refactor: Bump @graphql-tools/utils, @graphql-tools/schema and @graphql-tools/merge by dependabot[bot] · Pull Request #10760 · parse-community/parse-server

dependabot · 2026-10-07T16:17:01Z

Bumps @graphql-tools/utils, @graphql-tools/schema and @graphql-tools/merge. These dependencies needed to be updated together.
Updates @graphql-tools/utils from 11.2.2 to 13.2.1

Changelog

Sourced from @graphql-tools/utils's changelog.

13.2.1

Patch Changes

#8626 cc144f6 Thanks @dependabot! - dependencies updates:

Updated dependency @whatwg-node/promise-helpers@^2.0.1 ↗︎ (from ^2.0.0, in dependencies)

#8628 03f8963 Thanks @ardatan! - Cache collectFields / collectSubfields across executions when the document has no variable-conditional @skip, @include, or @defer, so variableValues are omitted from the cache key for those documents.

13.2.0

Minor Changes
#8606 6da2904 Thanks @ardatan! - loadDocuments / loadTypedefs now accept errorHandling so a single invalid file does not have to hide the rest of the load.

A glob that mixes a valid operation with broken SDL used to throw the first Syntax Error and drop every other file:
# valid.query.graphql
query ValidQuery {
  a
}
# broken-a.query.graphql
query {
  a
await loadDocuments('**/*.query.graphql', {
  loaders: [new GraphQLFileLoader()],
});
// throws Syntax Error
errorHandling chooses what happens next. The default is unchanged (throw the first error).

aggregate waits until every source is attempted, then throws AggregateError with each parse/load failure:
await loadDocuments('**/*.query.graphql', {
  loaders: [new GraphQLFileLoader()],
  errorHandling: 'aggregate',
});
return does not throw. Failed sources stay in the result as { location, error } without a document, next to the sources that parsed:

... (truncated)

Commits

de82865 chore(release): update monorepo packages versions (#8622)
cc144f6 build(deps): bump the actions-deps group with 4 updates (#8626)
03f8963 perf(executor): cache collectFields without variableValues when safe (#8628)
27e7848 build(deps): bump the actions-deps group across 1 directory with 11 updates (...
1f47fd6 chore(release): update monorepo packages versions (#8599)
f956bfe fix(utils): coerce singleton list inputs, including empty string (#8608)
6da2904 feat(load): add errorHandling for loadDocuments parse failures (#8606)
58061cb docs(schema-directives): validate input @length and document transformer orde...
7770067 fix(utils): rewire only types that reference a replacement (#8588)
5665102 test(utils): assert printSubgraphSchema stable after mapSchema (#4881) (#8597)
Additional commits viewable in compare view

Updates @graphql-tools/schema from 10.0.31 to 10.1.5

Changelog

Sourced from @graphql-tools/schema's changelog.

10.1.5

Patch Changes
#8445 82457d1 Thanks @ardatan! - dependencies updates:

Updated dependency @graphql-tools/merge@^9.2.7 ↗︎ (from ^9.2.6, in dependencies)

Updated dependency @graphql-tools/utils@^12.0.4 ↗︎ (from ^12.0.3, in dependencies)
#8445 82457d1 Thanks @ardatan! - Fix: Preserve symbol-keyed GraphQL extensions when building, merging, or extracting schemas.

GraphQL.js v17 allows string | symbol keys on schema/type/field extensions (via toObjMapWithSymbols). @graphql-tools was dropping those symbol keys in two places:

mergeDeep only walked enumerable string keys (for...in), so symbol extensions were lost when applying schemaExtensions.

extractExtensionsFromSchema did not copy non-enumerable own symbol keys (enumerable symbols already survive object rest/spread; the explicit loop covers the non-enumerable case).

Example (bug)
import { makeExecutableSchema } from '@graphql-tools/schema'
const META = Symbol('META')
const schema = makeExecutableSchema({
typeDefs: /* GraphQL */ type Query { hello: String },
schemaExtensions: {
schemaExtensions: {
[META]: { source: 'app' },
tagged: true,
},
types: {},
},
})
// Before: only string keys survived
// schema.extensions === { tagged: true }
// After: symbol keys are preserved
// schema.extensions[META] === { source: 'app' }
// schema.extensions.tagged === true
Schema extension merge/extract and resolver merging always enable { enumerable: true, nonEnumerable: true } so symbol keys survive in tools' own merge/extract paths on every supported GraphQL.js major. (GraphQL.js itself may still drop symbol keys from field configs below v17 when rebuilding types.)

mergeDeep API

mergeDeep now accepts an options object. The old positional boolean arguments still work but are deprecated.

... (truncated)

Commits

3634233 chore(release): update monorepo packages versions (#8505)
82457d1 fix: preserve symbol-keyed schema extensions (#8445)
28d08e8 chore(release): update monorepo packages versions (#8486)
944121e Upcoming Release Changes (#8483)
3a43b4b Upcoming Release Changes (#8460)
8b9b7df chore(release): update monorepo packages versions (#8365)
23ca392 chore(deps): update dependency graphql-scalars to v2 (#8385)
ce2470a build(deps): bump the actions-deps group with 8 updates (#8377)
0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
9feabd9 chore(release): update monorepo packages versions (#8327)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @graphql-tools/schema since your current version.

Updates @graphql-tools/merge from 9.1.7 to 9.2.8

Changelog

Sourced from @graphql-tools/merge's changelog.

9.2.8

Patch Changes
#8445 82457d1 Thanks @ardatan! - dependencies updates:

Updated dependency @graphql-tools/utils@^12.0.4 ↗︎ (from ^12.0.3, in dependencies)
#8445 82457d1 Thanks @ardatan! - Fix: Preserve symbol-keyed GraphQL extensions when building, merging, or extracting schemas.

GraphQL.js v17 allows string | symbol keys on schema/type/field extensions (via toObjMapWithSymbols). @graphql-tools was dropping those symbol keys in two places:

mergeDeep only walked enumerable string keys (for...in), so symbol extensions were lost when applying schemaExtensions.

extractExtensionsFromSchema did not copy non-enumerable own symbol keys (enumerable symbols already survive object rest/spread; the explicit loop covers the non-enumerable case).

Example (bug)
import { makeExecutableSchema } from '@graphql-tools/schema'
const META = Symbol('META')
const schema = makeExecutableSchema({
typeDefs: /* GraphQL */ type Query { hello: String },
schemaExtensions: {
schemaExtensions: {
[META]: { source: 'app' },
tagged: true,
},
types: {},
},
})
// Before: only string keys survived
// schema.extensions === { tagged: true }
// After: symbol keys are preserved
// schema.extensions[META] === { source: 'app' }
// schema.extensions.tagged === true
Schema extension merge/extract and resolver merging always enable { enumerable: true, nonEnumerable: true } so symbol keys survive in tools' own merge/extract paths on every supported GraphQL.js major. (GraphQL.js itself may still drop symbol keys from field configs below v17 when rebuilding types.)

mergeDeep API

mergeDeep now accepts an options object. The old positional boolean arguments still work but are deprecated.

... (truncated)

Commits

3634233 chore(release): update monorepo packages versions (#8505)
82457d1 fix: preserve symbol-keyed schema extensions (#8445)
691cbd7 build(deps): bump the actions-deps group across 1 directory with 16 updates (...
28d08e8 chore(release): update monorepo packages versions (#8486)
a73dd1d build(deps-dev): bump the actions-deps group across 1 directory with 3 update...
944121e Upcoming Release Changes (#8483)
3a43b4b Upcoming Release Changes (#8460)
20d36a5 fix(utils): block prototype pollution in mergeIncrementalResult paths
77bbaec build(deps): bump the actions-deps group with 7 updates (#8434)
861011f build(deps): bump the actions-deps group with 6 updates (#8432)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @graphql-tools/merge since your current version.

coderabbitai · 2026-10-07T16:17:10Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: e907e53a-d9c3-4e5d-80ff-403c253a0eee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

codecov · 2026-10-07T16:27:47Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.21%. Comparing base (e379536) to head (89620da).
⚠️ Report is 1 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10760   +/-   ##
=======================================
  Coverage   94.21%   94.21%           
=======================================
  Files         193      193           
  Lines       17433    17433           
  Branches      247      247           
=======================================
  Hits        16425    16425           
  Misses        988      988           
  Partials       20       20

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

parse-github-assistant · 2026-10-20T18:13:20Z