graphql-java-servlet icon indicating copy to clipboard operation
graphql-java-servlet copied to clipboard
verified publisher icon graphql-java-kickstart

fix(deps): update dependency com.graphql-java:graphql-java to v25

Open renovate[bot] opened this issue 10 months ago • 4 comments

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
com.graphql-java:graphql-java 22.3 -> 25.0 age confidence

Release Notes

graphql-java/graphql-java (com.graphql-java:graphql-java)

v25.0: 25.0

Key changes

Dataloader

Refactoring strategy

The existing PerLevelDataLoaderStrategy has been refactored which lead to simplifications and performance improvements.

New strategies

Two new strategies were introduced: CHAINED and EXHAUSTED. Both can be configured via UnusalConfiguration (see next section).

CHAINED allow for chained DataLoaders to be used while keeping a per level dispatch strategies.

EXHAUSTED is a completely new strategy that works on the basis to dispatch once the engine is not busy. It mirrors the JS data loader dispatch strategy, but for a multi threaded system.

Unusual Configuration

A more generalised configuration mechanism has been added for "unusual configuration". By that we mean configuation we dont expect many people to use but if they do its now in a more common place

For example if you wanted to change the maximum depth the document parser will accept you could call the following methods.

        var parserOptions = newParserOptions().maxRuleDepth(99).build()
        GraphQL.unusualConfiguration().parsing().setDefaultParserOptions(parserOptions)
JSpecify Annotations

The team are starting to embrace https://jspecify.dev/ annotations as the way to indicate nullable and non nullable fields. Many important classes have had these annotations added to help make it more semantically clear when a value can be null or not.

Breaking Changes

A wrapping FetchedValue object is not always returned on field fetchers for performance reasons. This means that graphql.execution.instrumentation.parameters.InstrumentationFieldCompleteParameters#getFetchedObject was created to replace the older getFetchedValue method and the returns object can sometimes be a FetchedValue or sometimes a simple POJO value.

Performance improvements

A series of performance improvements have been made to reduce the memory footprint of the library. Also the Java .stream() operator can be slower than a more direct loop and many of these calls have been changed for performance reasons.

What's Changed

New Contributors

Full Changelog: https://github.com/graphql-java/graphql-java/compare/v23.0...v25.0

v24.3: 24.3

This small bug fix brings in java-dataloader 5.0.3 which itself has a fix such that the Kotlin stdlib is not included a POM dependency

See https://github.com/graphql-java/java-dataloader/releases/tag/v5.0.3 for more details

What's Changed

Full Changelog: https://github.com/graphql-java/graphql-java/compare/v24.2...v24.3

v24.2: 24.2

This is a small bugfix release, to use the latest version of DataLoader that includes nullability annotation improvements. Thanks to the community to providing feedback.

See https://github.com/graphql-java/java-dataloader/releases/tag/v5.0.2 and https://github.com/graphql-java/java-dataloader/releases/tag/v5.0.1 for the details

What's Changed

Full Changelog: https://github.com/graphql-java/graphql-java/compare/v24.1...v24.2

v24.1: 24.1

This is bugfix release for 24.

Main change is #​3994: If you have defer enabled (an experimental feature) and use data loaders for mutations your requests would hang, because the data loaders are not dispatched correctly.

Additionally this release contains #​3995.

Cheers

What's Changed

Full Changelog: https://github.com/graphql-java/graphql-java/compare/v24.0...v24.1

v24.0: 24.0

24.0 is a breaking change

This release is an unexpected breaking change release. It was made to help propagate a fix in the DataLoader library

In DataLoader version 4.0.0 we introduced immutability into the DataLoaderOptions class, which was a good thing.

However it left the old mutative setXXX methods in place and made them immutable. This was a mistake. This leads to bugs at runtime for example

DataLoaderOptions options = DataLoaderOptions.newOptions();
if (maxBatchSize != BatchLoader.UNSET_BATCH_SIZE) {
  options.setMaxBatchSize(maxBatchSize);
}
return options.setCacheMap(cache);

The above code would continue to compile but the setMaxBatchSize() would never take affected at runtime with the immutable support.

So to help address this bug a DataLoader version 5.0.0 was released and it has removed the setXXX methods and requires the Builder methods to be used to ensure that code that relied on the old mutative methods now break at compile time and not at runtime.

In turn we have released this new version of graphql-java - we have designated it a breaking change because of this transitive DataLoader breaking change

We consider v23.x poisoned and we don't recommend you use it because of the latent bug above.

But the release notes of 23 are still relevant when you upgrade from 22: https://github.com/graphql-java/graphql-java/releases/tag/v23.0

Small performance fixes

There are also a set of small performance oriented fixes that have gone out in this release.

What's Changed

Full Changelog: https://github.com/graphql-java/graphql-java/compare/v23.1...v24.0

v23.1: 23.1

Do Not Use

Version 23.x is considered poisoned and we don't recommend you upgrade to it

See the release notes of v24 for more details on what this is the case.

Previous release notes

This reverts a bug in 23.0 introduced in #​3871.

Please use 23.1, and not 23.0.

Update: we will shortly release 24.0, which replaces the 23 line of releases. Please do not use any v23 releases going forward.

v23.0: 23.0

Do Not Use

Version 23.x is considered poisoned and we don't recommend you upgrade to it

See the release notes of v24 for more details on what this is the case.

Previous release notes

Notice: there is a bug with https://redirect.github.com/graphql-java/graphql-java/pull/3871/files, a new bugfix release is about to be released. Use 23.1 instead, not 23.0

Thanks to everyone for contributing to this release, through pull requests, issues, and discussions!

This is a major release which contains breaking changes.

Key changes

Performance improvements

See all performance improvements on GitHub: https://github.com/graphql-java/graphql-java/issues?q=is%3Amerged%20label%3A%22performance%22%20milestone%3A%2223.0%20breaking%20changes%22%20

Breaking changes

  • Strict runtime wiring redefinition checks now on by default. We now have stricter runtime wiring redefinition checks by default to catch invalid cases. For example, a field that already had a DataFetcher registered must not have a second DataFetcher registered. This can be toggled off. #​3824

  • Removed an unused protected method in ExecutionStrategy. #​3881

  • A small breaking change to AstPrinter to enable re-use of StringBuilders #​3853

  • Improvement in a few directive and applied directive builders to address a bug where all elements were cleared. #​3825

  • Breaking change for a new specification requirement, to prevent @include and @skip directives on subscription root fields #​3871

See all breaking changes on GitHub: https://github.com/graphql-java/graphql-java/issues?q=is%3Amerged%20label%3A%22breaking%20change%22%20milestone%3A%2223.0%20breaking%20changes%22

Security

We have become a CVE Numbering Authority (CNA) for GraphQL Java and related projects. For more information, see our Security page https://www.graphql-java.com/security.

What's Changed

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar Apr 07 '25 02:04 renovate[bot]

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud[bot] avatar Apr 15 '25 11:04 sonarqubecloud[bot]

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud[bot] avatar May 16 '25 06:05 sonarqubecloud[bot]

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud[bot] avatar Jul 28 '25 06:07 sonarqubecloud[bot]

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud[bot] avatar Nov 10 '25 05:11 sonarqubecloud[bot]