Bump @graphql-tools/utils from 11.2.2 to 12.0.1

[dependabot]

Bumps @graphql-tools/utils from 11.2.2 to 12.0.1.

Changelog

Sourced from @​graphql-tools/utils's changelog.

12.0.1

Patch Changes

• #8368 60db079 Thanks @​ardatan! - Omit mutation/subscription from printSchemaWithDirectives when those root types are no longer present on the schema (e.g. after pruneSchema).

• #8366 57e316d Thanks @​ardatan! - Allow % in paths checked by isValidPath (e.g. directories from URL-encoded repo names).

• #8370 1c1c5a0 Thanks @​ardatan! - Clean up observableToAsyncIterable queues and unsubscribe when the observable completes, so iterators do not retain references after done. Fixes leak detection flakes related to #8057.

• #8370 1c1c5a0 Thanks @​ardatan! - Prefer runtime description values over stale astNode descriptions in printSchemaWithDirectives / getDescriptionNode. Fixes #5508.

• #8423 0b9529f Thanks @​enisdenjo! - Fix prototype pollution in mergeDeep

  Source keys named __proto__, constructor or prototype are now skipped at every recursion level, and the check for an existing key uses hasOwnProperty instead of in, so inherited properties are never used as merge targets.

  Previously, merging untrusted data such as JSON.parse('{"constructor":{"__proto__":{"call":"x"}}}') could reach and overwrite properties on Object.prototype or Function.prototype.

12.0.0

Major Changes

• #8346 2273c21 Thanks @​ardatan! - This release adds GraphQL v17 support and aligns the existing executor implementation with the latest GraphQL v17 API changes. The following changes are included:

  • getAsyncHelpers is now available on GraphQLResolveInfo. Its track method is used whenever waitUntil is available, as in Yoga's Explicit Resource Management
  • getAbortSignal is now available on GraphQLResolveInfo, matching behavior that was already available in this executor implementation, as in Yoga's Execution Cancellation
  • GraphQLResolveInfo automatically aligns variableValues according to the GraphQL version for better compatibility. In GraphQL v17 and above, variableValues follows the wrapped shape ({ coerced, sources }) expected by GraphQL APIs. In GraphQL v16 and below, variableValues remains a flat map as in previous versions.
  • If your custom scalar resolvers define __serialize and __parseValue, they are automatically mapped to coerceOutputValue and coerceInputValue in GraphQL v17.
  • BREAKING: @graphql-tools/executor's getVariableValues now returns { variableValues } on success, where variableValues is a VariableValues object ({ coerced, sources }). On failure, it returns { errors }.
  • BREAKING: collectFields, shouldIncludeNode, getDeferValues, and collectSubFields now need a VariableValues object instead of Record<string, any> for the variableValues argument.
  • visitResult now internally normalizes ExecutionRequest.variables into a VariableValues-compatible shape ({ coerced, sources }) before traversing selections.

Commits

• 8b9b7df chore(release): update monorepo packages versions (#8365)
• 0b9529f Fix prototype pollution in mergeDeep (#8423)
• 23ca392 chore(deps): update dependency graphql-scalars to v2 (#8385)
• 60db079 fix(utils): omit pruned root operations from printSchemaWithDirectives (#8368)
• ce2470a build(deps): bump the actions-deps group with 8 updates (#8377)
• 0f00a44 chore: use HTTPS git URLs for package repository metadata (#8376)
• 1c1c5a0 fix: load errors, observable cleanup, descriptions, and import attributes (#8...
• 57e316d fix: optimize descriptions, isValidPath %, and mock resolverValidationOptions...
• 9feabd9 chore(release): update monorepo packages versions (#8327)
• 2273c21 GraphQL 17 Compatibility (#8346)
• Additional commits viewable in compare view