creates a new error each time, levels off at about 259 KiB.
Suggested fix: create a new ValidationAbortedError on each validate() call instead of reusing the module-level instance. Clearing __traceback__ before each raise would also work, but every caller's error list would still share one mutable error object.
Thanks a lot for the detailed report, @riodw! Confirmed and reproduced: this affects 3.3.0 and the pre-releases since 3.3.0a3, but not 3.2.x.
The fix is in #289. Besides creating a new error for every aborted validation, it also makes sure that the aborted error does not keep the frames alive through the context of an exception that was being handled when the error limit was reached (this can happen with the comparison budget of OverlappingFieldsCanBeMergedRule).
I'm going to release 3.3.1 with this fix shortly, together with a security advisory. Reviews of #289 or checks of the release are still very welcome.
Activity
Cito commentedon Oct 25, 2026
Thanks a lot for the detailed report, @riodw! Confirmed and reproduced: this affects 3.3.0 and the pre-releases since 3.3.0a3, but not 3.2.x.
The fix is in #289. Besides creating a new error for every aborted validation, it also makes sure that the aborted error does not keep the frames alive through the context of an exception that was being handled when the error limit was reached (this can happen with the comparison budget of
OverlappingFieldsCanBeMergedRule).I'm going to release 3.3.1 with this fix shortly, together with a security advisory. Reviews of #289 or checks of the release are still very welcome.
Cito commentedon Oct 25, 2026
The fix has been released in GraphQL-core 3.3.1, together with a security advisory. Thanks again, @riodw!