Bump com.graphql-java:graphql-java from 25.0 to 26.1

[dependabot]

Bumps com.graphql-java:graphql-java from 25.0 to 26.1.

Release notes

Sourced from com.graphql-java:graphql-java's releases.

26.1

This is a bugfix release for 26.

It contains a couple of fixes and no breaking changes.

List of PRs

• #4452 Backport 26.1: Remove dependency annotations from shaded classes
• #4443 Backport to 26.1: Fix nullable bound on DataFetcherResult.newResult
• #4444 Backport to 26.1: Fix covariance checks for SDL type extensions
• #4448 Backport 26.1: Fix input cycle validation for non-null lists
• #4447 Backport 26.1: Allow empty unions to be completed by extensions
• #4449 Backport 26.1: Fix subscription alternative call context cleanup
• #4446 Backport 26.1: Fix schema rebuild after root type deletion
• #4457 Backport 26.1: Mark InstrumentationState callback params as @​Nullable
• #4451 Backport 26.1: Reject cyclical SDL directive definitions
• #4450 Backport 26.1: validate circular default values

Full Changelog: graphql-java/graphql-java@v26.0...v26.1

26.0

This is the 26.0 release of graphql-java. Highlights are summarized below; the full list of merged PRs is at the end.

⚠️ Breaking Changes

Query complexity limits are now enforced by default

New QueryComplexityLimits validation checks maxDepth (default 100) and maxFieldsCount (default 100,000) as part of standard validation. Queries exceeding these limits will now fail with new MaxQueryDepthExceeded / MaxQueryFieldsExceeded validation errors.

• Set custom limits via GraphQLContext using QueryComplexityLimits.KEY.
• Disable entirely with QueryComplexityLimits.NONE.

Introduced in #4256.

Validation rule filtering API changed

In #4228 the rule-filter predicate changed from Predicate<Class<?>> to Predicate<OperationValidationRule> in Validator.validateDocument(...) and ParseAndValidate.parseAndValidate(...). Callers that filtered by class (e.g. rule -> rule != NoUnusedFragments.class) must migrate to the enum (rule -> rule != OperationValidationRule.NO_UNUSED_FRAGMENTS). The @Internal classes AbstractRule and RulesVisitor were removed.

Built-in directive handling consolidated (#4229)

• DirectiveInfo was removed. Replace usages:
  • DirectiveInfo.isGraphqlSpecifiedDirective(...) → Directives.isBuiltInDirective(...)
  • DirectiveInfo.GRAPHQL_SPECIFICATION_DIRECTIVES → Directives.BUILT_IN_DIRECTIVES
  • DirectiveInfo.GRAPHQL_SPECIFICATION_DIRECTIVE_MAP → Directives.BUILT_IN_DIRECTIVES_MAP
• Directive ordering is now consistent: all 7 built-in directives appear first, followed by user-defined directives.
• GraphQLSchema.Builder.clearDirectives() was initially removed then re-added in #4276 with new semantics — it clears all additionalDirectives, but built-in directives are always re-added automatically at build time.

OneOf inhabitability validation (#4248)

New validator rejects OneOf input types that cannot be populated with a finite value (e.g. input A @oneOf { a: A }). Schemas that previously validated may now be rejected.

Non-null field validation for code-built schemas (#4194)

Code-built schemas now perform the same deprecated-on-non-null field validation as SDL-built ones. Schemas relying on the gap may now fail validation.

... (truncated)

Commits

• 722262d Merge pull request #4450 from graphql-java/codex/backport-4253-to-26.x
• 40c578f Merge pull request #4451 from graphql-java/codex/backport-4385-to-26.x
• 915bf1e Simplify circular default value validation
• 9158901 Simplify directive cycle detection
• 7a7774d Merge pull request #4457 from graphql-java/codex/backport-4435-to-26.x
• 9be7527 Propagate nullable chained instrumentation state
• ac661d0 fix: mark InstrumentationState callback params as @​Nullable
• 2073c98 Merge pull request #4446 from graphql-java/codex/backport-4390-to-26.x
• d81252f Merge pull request #4449 from graphql-java/codex/backport-4384-to-26.x
• 8d6eaba Merge remote-tracking branch 'origin/26.x' into codex/backport-4390-to-26.x
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)