GraphQL-Ruby versions prior to certain patch releases did not count comment tokens when enforcing the max_query_string_tokens limit, allowing query strings to exceed the intended token limit. This issue was fixed in patch releases for each affected 2.x version.