Skip to content

fix(deps): update dependency com.graphql-java:graphql-java to v26#588

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/major-lib_graphql_java_ver
Open

fix(deps): update dependency com.graphql-java:graphql-java to v26#588
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/major-lib_graphql_java_ver

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 7, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
com.graphql-java:graphql-java 22.326.0 age confidence

Release Notes

graphql-java/graphql-java (com.graphql-java:graphql-java)

v26.0: 26.0

This is the 26.0 release of graphql-java. Highlights are summarized below; the full list of merged PRs is at the end.

⚠️ Breaking Changes

Query complexity limits are now enforced by default

New QueryComplexityLimits validation checks maxDepth (default 100) and maxFieldsCount (default 100,000) as part of standard validation. Queries exceeding these limits will now fail with new MaxQueryDepthExceeded / MaxQueryFieldsExceeded validation errors.

  • Set custom limits via GraphQLContext using QueryComplexityLimits.KEY.
  • Disable entirely with QueryComplexityLimits.NONE.

Introduced in #​4256.

Validation rule filtering API changed

In #​4228 the rule-filter predicate changed from Predicate<Class<?>> to Predicate<OperationValidationRule> in Validator.validateDocument(...) and ParseAndValidate.parseAndValidate(...). Callers that filtered by class (e.g. rule -> rule != NoUnusedFragments.class) must migrate to the enum (rule -> rule != OperationValidationRule.NO_UNUSED_FRAGMENTS). The @Internal classes AbstractRule and RulesVisitor were removed.

Built-in directive handling consolidated (#​4229)
  • DirectiveInfo was removed. Replace usages:
    • DirectiveInfo.isGraphqlSpecifiedDirective(...)Directives.isBuiltInDirective(...)
    • DirectiveInfo.GRAPHQL_SPECIFICATION_DIRECTIVESDirectives.BUILT_IN_DIRECTIVES
    • DirectiveInfo.GRAPHQL_SPECIFICATION_DIRECTIVE_MAPDirectives.BUILT_IN_DIRECTIVES_MAP
  • Directive ordering is now consistent: all 7 built-in directives appear first, followed by user-defined directives.
  • GraphQLSchema.Builder.clearDirectives() was initially removed then re-added in #​4276 with new semantics — it clears all additionalDirectives, but built-in directives are always re-added automatically at build time.
OneOf inhabitability validation (#​4248)

New validator rejects OneOf input types that cannot be populated with a finite value (e.g. input A @&#8203;oneOf { a: A }). Schemas that previously validated may now be rejected.

Non-null field validation for code-built schemas (#​4194)

Code-built schemas now perform the same deprecated-on-non-null field validation as SDL-built ones. Schemas relying on the gap may now fail validation.

GraphQLSchema.getCodeRegistry() is no longer @Nullable (#​4247)

The return type was incorrectly annotated nullable. Callers may now drop redundant null checks; downstream nullness tooling will reflect the change.

JSpecify nullability annotations rolled out broadly

Waves 2 and 3 (#​4184, #​4274) plus many individual PRs annotated hundreds of classes across graphql.analysis, graphql.execution, graphql.language, graphql.schema and others with @NullMarked/@NullUnmarked/@Nullable. Kotlin and other null-aware callers will now see stricter nullability contracts; code that relied on previously-permissive signatures may need adjustment.

✨ New Features

  • GraphQLSchema.FastBuilder (#​4197) — a more restrictive but ~5× faster schema builder that reduces both time and memory for large schemas.
  • Query complexity limits (#​4256) — depth/field-count guardrails baked into validation (see breaking changes above for the enforcement side).
  • QueryAppliedDirective on operations and documents (#​4297) — directives applied at the operation/document level are now exposed as QueryAppliedDirectives.
  • New instrumentation hook for post-exception-handling results (#​4206, #​4207) — observe the DataFetcherResult after DataFetcherExceptionHandler has mapped exceptions to errors. ChainedInstrumentation delegates the new hook correctly.
  • Generic DataFetcherResult.newBuilder(T data) (#​4254) — removes the need for explicit type witnesses on the common DataFetcherResult.<T>newResult().data(x)... pattern.
  • Re-added GraphQLSchema.Builder.clearDirectives() (#​4276) — useful with GraphQLSchema.transform to rewrite non-built-in directives; built-ins are always re-added.
  • toString() on AST directives holders (#​4195).

⚡ Performance

  • Incremental @defer execution starts earlier (#​4174) — begins processing deferred payloads as soon as the first incremental call is detected instead of waiting for the initial result to complete.
  • Validation consolidation (#​4228) — all operation validation rules run in a single OperationValidator pass, significantly cutting validation overhead.
  • Reduced allocations on the execution hot path (#​4252):
    • Async$Many.materialisedList() — replaced ArrayList copy with a zero-copy Arrays.asList() wrapper.
    • ResultPath.toStringValue — lazy computation; the string form is only built on first toString() (typically only during error reporting).
    • New GraphQLCodeRegistry.getDataFetcher(String, String, GraphQLFieldDefinition) overload avoiding per-fetch FieldCoordinates allocations (~54 KB/op reduction).
  • FastBuilder for schema construction (#​4197) — see New Features.
  • Fixed ShallowTypeRefCollector to also resolve type refs inside applied directive arguments and enum value definitions (#​4288) — correctness fix enabling FastBuilder to be used on more schemas.

🐛 Other Noteworthy Changes

Execution / data fetching
  • DataLoader dispatch with multiple @defer fragments (#​4270) — fixes a case where DataLoaders were not dispatched correctly when multiple deferred fragments were in play.
  • CompletionStageSubscriber race condition (#​4296) — completion signal could be lost if an in-flight CompletionStage resolved concurrently. Fix is backed by new jcstress stress tests.
  • PropertyDataFetcher on non-public classes (#​4287) — properties on non-public classes that implement public interfaces (e.g. TreeMap.Entry) now fetch correctly on Java 16+ by searching public interfaces.
  • ExecutableNormalizedField respects GraphqlFieldVisibility (#​4204) — selection-set APIs now use the schema's configured visibility instead of going straight to the type.
  • ScheduledDataLoaderRegistry "dispatch all" fix (#​4164).
  • ChainedInstrumentation onExceptionHandled delegation (#​4207).
Schema / field visibility
Build / packaging / security
  • Bytecode-modified classes no longer ship in published JARs (#​4343) — the @Generated annotation injected for coverage reporting was leaking into published artifacts. JARs now contain pristine compiler output.
  • Trojan Source / glassworm Unicode detection (#​4344) — pre-commit hook and CI workflow now reject dangerous BiDi/zero-width/control characters in source.
  • Windows compatibility (#​4239) — removed colons from performance-results/ filenames, split the oversized large-schema-5.graphqls, added pre-commit + CI checks.
Tooling / DX
  • getDataLoader type bounds improved (#​4180).
  • Build and test on Java 25 (#​4173, #​4330).
  • Many dependency updates (Reactor, Jackson, Kotlin, Groovy, Gradle, ByteBuddy, errorprone, etc.) across the release.

Full PR list

Expand to see all merged PRs

New Contributors

Full Changelog: graphql-java/graphql-java@v25.0...v26.0

v25.0: 25.0

Compare Source

Key changes

Dataloader

Refactoring strategy

The existing PerLevelDataLoaderStrategy has been refactored which lead to simplifications and performance improvements.

New strategies

Two new strategies were introduced: CHAINED and EXHAUSTED. Both can be configured via UnusalConfiguration (see next section).

CHAINED allow for chained DataLoaders to be used while keeping a per level dispatch strategies.

EXHAUSTED is a completely new strategy that works on the basis to dispatch once the engine is not busy. It mirrors the JS data loader dispatch strategy, but for a multi threaded system.

Unusual Configuration

A more generalised configuration mechanism has been added for "unusual configuration". By that we mean configuation we dont expect many people to use but if they do its now in a more common place

For example if you wanted to change the maximum depth the document parser will accept you could call the following methods.

        var parserOptions = newParserOptions().maxRuleDepth(99).build()
        GraphQL.unusualConfiguration().parsing().setDefaultParserOptions(parserOptions)
JSpecify Annotations

The team are starting to embrace https://jspecify.dev/ annotations as the way to indicate nullable and non nullable fields. Many important classes have had these annotations added to help make it more semantically clear when a value can be null or not.

Breaking Changes

A wrapping FetchedValue object is not always returned on field fetchers for performance reasons. This means that graphql.execution.instrumentation.parameters.InstrumentationFieldCompleteParameters#getFetchedObject was created to replace the older getFetchedValue method and the returns object can sometimes be a FetchedValue or sometimes a simple POJO value.

Performance improvements

A series of performance improvements have been made to reduce the memory footprint of the library. Also the Java .stream() operator can be slower than a more direct loop and many of these calls have been changed for performance reasons.

What's Changed


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Apr 7, 2025
@renovate renovate Bot force-pushed the renovate/major-lib_graphql_java_ver branch from 9eadcc5 to 9a2f68f Compare April 15, 2025 11:46
@sonarqubecloud
Copy link
Copy Markdown

@renovate renovate Bot force-pushed the renovate/major-lib_graphql_java_ver branch from 9a2f68f to 41cf554 Compare May 16, 2025 06:50
@renovate renovate Bot changed the title fix(deps): update dependency com.graphql-java:graphql-java to v23 fix(deps): update dependency com.graphql-java:graphql-java to v24 May 16, 2025
@sonarqubecloud
Copy link
Copy Markdown

@renovate renovate Bot force-pushed the renovate/major-lib_graphql_java_ver branch from 41cf554 to 678a53f Compare May 30, 2025 07:14
@renovate renovate Bot force-pushed the renovate/major-lib_graphql_java_ver branch from 678a53f to bc91c34 Compare July 28, 2025 06:06
@sonarqubecloud
Copy link
Copy Markdown

@renovate renovate Bot force-pushed the renovate/major-lib_graphql_java_ver branch from bc91c34 to d9f80eb Compare September 24, 2025 02:14
@renovate renovate Bot force-pushed the renovate/major-lib_graphql_java_ver branch from d9f80eb to f2d5c57 Compare November 10, 2025 05:55
@renovate renovate Bot changed the title fix(deps): update dependency com.graphql-java:graphql-java to v24 fix(deps): update dependency com.graphql-java:graphql-java to v25 Nov 10, 2025
@sonarqubecloud
Copy link
Copy Markdown

@renovate renovate Bot force-pushed the renovate/major-lib_graphql_java_ver branch from f2d5c57 to e3842fc Compare April 23, 2026 02:47
@renovate renovate Bot changed the title fix(deps): update dependency com.graphql-java:graphql-java to v25 fix(deps): update dependency com.graphql-java:graphql-java to v26 Apr 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants