fix(deps): bump the graphql group with 6 updates by dependabot[bot] · Pull Request #446 · code-like-a-carpenter/workbench

dependabot · 2026-09-14T12:55:43Z

Bumps the graphql group with 6 updates:

Package	From	To
@graphql-eslint/eslint-plugin	`3.20.1`	`4.4.1`
@graphql-tools/apollo-engine-loader	`8.0.1`	`8.0.36`
@graphql-codegen/plugin-helpers	`5.0.4`	`7.3.0`
graphql	`16.8.1`	`17.0.2`
@graphql-codegen/core	`4.0.2`	`6.2.0`
@graphql-tools/schema	`10.0.23`	`10.1.1`

Updates @graphql-eslint/eslint-plugin from 3.20.1 to 4.4.1

Commits

d891c64 fix: latest node, latest pnpm, trusted publishing (#2967)
6c121e3 chore(release): update monorepo packages versions (#2966)
51fe6bd fix: replace deprecated ESLint context methods for v10 compatibility (#2946)
f0f200e fix(deps): update dependency next to v15.4.7 [security] (#2931)
7ef10c6 Bump the npm_and_yarn group across 2 directories with 1 update (#2930)
5141fdb Bump glob
8c097c2 Fix security vuln errors
c1af8ab chore(deps): update dependency eslint-plugin-vue to v10 (#2889)
4797aaf chore(deps): update dependency @changesets/cli to v2.29.5 (#2863)
e8dd16a chore(deps): update dependency svelte-eslint-parser to v1 (#2891)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @graphql-eslint/eslint-plugin since your current version.

Updates @graphql-tools/apollo-engine-loader from 8.0.1 to 8.0.36

Changelog

Sourced from @graphql-tools/apollo-engine-loader's changelog.

8.0.36

Patch Changes

Updated dependencies [60db079, 57e316d, 1c1c5a0, 1c1c5a0, 0b9529f]:

@graphql-tools/utils@12.0.1

8.0.35

Patch Changes

Updated dependencies [2273c21]:

@graphql-tools/utils@12.0.0

8.0.34

Patch Changes

Updated dependencies [e90719b]:

@graphql-tools/utils@11.2.2

8.0.33

Patch Changes

Updated dependencies [615c1a2]:

@graphql-tools/utils@11.2.1

8.0.32

Patch Changes

Updated dependencies [2609c94]:

@graphql-tools/utils@11.2.0

8.0.31

Patch Changes

Updated dependencies [981d461]:

@graphql-tools/utils@11.1.1

8.0.30

Patch Changes

... (truncated)

Commits

8b9b7df chore(release): update monorepo packages versions (#8365)
0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
9feabd9 chore(release): update monorepo packages versions (#8327)
11f0a21 chore(release): update monorepo packages versions (#8303)
3c27f9a chore(release): update monorepo packages versions (#8284)
062d229 chore(release): update monorepo packages versions (#8261)
c7f20ac chore(release): update monorepo packages versions (#8157)
4aa9156 chore(release): update monorepo packages versions (#8145)
14066f9 chore(release): update monorepo packages versions (#8118)
7417ceb chore(release): update monorepo packages versions (#7754)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @graphql-tools/apollo-engine-loader since your current version.

Updates @graphql-codegen/plugin-helpers from 5.0.4 to 7.3.0

Changelog

Sourced from @graphql-codegen/plugin-helpers's changelog.

7.3.0

Minor Changes

#10928 90229a5 Thanks @eddeee888! - Add contentComparison?: 'cache-first' | 'disk' to control disk-vs-cache write comparison in watch mode.

In watch mode the CLI caches the hash of the content it last wrote per file and compares new output against that cached hash to skip redundant writes. This assumes generated output is a pure function of the codegen inputs. An output whose content depends on the file's existing content (e.g. a preset that reads the file and rewrites part of it) breaks that assumption: if the file is changed on disk and codegen regenerates content identical to a previous run, the cached hash still matches and the write is skipped, so the on-disk change is never corrected.

contentComparison: 'disk' opts an output into comparing the generated content against the file on disk instead of the in-memory record of what codegen last wrote, so the file is rewritten when it was changed externally. It can be set:

by a preset, on the GenerateOptions it returns from buildGeneratesSection, or

on the output config (generates[output].contentComparison) for any output, including plain plugin outputs without a preset.

When both are present, the preset's value takes precedence. The default, 'cache-first', keeps the existing in-memory-cache behaviour for outputs that are a pure function of their inputs.

Patch Changes

#10930 448431a Thanks @eddeee888! - Fix overwrite being ignored for preset-based generates outputs.

A generates entry that used a preset and set overwrite (e.g. overwrite: { removeStaleFiles: false }) had that setting silently ignored, so in watch mode its generated files could still be deleted as stale.

The CLI resolved overwrite per generated file by looking the file's path up in config.generates. That fails for a preset: its generates entry is keyed by the preset's baseOutputDir, not by any generated file's path (and a preset can emit files outside that directory), and the lookup additionally required a plugins key that preset entries don't have. Both cases fell through to the global config.overwrite (default true).

7.2.1

Patch Changes

#10924 0c8f5ba

... (truncated)

Commits

3216e72 chore(release): update monorepo packages versions (#10929)
448431a Fix overwrite being ignored for preset-based generates outputs (#10930)
90229a5 Add contentComparison to allow plugins and presets to configure whether to ...
a2e1d5c chore(release): update monorepo packages versions (#10925)
0c8f5ba Implement rolling profiler output for watch mode (#10924)
6aa476a Upcoming Release Changes (#10923)
58cdb31 Add overwrite.updateExistingFiles and overwrite.removeStaleFiles (#10921)
726d28a chore(release): update monorepo packages versions (#10889)
959915f CODEGEN905 - Add GraphQL 17 support (#10866)
d791fc5 Migrate to pnpm (#10818)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @graphql-codegen/plugin-helpers since your current version.

Updates graphql from 16.8.1 to 17.0.2

Release notes

Sourced from graphql's releases.

v17.0.2 (2026-07-03)

Bug Fix 🐞

#4832 fix: detect default-value changes on input object fields (@spokodev)

Polish 💅

#4829 fix(mapSchemaConfig): fix context for schema argument mapper (@yaacovCR)

Committers: 2

null(@spokodev)

Yaacov Rydzinski (@yaacovCR)

v17.0.1 (2026-06-16)

Bug Fix 🐞

#4824 fix(diagnostics): emit asyncStart after promise settlement to match native tracePromise (@logaretm)

Internal 🏠

#4823 chore(npm): remove obsolete ESM-only package build (@yaacovCR)

#4825 chore(release): protect latest release channels (@yaacovCR)

Committers: 2

Abdelrahman Awad(@logaretm)

Yaacov Rydzinski (@yaacovCR)

v17.0.0 (2026-06-15)

New Feature 🚀

#4819 feat: graduate directives on directives (@yaacovCR)

Bug Fix 🐞

#4799 fix: raise request error on invalid fragment variables (@yaacovCR)

#4800 fix: apply directives when SDL contains type definitions and extensions with directives (@yaacovCR)

#4564 OneOf Inhabitability (@jbellenger)

#4814 fix(KnownDirectivesRule): locations for input field arguments in extensions (@yaacovCR)

#4726 feat(validation): reject directive definition cycles (@yaacovCR)

#4815 Revert "feat(validation): reject directive definition cycles (#4726)" (@yaacovCR)

Docs 📝

#4790 docs: minor diagnostics doc comment improvements (@yaacovCR)

#4791 fix: docs: polish diagnostics comments further (@yaacovCR)

#4793 docs: further improve general execution and tracing docs (@yaacovCR)

#4802 docs: correct extension field comments - v17 (@yaacovCR)

... (truncated)

Commits

71606d7 chore(release): v17.0.2
101de34 fix: detect default-value changes on input object fields (#4832)
82da713 fix(mapSchemaConfig): fix context for schema argument mapper (#4829)
9617473 chore(release): v17.0.1
851bd6a chore(release): protect latest release channels (#4825)
c471d36 fix(diagnostics): emit asyncStart after promise settlement to match native `t...
3f3895f chore(npm): remove obsolete ESM-only package build (#4823)
c7e494a chore(release): v17.0.0
d977f66 docs: post 17.rc-0 update (#4817)
39f865f docs: document @experimental_disableErrorPropagation (#4820)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for graphql since your current version.

Updates @graphql-codegen/core from 4.0.2 to 6.2.0

Changelog

Sourced from @graphql-codegen/core's changelog.

6.2.0

Minor Changes

#10866 959915f Thanks @eddeee888! - dependencies updates:

Updated dependency @graphql-tools/utils@^11.2.0 ↗︎ (from ^11.0.0, in dependencies)

Updated dependency graphql@^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0 ↗︎ (from ^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0, in peerDependencies)

Patch Changes

Updated dependencies [959915f]:

@graphql-codegen/plugin-helpers@7.1.0

6.1.0

Minor Changes

#10788 cbf9544 Thanks @robertobadalamenti! - Add disableFederationDirectiveAndScalarInjection config to better support Federation v2

6.0.1

Patch Changes

#10849 55a4742 Thanks @eddeee888! - dependencies updates:

Updated dependency @graphql-codegen/plugin-helpers@workspace:^ ↗︎ (from ^7.0.0, in dependencies)

6.0.0

Major Changes

#10496 afaace6 Thanks @eddeee888! - BREAKING CHANGE: Drop Node 20 support

... (truncated)

Commits

726d28a chore(release): update monorepo packages versions (#10889)
959915f CODEGEN905 - Add GraphQL 17 support (#10866)
41bc398 chore(release): update monorepo packages versions (#10854)
cbf9544 feat(cli): allow disabling legacy federation injection for FederationV2 schem...
29c84f7 chore(release): update monorepo packages versions (#10852)
55a4742 Link all deps with workspace: for pnpm & changeset, fix release CI (#10849)
9e61d5d Revert "Fix pnpm workspace dep linking (#10843)" (#10847)
f5a9963 Revert "chore(release): update monorepo packages versions (#10844)" (#10845)
55361d6 chore(release): update monorepo packages versions (#10844)
2fb9bd3 Fix pnpm workspace dep linking (#10843)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @graphql-codegen/core since your current version.

Updates @graphql-tools/schema from 10.0.23 to 10.1.1

Changelog

Sourced from @graphql-tools/schema's changelog.

10.1.1

Patch Changes

Updated dependencies [2262087, 5523c4b, 60db079, 57e316d, 1c1c5a0, 1c1c5a0, 0b9529f]:

@graphql-tools/merge@9.2.4

@graphql-tools/utils@12.0.1

10.1.0

Minor Changes

#8346 2273c21 Thanks @ardatan! - This release adds GraphQL v17 support and aligns the existing executor implementation with the latest GraphQL v17 API changes. The following changes are included:

getAsyncHelpers is now available on GraphQLResolveInfo. Its track method is used whenever waitUntil is available, as in Yoga's Explicit Resource Management

getAbortSignal is now available on GraphQLResolveInfo, matching behavior that was already available in this executor implementation, as in Yoga's Execution Cancellation

GraphQLResolveInfo automatically aligns variableValues according to the GraphQL version for better compatibility. In GraphQL v17 and above, variableValues follows the wrapped shape ({ coerced, sources }) expected by GraphQL APIs. In GraphQL v16 and below, variableValues remains a flat map as in previous versions.

If your custom scalar resolvers define __serialize and __parseValue, they are automatically mapped to coerceOutputValue and coerceInputValue in GraphQL v17.

BREAKING: @graphql-tools/executor's getVariableValues now returns { variableValues } on success, where variableValues is a VariableValues object ({ coerced, sources }). On failure, it returns { errors }.

BREAKING: collectFields, shouldIncludeNode, getDeferValues, and collectSubFields now need a VariableValues object instead of Record<string, any> for the variableValues argument.

visitResult now internally normalizes ExecutionRequest.variables into a VariableValues-compatible shape ({ coerced, sources }) before traversing selections.

Patch Changes

Updated dependencies [2273c21, 7fe0319]:

@graphql-tools/utils@12.0.0

@graphql-tools/merge@9.2.3

10.0.38

Patch Changes

... (truncated)

Commits

8b9b7df chore(release): update monorepo packages versions (#8365)
23ca392 chore(deps): update dependency graphql-scalars to v2 (#8385)
ce2470a build(deps): bump the actions-deps group with 8 updates (#8377)
0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
9feabd9 chore(release): update monorepo packages versions (#8327)
2273c21 GraphQL 17 Compatibility (#8346)
11f0a21 chore(release): update monorepo packages versions (#8303)
3c27f9a chore(release): update monorepo packages versions (#8284)
76b54da chore(release): update monorepo packages versions (#8264)
062d229 chore(release): update monorepo packages versions (#8261)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @graphql-tools/schema since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the graphql group with 6 updates: | Package | From | To | | --- | --- | --- | | [@graphql-eslint/eslint-plugin](https://github.com/graphql-hive/graphql-eslint) | `3.20.1` | `4.4.1` | | [@graphql-tools/apollo-engine-loader](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/loaders/apollo-engine) | `8.0.1` | `8.0.36` | | [@graphql-codegen/plugin-helpers](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/utils/plugins-helpers) | `5.0.4` | `7.3.0` | | [graphql](https://github.com/graphql/graphql-js) | `16.8.1` | `17.0.2` | | [@graphql-codegen/core](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-core) | `4.0.2` | `6.2.0` | | [@graphql-tools/schema](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/schema) | `10.0.23` | `10.1.1` | Updates `@graphql-eslint/eslint-plugin` from 3.20.1 to 4.4.1 - [Release notes](https://github.com/graphql-hive/graphql-eslint/releases) - [Commits](https://github.com/graphql-hive/graphql-eslint/compare/@graphql-eslint/eslint-plugin@3.20.1...@graphql-eslint/eslint-plugin@4.4.1) Updates `@graphql-tools/apollo-engine-loader` from 8.0.1 to 8.0.36 - [Release notes](https://github.com/ardatan/graphql-tools/releases) - [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/loaders/apollo-engine/CHANGELOG.md) - [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/apollo-engine-loader@8.0.36/packages/loaders/apollo-engine) Updates `@graphql-codegen/plugin-helpers` from 5.0.4 to 7.3.0 - [Release notes](https://github.com/dotansimha/graphql-code-generator/releases) - [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/utils/plugins-helpers/CHANGELOG.md) - [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/plugin-helpers@7.3.0/packages/utils/plugins-helpers) Updates `graphql` from 16.8.1 to 17.0.2 - [Release notes](https://github.com/graphql/graphql-js/releases) - [Commits](graphql/graphql-js@v16.8.1...v17.0.2) Updates `@graphql-codegen/core` from 4.0.2 to 6.2.0 - [Release notes](https://github.com/dotansimha/graphql-code-generator/releases) - [Changelog](https://github.com/dotansimha/graphql-code-generator/blob/master/packages/graphql-codegen-core/CHANGELOG.md) - [Commits](https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/core@6.2.0/packages/graphql-codegen-core) Updates `@graphql-tools/schema` from 10.0.23 to 10.1.1 - [Release notes](https://github.com/ardatan/graphql-tools/releases) - [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/schema/CHANGELOG.md) - [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/schema@10.1.1/packages/schema) --- updated-dependencies: - dependency-name: "@graphql-eslint/eslint-plugin" dependency-version: 4.4.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: graphql - dependency-name: "@graphql-tools/apollo-engine-loader" dependency-version: 8.0.36 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: graphql - dependency-name: "@graphql-codegen/plugin-helpers" dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: graphql - dependency-name: graphql dependency-version: 17.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: graphql - dependency-name: "@graphql-codegen/core" dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: graphql - dependency-name: "@graphql-tools/schema" dependency-version: 10.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: graphql ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-09-14T12:56:17Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
@graphql-tools/apollo-engine-loader@8.0.1 ⏵ 8.0.36				⁺³
@graphql-tools/schema@10.0.23 ⏵ 10.1.1				⁺³
@graphql-codegen/core@6.2.0
@babel/template@7.24.6 ⏵ 7.29.7	⁺¹			^-5
@babel/generator@7.24.6 ⏵ 7.29.8
@babel/core@7.24.6 ⏵ 7.29.7		⁺¹		^-1
@babel/types@7.24.6 ⏵ 7.29.8	⁺¹
@graphql-eslint/eslint-plugin@3.20.1 ⏵ 4.4.1	⁺¹		⁺¹	⁺⁹
graphql@17.0.2

View full report

nx-cloud · 2026-09-14T13:00:51Z

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

_{To disable these notifications, a workspace admin can disable them in workspace settings.}

View your CI Pipeline Execution ↗ for commit 31ca8ec

Command	Status	Duration	Result
`nx run-many --target build`	❌ Failed	3m 31s	View ↗

💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗.

☁️ Nx Cloud last updated this comment at 2026-09-14 13:00:51 UTC

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 14, 2026

Navigation Menu

Uh oh!

fix(deps): bump the graphql group with 6 updates - #446

fix(deps): bump the graphql group with 6 updates#446
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/graphql-c992ca6f37

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

socket-security Bot commented Sep 14, 2026

Uh oh!

nx-cloud Bot commented Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026

8.0.36

Patch Changes

8.0.35

Patch Changes

8.0.34

Patch Changes

8.0.33

Patch Changes

8.0.32

Patch Changes

8.0.31

Patch Changes

8.0.30

Patch Changes

7.3.0

Minor Changes

Patch Changes

7.2.1

Patch Changes

v17.0.2 (2026-07-03)

Bug Fix 🐞

Polish 💅

Committers: 2

v17.0.1 (2026-06-16)

Bug Fix 🐞

Internal 🏠

Committers: 2

v17.0.0 (2026-06-15)

New Feature 🚀

Bug Fix 🐞

Docs 📝

6.2.0

Minor Changes

Patch Changes

6.1.0

Minor Changes

6.0.1

Patch Changes

6.0.0

Major Changes

10.1.1

Patch Changes

10.1.0

Minor Changes

Patch Changes

10.0.38

Patch Changes

Uh oh!

socket-security Bot commented Sep 14, 2026

Uh oh!

nx-cloud Bot commented Sep 14, 2026

🤖 Nx Cloud AI Fix Eligible

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants