GHSA-cqmq-8755-7xvh Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

• npm @keystone-6/core: < 6.5.3 → fixed in 6.5.3

Summary The value of `graphql.maxTake` can be bypassed by providing a negative input. This can be used to exceed the developer's intended `graphql.maxTake` value, allowing queries to return results in excess of the `graphql.maxTake` value set. Impact This affects any project relying on `graphql.maxTake` to bound the number of items returned per query. Patches This issue has been patched in `@keystone-6/core` version `6.5.3`. If you cannot patch, you can workaround this by restricting `take` input values in your GraphQL queries to the bounded value, or by blocking negative values. Credit This issue was found by Haxset's Security Scanner and validated by their team.