rmosolgo/graphql-ruby: technical due diligence, read from its repository

The median source file here is 82 lines. 58 files exceed 1,000 lines, the largest being 21,029. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: CI workflows. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

2 places read data with a deserialiser that executes what it reads (Ruby `Marshal.load`). That is safe on data the system wrote itself and remote code execution on anything else. Ask where each one's input comes from.

2 of 8 locked dependencies match 2 published advisories in OSV. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

The newest was published on 2026-10-30. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 2 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 2.6.13. Answer lives in: the release you run, set against each fixed version.