dependabot[bot] opened a new pull request, #2573: URL: https://github.com/apache/karaf/pull/2573
Bumps [com.graphql-java:graphql-java](https://github.com/graphql-java/graphql-java) from 22.3 to 26.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/graphql-java/graphql-java/releases";>com.graphql-java:graphql-java's releases</a>.</em></p> <blockquote> <h2>26.0</h2> <p>This is the 26.0 release of graphql-java. Highlights are summarized below; the full list of merged PRs is at the end.</p> <h2>⚠️ Breaking Changes</h2> <h3>Query complexity limits are now enforced by default</h3> <p>New <code>QueryComplexityLimits</code> validation checks <code>maxDepth</code> (default <strong>100</strong>) and <code>maxFieldsCount</code> (default <strong>100,000</strong>) as part of standard validation. Queries exceeding these limits will now fail with new <code>MaxQueryDepthExceeded</code> / <code>MaxQueryFieldsExceeded</code> validation errors.</p> <ul> <li>Set custom limits via <code>GraphQLContext</code> using <code>QueryComplexityLimits.KEY</code>.</li> <li>Disable entirely with <code>QueryComplexityLimits.NONE</code>.</li> </ul> <p>Introduced in <a href="https://redirect.github.com/graphql-java/graphql-java/issues/4256";>#4256</a>.</p> <h3>Validation rule filtering API changed</h3> <p>In <a href="https://redirect.github.com/graphql-java/graphql-java/issues/4228";>#4228</a> the rule-filter predicate changed from <code>Predicate<Class<?>></code> to <code>Predicate<OperationValidationRule></code> in <code>Validator.validateDocument(...)</code> and <code>ParseAndValidate.parseAndValidate(...)</code>. Callers that filtered by class (e.g. <code>rule -> rule != NoUnusedFragments.class</code>) must migrate to the enum (<code>rule -> rule != OperationValidationRule.NO_UNUSED_FRAGMENTS</code>). The <code>@Internal</code> classes <code>AbstractRule</code> and <code>RulesVisitor</code> were removed.</p> <h3>Built-in directive handling consolidated (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4229";>#4229</a>)</h3> <ul> <li><code>DirectiveInfo</code> was removed. Replace usages: <ul> <li><code>DirectiveInfo.isGraphqlSpecifiedDirective(...)</code> → <code>Directives.isBuiltInDirective(...)</code></li> <li><code>DirectiveInfo.GRAPHQL_SPECIFICATION_DIRECTIVES</code> → <code>Directives.BUILT_IN_DIRECTIVES</code></li> <li><code>DirectiveInfo.GRAPHQL_SPECIFICATION_DIRECTIVE_MAP</code> → <code>Directives.BUILT_IN_DIRECTIVES_MAP</code></li> </ul> </li> <li>Directive ordering is now consistent: all 7 built-in directives appear first, followed by user-defined directives.</li> <li><code>GraphQLSchema.Builder.clearDirectives()</code> was initially removed then re-added in <a href="https://redirect.github.com/graphql-java/graphql-java/issues/4276";>#4276</a> with new semantics — it clears all <code>additionalDirectives</code>, but built-in directives are always re-added automatically at build time.</li> </ul> <h3>OneOf inhabitability validation (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4248";>#4248</a>)</h3> <p>New validator rejects OneOf input types that cannot be populated with a finite value (e.g. <code>input A @oneOf { a: A }</code>). Schemas that previously validated may now be rejected.</p> <h3>Non-null field validation for code-built schemas (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4194";>#4194</a>)</h3> <p>Code-built schemas now perform the same deprecated-on-non-null field validation as SDL-built ones. Schemas relying on the gap may now fail validation.</p> <h3><code>GraphQLSchema.getCodeRegistry()</code> is no longer <code>@Nullable</code> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4247";>#4247</a>)</h3> <p>The return type was incorrectly annotated nullable. Callers may now drop redundant null checks; downstream nullness tooling will reflect the change.</p> <h3>JSpecify nullability annotations rolled out broadly</h3> <p>Waves 2 and 3 (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4184";>#4184</a>, <a href="https://redirect.github.com/graphql-java/graphql-java/issues/4274";>#4274</a>) plus many individual PRs annotated hundreds of classes across <code>graphql.analysis</code>, <code>graphql.execution</code>, <code>graphql.language</code>, <code>graphql.schema</code> and others with <code>@NullMarked</code>/<code>@NullUnmarked</code>/<code>@Nullable</code>. Kotlin and other null-aware callers will now see stricter nullability contracts; code that relied on previously-permissive signatures may need adjustment.</p> <h2>✨ New Features</h2> <ul> <li><strong><code>GraphQLSchema.FastBuilder</code></strong> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4197";>#4197</a>) — a more restrictive but <strong>~5× faster</strong> schema builder that reduces both time and memory for large schemas.</li> <li><strong>Query complexity limits</strong> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4256";>#4256</a>) — depth/field-count guardrails baked into validation (see breaking changes above for the enforcement side).</li> <li><strong><code>QueryAppliedDirective</code> on operations and documents</strong> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4297";>#4297</a>) — directives applied at the operation/document level are now exposed as <code>QueryAppliedDirective</code>s.</li> <li><strong>New instrumentation hook for post-exception-handling results</strong> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4206";>#4206</a>, <a href="https://redirect.github.com/graphql-java/graphql-java/issues/4207";>#4207</a>) — observe the <code>DataFetcherResult</code> after <code>DataFetcherExceptionHandler</code> has mapped exceptions to errors. <code>ChainedInstrumentation</code> delegates the new hook correctly.</li> <li><strong>Generic <code>DataFetcherResult.newBuilder(T data)</code></strong> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4254";>#4254</a>) — removes the need for explicit type witnesses on the common <code>DataFetcherResult.<T>newResult().data(x)...</code> pattern.</li> <li><strong>Re-added <code>GraphQLSchema.Builder.clearDirectives()</code></strong> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4276";>#4276</a>) — useful with <code>GraphQLSchema.transform</code> to rewrite non-built-in directives; built-ins are always re-added.</li> <li><strong><code>toString()</code> on AST directives holders</strong> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4195";>#4195</a>).</li> </ul> <h2>⚡ Performance</h2> <ul> <li><strong>Incremental <code>@defer</code> execution starts earlier</strong> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4174";>#4174</a>) — begins processing deferred payloads as soon as the first incremental call is detected instead of waiting for the initial result to complete.</li> <li><strong>Validation consolidation</strong> (<a href="https://redirect.github.com/graphql-java/graphql-java/issues/4228";>#4228</a>) — all operation validation rules run in a single <code>OperationValidator</code> pass, significantly cutting validation overhead.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/graphql-java/graphql-java/commits";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
