GHSA-2276-r4j8-v779: 
Rust Analyse et atténuation de la vulnérabilité

Audit finding RUN-1 (2026-11-09 audit, follow-up deep pass), severity medium. Audited revision b7c8030f; line numbers refer to it. Static reading with upstream documentation; nothing was executed. Reproduce with a failing test before changing code.

Problem

Runtime mutation roots (runtime/mutation.rs execute) never call enforce_operation_assurance; a case-insensitive search for assurance finds nothing under runtime/ or orm/runtime_*.rs. The registry is seeded only from the static catalogue, so strict ensure_complete() still passes. A host that sets a default interactive mutation policy gets step-up on static mutations and none on runtime create/update/delete/link mutations or RuntimeHostField mutations. Related: a registry miss returns Ok unless strict mode, a configured default policy is not applied on a miss, custom-operation macros inject no assurance call, and Federation _entities resolvers key the lookup on the field name _entities (plausible, not confirmed), which is not in the catalogue.

Where

crates/graphql-orm/src/graphql/runtime/mutation.rs:361-413, :1069-1087; crates/graphql-orm/src/graphql/assurance.rs:190-207, :573-597; crates/graphql-orm-macros/src/federation.rs:381-384, :559-562

Suggested fix

Call enforce_operation_assurance(ctx, Mutation, field_name) at the top of runtime execute and register runtime roots; in strict mode verify at schema build that every Mutation-root field is registered; pass the explicit get-by-id coordinate from entity resolvers.

Acceptance

• A regression test fails before the change and passes after it.
• Docs and changelog state the corrected behaviour. Filed as a private draft advisory.