Skip to content

chore(deps): upgrade graphql to v17 and update codegen dependencies - #5150

Merged
arkid15r merged 7 commits into
OWASP:mainfrom
Adarshkumar0509:fix/graphql-17-upgrade
Jul 9, 2026
Merged

chore(deps): upgrade graphql to v17 and update codegen dependencies#5150
arkid15r merged 7 commits into
OWASP:mainfrom
Adarshkumar0509:fix/graphql-17-upgrade

Conversation

@Adarshkumar0509

@Adarshkumar0509 Adarshkumar0509 commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Proposed change

Resolves #5151

Upgrades graphql from 16.14.0 to 17.0.0 and bumps codegen packages to versions that support graphql v17 peer dependency.

The Dependabot PR #5145 only bumped graphql itself, which caused E2E test failures because @graphql-codegen/cli@7.0.0 only supports up to graphql@^16.0.0.

This PR fixes that by upgrading:

  • @graphql-codegen/cli: 7.0.0 → 7.2.0
  • @graphql-codegen/typescript: 6.0.0 → 6.1.0
  • @graphql-codegen/typescript-operations: 6.0.0 → 6.1.0
  • @graphql-codegen/typed-document-node: 7.0.0 → 7.1.0

Checklist

  • Required: I followed the contributing workflow
  • Required: I verified that my code works as intended and resolves the issue as described
  • Required: I ran all required checks and tests locally; all warnings addressed and failures resolved
  • I used AI for code, documentation, tests, or communication related to this PR

Signed-off-by: Adarshkumar0509 <adarshkumarthakur0509@gmail.com>
@coderabbitai

coderabbitai Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Walkthrough

Upgrades the graphql package to v17.0.0 and updates related @graphql-codegen/* devDependencies to compatible versions, adds corresponding entries to the pnpm workspace's minimumReleaseAgeExclude list, and expands Next.js standalone output tracing to include GraphQL .mjs files.

Changes

GraphQL dependency bump

Layer / File(s) Summary
Dependency version updates
frontend/package.json, frontend/pnpm-workspace.yaml
graphql is bumped to 17.0.0, @graphql-codegen/cli, @graphql-codegen/typed-document-node, @graphql-codegen/typescript, and @graphql-codegen/typescript-operations devDependencies are upgraded, and matching pinned versions are added to the pnpm workspace minimumReleaseAgeExclude list.
Standalone GraphQL tracing
frontend/next.config.ts
The non-local build output: 'standalone' branch now also sets outputFileTracingIncludes to include node_modules/graphql/** and node_modules/graphql/index.mjs for correct ESM tracing.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: cubic-dev-ai, kasya

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The changes align with #5151 by upgrading graphql to v17 and bumping compatible codegen packages.
Out of Scope Changes check ✅ Passed The workspace and Next.js tracing updates support the graphql v17 upgrade and are not unrelated.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check ✅ Passed The title clearly summarizes the main dependency upgrade and GraphQL Codegen compatibility changes.
Description check ✅ Passed The description is directly related to the dependency upgrades and explains why the codegen updates were needed.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Adarshkumar0509 Adarshkumar0509 self-assigned this Jul 8, 2026
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Contribution validation failed:

  • issue_reference: This PR must be linked to an issue or include a valid closing issue reference in the description.

@github-actions github-actions Bot closed this Jul 8, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@frontend/package.json`:
- Around line 53-57: Add `@graphql-codegen/near-operation-file-preset` to the
minimumReleaseAgeExclude list in the workspace configuration so it matches the
version bump in package.json. Update the pnpm-workspace.yaml entry alongside the
dependency change, keeping it aligned with the other `@graphql-codegen/`* packages
and ensuring the dependency upgrade is reflected consistently across the
relevant config.

In `@frontend/pnpm-workspace.yaml`:
- Around line 32-43: The pnpm workspace exclusion list is missing the newly
added direct dependency `@graphql-codegen/near-operation-file-preset@5.2.1`, so
the `frontend/pnpm-workspace.yaml` package exclusions are incomplete. Update the
exclusion entries alongside the other `@graphql-codegen/*` packages to include
`@graphql-codegen/near-operation-file-preset@5.2.1`, keeping the workspace
filter consistent with the direct devDependency added in
`frontend/package.json`.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 48260b34-1451-46a5-8d94-7ed1657f8f8b

📥 Commits

Reviewing files that changed from the base of the PR and between 2f7b127 and 7e3313c.

⛔ Files ignored due to path filters (1)
  • frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (2)
  • frontend/package.json
  • frontend/pnpm-workspace.yaml

Comment thread frontend/package.json
Comment thread frontend/pnpm-workspace.yaml Outdated
@codecov

codecov Bot commented Jul 8, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.73%. Comparing base (1dc4fb7) to head (befb863).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main    #5150   +/-   ##
=======================================
  Coverage   98.73%   98.73%           
=======================================
  Files         536      536           
  Lines       16976    16976           
  Branches     2417     2417           
=======================================
  Hits        16761    16761           
  Misses        123      123           
  Partials       92       92           
Flag Coverage Δ
backend 99.44% <ø> (ø)
frontend 96.71% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.


Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1dc4fb7...befb863. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Adarshkumar0509 <adarshkumarthakur0509@gmail.com>
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Contribution validation failed:

  • issue_reference: This PR must be linked to an issue or include a valid closing issue reference in the description.

1 similar comment
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Contribution validation failed:

  • issue_reference: This PR must be linked to an issue or include a valid closing issue reference in the description.

@github-actions github-actions Bot closed this Jul 8, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jul 8, 2026
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Contribution validation failed:

  • issue_reference: This PR must be linked to an issue or include a valid closing issue reference in the description.

@github-actions github-actions Bot closed this Jul 8, 2026
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Contribution validation failed:

  • issue_reference: This PR must be linked to an issue or include a valid closing issue reference in the description.

@arkid15r

arkid15r commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

You can't resolve a PR, you need an issue instead.

@arkid15r arkid15r reopened this Jul 8, 2026
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

Contribution validation failed:

  • issue_reference: This PR must be linked to an issue or include a valid closing issue reference in the description.

@github-actions github-actions Bot closed this Jul 8, 2026
@Adarshkumar0509

Copy link
Copy Markdown
Collaborator Author

yes according to contribution guidelines i have to create a issue first. next time i will keep this thing in my mind

The 'all dropdown triggers should use pointer cursor' test was left
over from when Community had a dropdown submenu. PR OWASP#4100 replaced
the Community dropdown with a plain link, leaving this test broken.
Removes the obsolete test.

Signed-off-by: Adarshkumar0509 <adarshkumarthakur0509@gmail.com>
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jul 8, 2026
cubic-dev-ai[bot]
cubic-dev-ai Bot previously approved these changes Jul 8, 2026

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

Confidence score: 5/5

  • Automated review surfaced no issues in the provided summaries.
  • No files require special attention.

Re-trigger cubic

@Adarshkumar0509

Copy link
Copy Markdown
Collaborator Author

hii @arkid15r the ChapterDetails and CommitteeDetails E2E failures are caused by missing data in the CI database dump I confirmed this locally via pg_restore --data-only which returns nothing for /chapters/rosario and /committees/events. Could you update the S3 dump with this data?

@arkid15r

arkid15r commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

hii @arkid15r the ChapterDetails and CommitteeDetails E2E failures are caused by missing data in the CI database dump I confirmed this locally via pg_restore --data-only which returns nothing for /chapters/rosario and /committees/events. Could you update the S3 dump with this data?

I'm not sure that's the root cause. Why did it pass with the previous package version? We didn't touch the dump for a while. I understand there might be time-related entity failure for events but I don't think it's the case here.

Signed-off-by: Adarshkumar0509 <adarshkumarthakur0509@gmail.com>
@Adarshkumar0509

Copy link
Copy Markdown
Collaborator Author

hii @arkid15r My local e2e run passes 252/252. Could you take a look at what differs in the CI environment?
image

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown

Contribution validation failed:

  • commit_sign_off: One or more commits are missing or have an invalid Signed-off-by trailer.

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown

Contribution validation failed:

  • commit_sign_off: One or more commits are missing or have an invalid Signed-off-by trailer.

@sonarqubecloud

sonarqubecloud Bot commented Jul 9, 2026

Copy link
Copy Markdown

@arkid15r
arkid15r marked this pull request as ready for review July 9, 2026 00:54
@arkid15r
arkid15r requested review from arkid15r and kasya as code owners July 9, 2026 00:54
@arkid15r
arkid15r marked this pull request as draft July 9, 2026 00:54

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@frontend/package.json`:
- Line 29: The dependency set is inconsistent because
`@graphql-codegen/near-operation-file-preset`@5.2.1 only supports graphql up to
v16 while frontend/package.json already pins graphql to 17.0.0. Update the
codegen preset version (and any related codegen package entries in the same
dependency block) to a release that declares GraphQL 17 support, keeping the
existing graphql and `@apollo/client` versions aligned. Use the package.json
dependency declarations to locate the codegen preset entry and adjust it so the
peer range matches graphql@17.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 87a59da9-3a9c-4839-99f4-3ca7cc5a56fd

📥 Commits

Reviewing files that changed from the base of the PR and between e2f2295 and a4be6f9.

⛔ Files ignored due to path filters (1)
  • frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (3)
  • frontend/next.config.ts
  • frontend/package.json
  • frontend/pnpm-workspace.yaml

Comment thread frontend/package.json

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

0 issues found across 3 files (changes from recent commits).

Re-trigger cubic

@arkid15r
arkid15r marked this pull request as ready for review July 9, 2026 01:02

@arkid15r arkid15r left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The e2e tests failed locally too, it wasn't a CI only issue. See my commits for the fix details.

Comment thread e2e/components/Header.spec.ts
@arkid15r
arkid15r enabled auto-merge July 9, 2026 01:03
@arkid15r
arkid15r added this pull request to the merge queue Jul 9, 2026
Merged via the queue into OWASP:main with commit 5a40c50 Jul 9, 2026
32 of 33 checks passed
@Adarshkumar0509

Copy link
Copy Markdown
Collaborator Author

Now I can see it was failing because graphql v17's ESM .mjs files weren't being traced by Next.js

@Adarshkumar0509
Adarshkumar0509 deleted the fix/graphql-17-upgrade branch July 9, 2026 01:57
arkid15r added a commit to Nachiket-Roy/Nest that referenced this pull request Jul 9, 2026
…WASP#5150)

* chore(deps): upgrade graphql to v17 and update codegen dependencies

Signed-off-by: Adarshkumar0509 <adarshkumarthakur0509@gmail.com>

* chore(deps): add near-operation-file-preset to minimumReleaseAgeExclude

Signed-off-by: Adarshkumar0509 <adarshkumarthakur0509@gmail.com>

* fix(e2e): remove stale dropdown cursor test from Header spec

The 'all dropdown triggers should use pointer cursor' test was left
over from when Community had a dropdown submenu. PR OWASP#4100 replaced
the Community dropdown with a plain link, leaving this test broken.
Removes the obsolete test.

Signed-off-by: Adarshkumar0509 <adarshkumarthakur0509@gmail.com>

* ci: trigger e2e re-run

Signed-off-by: Adarshkumar0509 <adarshkumarthakur0509@gmail.com>

* Update code

* Update code

---------

Signed-off-by: Adarshkumar0509 <adarshkumarthakur0509@gmail.com>
Co-authored-by: Arkadii Yakovets <arkadii.yakovets@owasp.org>
@coderabbitai coderabbitai Bot mentioned this pull request Jul 26, 2026
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore(deps): upgrade graphql to v17 and update codegen dependencies

3 participants