match graphql dep to @shopify/api-codegen-preset

[lopert]

Fixes https://github.com/shop/issues-shopifyvm/issues/727.

I documented my investigations in this comment, but TL;DR:

• Our main app template, react-router, has depencies that end up installing graphql@16.12.0.
• This package (@shopify/shopify_function) has a locked dependency to graphql@16.11.0.
• pnpm loads both, but graphql-js has some guardrails where it errors out when it detects multiple versions.

This PR fixes this by unlocking our graphql dep, and matching it to what gets pulled into the react router app via @shopify/api-codegen-preset.

There's still the potential for things to get out of sync in the future should a different version of graphql get pulled into our templates, but this addresses the errors encountered in today's out-of-the-box flow.

How to 🎩

• Make sure you have the CLI installed, latest is fine.

npm i -g @shopify/cli@latest

• Generate a pnpm managed shopify app, using the react router template.

shopify app init --flavor=javascript --template=reactRouter --package-manager=pnpm --name nov-pnpm-rr-js

• cd into your new app

cd ./nov-pnpm-rr-js

• reproduce the issue by attempting to generate a new JS extension. You should get an error that looks like:
  Cannot use GraphQLScalarType "Boolean" from another module or realm.

shopify app generate extension --template=discount --flavor=vanilla-js --name test-extension

• use my CLI snapshot that swaps our the template dep on this package to this PR's snapshot.

npm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20251112140027

• run the generate command again, this time it should succeed.

shopify app generate extension --template=discount --flavor=vanilla-js --name test-extension

• confirm that the function's package.json contains the snapshot as the dep for @shopify/shopify_function

  "dependencies": {
    "@shopify/shopify_function": "0.0.0-snapshot-20251111164106"
  },

[lopert]

/snapit

[github-actions]

🫰✨ Thanks @lopert! Your snapshot has been published to npm.

Test the snapshot by updating your package.json with the newly published version:

"@shopify/shopify_function": "0.0.0-snapshot-20251111164106"

[lopert]

I updated the version number here to make generating the local tar with npm pack easier, and to make sure testing didn't get messed up by existing installs of 2.0.0.

I'll swap this back to 2.0.0 once I have approvals. Then I can do a separate PR to bump 2.0.1 and release.