16.7.0

What's Changed

• Update npm runtime dependencies in the website by @glen-84 in #10311
• Add batch and cache DataLoader interfaces by @michaelstaib in #10305
• Update vulnerable transitive npm packages in the website by @glen-84 in #10316
• Add keyed service support to DataLoaders by @michaelstaib in #10314
• Fix planner selecting Apollo @external key fields from non-resolving subgraphs by @michaelstaib in #10318
• Tolerate dispose failures when stopping ASB receive endpoints by @glen-84 in #10315
• Update Testcontainers to clear the SSH.NET vulnerability by @glen-84 in #10322
• Remove stale project entry from the Primitives solution by @glen-84 in #10323
• Retry the Fusion archive open when a concurrent reader holds it by @glen-84 in #10324
• Fix ambiguous wait patterns in the Nitro e2e tapes by @glen-84 in #10325
• Merge same-named fields across fragments in MCP tool output schemas by @glen-84 in #10326
• Surface tool creation failures as unavailable MCP tools by @glen-84 in #10328
• Narrow fragment spreads to their type condition in MCP tool schemas by @glen-84 in #10329
• Add wide condition mask by @michaelstaib in #10319
• Follow-up cleanups for wide condition masks by @michaelstaib in #10331
• Fix UpdateTools forwarding in the aggregate MCP diagnostic events by @glen-84 in #10330
• Improve devcontainer by @tobias-tengler in #10333
• Replace Squadron with CookieCrumble Testcontainers resources by @glen-84 in #10338
• Share test containers per assembly via xUnit assembly fixtures by @glen-84 in #10342
• Skip Fusion Redis tests from the test body when Redis is unreachable by @glen-84 in #10343
• Fix the mail wake coordinator test's dropped cancellation event by @glen-84 in #10344
• Fix GeoJSON polygon coordinates dropping the exterior ring with holes by @glen-84 in #10345
• Fix GeoJSON MultiPolygon coordinates flattening each polygon's rings by @glen-84 in #10347
• Fix Spatial fragment tests snapshotting unknown type errors by @glen-84 in #10348
• Re-enable the point input test for a missing geometry type by @glen-84 in #10350
• Fix the polygon input execution test passing a single ring literal by @glen-84 in #10351
• Widen the subscription timer reset test's outer deadline to 30 seconds by @glen-84 in #10352
• Fix Mocha saga fault handling so OnReplyFault fires by @alisan3 in #10313
• Add configurable WebSocket message size limit by @michaelstaib in #10354
• Update browserslist, Next.js, and ESLint by @tobias-tengler in #10355
• Update Security Policy by @michaelstaib in #10353
• Fix pruning of list-wrapped @require input types during composition by @michaelstaib in #10346
• Detect unbreakable OneOf input object cycles in schema validation by @glen-84 in #10356
• Run in-process retries in a fresh scope so saga concurrency conflicts resolve by @alisan3 in #10327
• Provision BindFrom bindings for queues that opt in by @alisan3 in #10335
• Enable XML documentation generation in test projects by @glen-84 in #10358
• Make single-target local builds opt-in by @tobias-tengler in #10359
• Update backend devcontainer to Bookworm by @tobias-tengler in #10360
• Fix retry feature activation in mocha by @PascalSenn in #10363
• Add support for empty selection sets by @michaelstaib in #10337
• Derive exported batching flags from the server's batching options by @glen-84 in #10368
• Create the schema export directory when it does not exist by @glen-84 in #10369
• Allow Dictionary<TKey, T> as DataLoader return type by @michaelstaib in #10370
• Report the reason for rejected batch requests to server diagnostics by @glen-84 in #10372
• Fix Utf8MemoryBuilder state after sealing or abandoning by @michaelstaib in #10378
• Resolve MCP handler services from the schema in stateless mode by @glen-84 in #10379
• Return 405 for MCP GET and DELETE in stateless mode by @glen-84 in #10380
• Add inaccessible switch to global object identification options by @michaelstaib in #10381
• [Diagnostics] Emit GraphQL spans for the persisted operation endpoint by @tobias-tengler in #10382
• Enforce IDE code style in CI builds by @glen-84 in #10383
• Enforce warnings as errors in the Fusion execution benchmarks by @glen-84 in #10385
• Keep generated Fusion operation names valid for every hash format by @glen-84 in #10388
• Reject non-ASCII characters in GraphQL name validation by @glen-84 in #10389
• [Website] Document v16 telemetry and subgraph operation name changes by @glen-84 in #10386
• [Diagnostics] Improve WebSocket handling by @tobias-tengler in #10390
• [Diagnostics] Give every batch item its own request span by @tobias-tengler in #10393
• Fix GraphQL over HTTP conformance gaps in the HTTP pipeline by @glen-84 in #10392
• Resolve the HTTP transport version to a dated revision by @glen-84 in #10395
• Add the opt-in Draft20260903 HTTP transport version by @glen-84 in #10398
• [Website] Clear every npm audit advisory by @glen-84 in #10399
• [Fusion] Version the operation plan JSON and publish its schema by @tobias-tengler in #10400
• Drop build scripts and devDependencies from the prebuilt Mocha visualizer by @glen-84 in #10401
• [Fusion] Add IgnoreAdditionalInputFields option by @tobias-tengler in #10403
• Add AddNodeField option to disable Query.node while keeping the Node interface by @michaelstaib in #10404
• Enable variable batching by default by @michaelstaib in #10405
• Fix input path leaking into the error path during variable coercion by @michaelstaib in #10406
• Add push full agent mail by @michaelstaib in #10340
• [Fusion] Add OperationPlanner version by @tobias-tengler in #10409
• Remove the CLAUDE.md pointer now that Claude reads AGENTS.md by @glen-84 in #10410
• Simplify redundant type references in the Nitro CLI by @glen-84 in #10411
• Update Marten and pin MongoDB transitives to secure versions by @glen-84 in #10412
• Add opt-in covariant field merging to selection set validation by @glen-84 in #10413
• Add Opencode hooks to nitro agent by @michaelstaib in #10366
• Add the covariant field merging opt-in to StrawberryShake codegen by @glen-84 in #10414
• Fix BindRuntimeType for byte[] and dictionaries nested in lists by @glen-84 in #10417
• [Website] Document byte[] to Base64String as an explicit binding by @glen-84 in #10418
• Add opt-in support for the HTTP QUERY method by @glen-84 in #10420
• [Fusion] Add a planning fingerprint to gateway archives and expose it to the planner by @tobias-tengler in #10421
• Apply sorting after the resolver's Select projection by @glen-84 in #10422
• Adds nitro skills to Nitro Commandline by @PascalSenn in #10303
• Add IBM cost spec support to fusion by @michaelstaib in #10374
• Apply explicit null variable defaults when variables are omitted by @glen-84 in #10424
• Add Mocha to the issue labeler by @glen-84 in #10426
• Add PR title conventions to AGENTS.md by @glen-84 in #10427
• [Website] Add inline code syntax highlighting by @tobias-tengler in #10428
• Fix missing pipeline state answering 400 or 422 instead of 500 by @glen-84 in #10430
• Add GraphQL spec version serialization options by @michaelstaib in #10407
• [Fusion] Fix an empty variable batch answering 500 instead of 400 or 422 by @glen-84 in #10433
• Fix the HTTP QUERY activity test failing on .NET 9 by @glen-84 in #10434
• Fix tests that fail when running all target frameworks by @glen-84 in #10435
• Bump .NET 11 SDK and packages to RC 1 by @glen-84 in #10436
• Rework the agent views for nitro agent by @michaelstaib in #10431
• Treat warnings as errors in the CostAnalysis benchmarks by @glen-84 in #10437
• Fix style errors in the Nitro CLI by @glen-84 in #10439
• Answer 413 for an oversized request body under Draft20260903 by @glen-84 in #10440
• Refuse an empty variable batch in the HTTP transport by @glen-84 in #10441
• Fix source-generated batch resolvers with a keyed service not compiling by @glen-84 in #10442
• [OpenAPI] Fix MapOpenApiEndpoints not resolving a single named schema by @tobias-tengler in #10443
• [Nitro CLI] Add --force option to client unpublish by @tobias-tengler in #10444
• [Nitro CLI] Add ref and pullRequestNumber to source metadata by @tobias-tengler in #10445
• [Nitro CLI] Use the dedicated Fusion validation flow in fusion validate by @tobias-tengler in #10446
• Remove frontend devcontainer requirement by @michaelstaib in #10432
• [Nitro CLI] Forward source metadata in fusion validate by @tobias-tengler in #10448
• Add fullstack devcontainer by @tobias-tengler in #10449
• Fix schema reloads disposing application services by @tobias-tengler in #10450
• Update CI actions, tools, and runner images by @glen-84 in #10451
• Answer 413 for multipart and server body limits under Draft20260903 by @glen-84 in #10452
• Remove the dead HttpContext.Items read from ParseContentType by @glen-84 in #10453
• Fix the HTTP request span reporting named schemas as _Default by @glen-84 in #10454
• Answer a single result as multipart or SSE only when the client names it by @glen-84 in #10455
• Update vulnerable npm packages and gate SpecVersion test installs by @glen-84 in #10456
• [Website] Update Next.js and DOMPurify to clear security advisories by @glen-84 in #10457
• [Website] Document the 16.7 response format selection changes by @glen-84 in #10459
• [Website] Remove the CLAUDE.md that imports AGENTS.md by @glen-84 in #10460
• Fix EventSource never receiving the SSE complete event by @glen-84 in #10462
• [Mocha] Fix message identity collisions for nested types by @tobias-tengler in #10466
• [Mocha] Fix the mediator throwing when a notification has no handlers by @tobias-tengler in #10465
• [Nitro] Add nitro agent backup command by @michaelstaib in #10470
• Pin dtolnay/rust-toolchain to master instead of stable by @glen-84 in #10476
• [Mocha] Fix PostgreSQL outbox persistence connection lifetime by @tobias-tengler in #10478
• [Fusion] Fix subgraph errors being dropped on non-null fields and null list elements by @michaelstaib in #10464
• Fix GraphQL HTTP responses missing Vary: Accept by @glen-84 in #10467
• Fix test servers staying alive until their test class ends by @glen-84 in #10482
• [Nitro] Remove a redundant namespace qualifier in AgentsMode by @glen-84 in #10481
• Fix the Nitro tool answering refused GraphQL GET requests by @glen-84 in #10483
• Read documentId from GraphQL GET requests by @glen-84 in #10487
• Add scheduled delivery to the Mocha in-memory transport by @glen-84 in #10119
• Answer unsupported methods and media types in Azure Functions by @glen-84 in #10488
• Add Nitro telemetry CLI commands by @PascalSenn in #10458
• [Mocha] Fix RabbitMQ sends to undeclared queues failing under explicit binding by @alisan3 in #10484
• Record undeclared Azure Service Bus dispatch targets in the topology under explicit binding by @PascalSenn in #10490
• Record undeclared Postgres dispatch targets in the topology under explicit binding by @PascalSenn in #10491
• [Mocha] Support out-of-band PostgreSQL schema migrations by @tobias-tengler in #10486
• [Mocha] Fix PostgreSQL outbox and scheduling authentication with NpgsqlDataSource by @tobias-tengler in #10477
• [Mocha] Fix the outbox worker missing messages written inside a TransactionScope by @tobias-tengler in #10496
• [Website] Serve the website on port 3002 by @tobias-tengler in #10498
• Fix QueryContext<T> dropping sort fields after a nested object field by @glen-84 in #10501
• Switch from Yarn to npm by @glen-84 in #10503
• Dispatch GitHub Action, Homebrew and Azure Pipelines releases with only the version by @tobias-tengler in #10502
• [Fusion] Fix the operation planner dropping requirement chains by @michaelstaib in #10485
• Fix mutation conventions on non-static mutation types by @tobias-tengler in #10513
• Fix JsonValueParser not unescaping strings when parsing UTF-8 JSON by @tobias-tengler in #10516
• Fix a race condition in WorkScheduler by @mnebes in #10463
• [Fusion] Write forwarded variable literals as UTF-8 by @tobias-tengler in #10517
• Fix IDE0055 errors in Windows checkouts by @PHILLIPS71 in #10520
• [Fusion] Fix node planning crash on unions with non-Node members by @mnebes in #10521
• [Mocha] Configure receive resilience on RabbitMQ queues by @PascalSenn in #10507
• [Mocha] Configure receive resilience on InMemory queues by @PascalSenn in #10508
• [Mocha] Configure receive resilience on PostgreSQL queues by @PascalSenn in #10509
• [Mocha] Configure receive resilience on Azure Service Bus queues by @PascalSenn in #10510
• [Mocha] Fix in-process retry ignoring endpoint and transport exception policies by @PascalSenn in #10514
• Fix concurrent first requests to one schema failing with HTTP 500 by @glen-84 in #10525
• [Mocha] Stabilize saga integration tests against timing flakes by @glen-84 in #9947
• [Mocha] Gate saga reply tests until the saga state is persisted by @glen-84 in #10526
• Fix variable coercion leaking a pooled buffer per numeric value by @tobias-tengler in #10527
• [Website] Update sharp, Next.js, and source-map-js to clear advisories by @glen-84 in #10531
• Added support for venti by @michaelstaib in #10528
• [Mocha] Fix transports not stopping when the host shuts down by @tobias-tengler in #10479
• Fix ShutdownTests binding Reverse to the span overload on net8.0 / net9.0 by @tobias-tengler in #10533
• Fix empty filter objects failing with an unexpected error by @glen-84 in #10532
• [Mocha] Cancel message handlers and release interrupted messages on shutdown by @tobias-tengler in #10504
• [Fusion] Write forwarded variables once per fetch by @tobias-tengler in #10524
• [Fusion] Look up input object fields by UTF-8 name during variable coercion by @tobias-tengler in #10522
• Look up input object fields and enum values by UTF-8 name during variable coercion by @tobias-tengler in #10534
• Fix in-memory filters failing when a nested object has several fields by @glen-84 in #10536
• Fix torn reads in value node caches by @tobias-tengler in #10540
• Cache the enum value literal for variable coercion by @tobias-tengler in #10537
• Update the security contact address and add Mocha to the policy by @glen-84 in #10539
• [Mocha] Fix Postgres outbox dropping fault replies to a caller's reply queue by @tobias-tengler in #10529
• [Mocha] Fix batching tests failing on machines with two processors by @glen-84 in #10542
• [Fusion] Fix tests failing on machines with one or two processors by @glen-84 in #10544
• Bump System.Security.Cryptography.Pkcs to the patched versions by @tobias-tengler in #10545
• Fix omitted variables counting as provided input values by @glen-84 in #10541
• Add .NET profiling tools to the dev container and document their use by @tobias-tengler in #10549
• Fix test projects failing to compile on net8.0 due to JsonElement.DeepEquals by @tobias-tengler in #10550
• Update dev and test packages, including xUnit v3 4.0 and Aspire 13.6 by @glen-84 in #10553
• Write JSON results through a chunked pipe buffer by @tobias-tengler in #10552
• [Fusion] Batch path segment pool access and keep the local pool across requests by @tobias-tengler in #10548
• Scope the allowScripts note in AGENTS.md to affected npm versions by @glen-84 in #10556
• Add GraphQL federation performance benchmarks page by @tobias-tengler in #10551
• [Website] Fix transparency in image loading placeholders by @tobias-tengler in #10571
• [Website] Refine benchmark page by @tobias-tengler in #10572
• [Fusion] Fix source result cleanup when execution is canceled by @tobias-tengler in #10579
• [Fusion] Fix Apollo result cleanup when execution is canceled by @tobias-tengler in #10580
• [Website] Backfill historical benchmark data by @tobias-tengler in #10583
• [Fusion] Reduce source-response buffer copies by @tobias-tengler in #10581
• [Fusion] Reuse contiguous source response segments by @tobias-tengler in #10582
• [Fusion] Fix oversized path pool slot storage by @tobias-tengler in #10557
• [Fusion] Avoid temporary file map path allocations by @tobias-tengler in #10596
• [Fusion] Reuse completed object types in Apollo representations by @tobias-tengler in #10589
• [Fusion] Reduce forwarded-variable projection allocations by @tobias-tengler in #10584
• [Fusion] Precompute deferred delivery-path metadata by @tobias-tengler in #10591
• Fix redundant multipart path token allocations by @tobias-tengler in #10601
• [Fusion] Fix repeated selection resolution in object list completion by @tobias-tengler in #10560
• [Fusion] Compact operation text sent to subgraphs by @tobias-tengler in #10604
• [Fusion] Fix the in-memory connector failing on batched lookups with multiple variable sets by @tobias-tengler in #10636
• [Fusion] Skip lookups for entities the request already fetched by @michaelstaib in #10606
• Fix the isolated worker treating a request without Content-Type as JSON by @glen-84 in #10638
• Fix persisted operation routes accepting any Content-Type by @glen-84 in #10639
• [Fusion] Fix property names including white space before the colon in source documents by @tobias-tengler in #10634
• [Mocha] Require transaction for Postgres outbox publishes by @tobias-tengler in #10555
• Fix serial tasks waiting on a reassigned task id by @bbarry in #10562
• Skip query parsing for POST requests without a query string by @tobias-tengler in #10620
• Elide async frames in pass-through request pipeline layers by @tobias-tengler in #10621
• [Mocha] Fix the RabbitMQ transport losing the exact SentAt and DeliverBy by @tobias-tengler in #10642
• Fix pooled operation contexts being reused while deferred resolvers still run by @michaelstaib in #10519
• Bump MessagePack to 2.5.307 and pin Pkcs to the patched versions by @glen-84 in #10646
• [Fusion] Parse source documents with a purpose-built JSON tokenizer by @tobias-tengler in #10635
• [Fusion] Parse batched source results with purpose-built JSON tokenizer by @tobias-tengler in #10644
• [Fusion] Fix deferred plans rejecting nested lookups below the defer anchor by @tobias-tengler in #10647
• [Website] Add a videos section by @PascalSenn in #10645
• [Fusion] Merge identical Apollo entity lookups across target paths by @tobias-tengler in #10607
• [Fusion] Fold leaf Apollo lookups into a deeper identical lookup by @tobias-tengler in #10628
• [Website] Fix video upload dates missing a time zone by @PascalSenn in #10650
• [Fusion] Align the k6 benchmarks with graphql-federation-benchmarks by @michaelstaib in #10652
• [Fusion] Copy completed leaf values into duplicate lookup targets by @tobias-tengler in #10612
• [Fusion] Keep duplicate lookup targets as result cursors by @tobias-tengler in #10613
• Fix ISellectionCollection.Select failing on large child selection sets by @tobias-tengler in #10655
• [Mocha] Fix PostgreSQL timestamps and outbox expiration by @tobias-tengler in #10656
• [Mocha] Compute SentAt at time of dispatch by @tobias-tengler in #10659
• [Fusion] Fix previous schemas not being garbage collected by @mnebes in #10654
• [Fusion] Match duplicate lookup variables on raw leaf values by @tobias-tengler in #10614
• [Fusion] Write minimized results without per-token JsonWriter calls by @tobias-tengler in #10617
• [Fusion] Write single JSON results straight into the response pipe by @tobias-tengler in #10624
• Test and document cache headers for HTTP QUERY requests by @glen-84 in #10662
• [Website] Fix errors on the cache-control docs pages by @glen-84 in #10663
• [Website] Fix structured video data by @tobias-tengler in #10664
• Fail the release when the tag's GitHub release is already published by @glen-84 in #10665
• [Fusion] Reuse already fetched entities in Apollo entity lookups by @tobias-tengler in #10653
• [Fusion] Fill fully reused entity lookups by row offset by @tobias-tengler in #10657
• Answer 405 for unmapped methods on persisted operation routes by @glen-84 in #10666
• Pin Ubuntu runners to ubuntu-26.04 by @glen-84 in #10667
• Fix concurrent Postgres subscription initialization hanging callers by @alisan3 in #10669
• [Fusion] Reuse HTTP subgraph clients across requests by @tobias-tengler in #10609
• [Fusion] Keep identical lookups apart when entity reuse can serve the deeper one by @michaelstaib in #10661
• Fix slicingArgumentDefaultValue exceeding the max page size in cost directives by @michaelstaib in #10671
• Fix pagination fields losing parallel execution by @bbarry in #10564
• [Website] Fix the diagnostic event tables on the instrumentation page by @glen-84 in #10672
• [Fusion] Fix satisfiability validation skipping paths that reach an already visited type by @michaelstaib in #10673
• Fix diagnostic event XML docs that misstate when events are raised by @glen-84 in #10674
• [Website] Update Next.js, Storybook, and Vite to clear advisories by @glen-84 in #10675
• Remove redundant name qualifiers flagged by IDE0002 by @glen-84 in #10676
• [Website] Update benchmark results by @tobias-tengler in #10677

New Contributors

• @mnebes made their first contribution in #10463
• @bbarry made their first contribution in #10562

Full Changelog: 16.6.2...16.7.0