graphql-hive · n1ru4l · Nov 24, 2025 · Nov 24, 2025
diff --git a/.changeset/major-baths-feel.md b/.changeset/major-baths-feel.md
@@ -0,0 +1,18 @@
+---
+'@graphql-hive/cli': minor
+'hive': minor
+---
+
+Updated federation-composition to v0.21.0
+
+- **Enhanced auth directive validation**: The federation-composition now enforces correct placement of auth directives (`@authenticated`, `@requiresScopes`, `@policy`) by rejecting attempts to place them on interfaces, interface fields, or interface objects with the new `AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE` validation rule.
+
+- **Transitive auth requirements checking**: Added a new validation rule that ensures fields using `@requires` specify at least the auth requirements of the fields they select. If a field doesn't carry forward required auth directives, composition fails with a `MISSING_TRANSITIVE_AUTH_REQUIREMENTS` error.
+
+- **Auth requirements inheritance**: Interface types and fields now properly inherit `@authenticated`, `@requiresScopes`, and `@policy` directives from the object types that implement them.
+
+- **`@cost` directive restrictions**: The `@cost` directive can no longer be placed on interface types, their fields, or field arguments. Invalid placements now result in composition errors instead of being silently accepted.
+
+- **Improved `@listSize` validation**: The directive now validates that `sizedFields` point to actual list fields rather than integer counters. Additionally, `slicingArguments` validation has been added to ensure only arguments that exist in all subgraphs are retained.
+
+- **Fixed `EXTERNAL_MISSING_ON_BASE` rule**: Resolved false positives when handling `@interfaceObject` corner-cases, particularly for `@external` fields on object types provided by interface objects.
diff --git a/integration-tests/package.json b/integration-tests/package.json
@@ -21,7 +21,7 @@
     "@hive/schema": "workspace:*",
     "@hive/server": "workspace:*",
     "@hive/storage": "workspace:*",
-    "@theguild/federation-composition": "0.20.2",
+    "@theguild/federation-composition": "0.21.0",
     "@trpc/client": "10.45.2",
     "@trpc/server": "10.45.2",
     "@types/async-retry": "1.4.8",

diff --git a/package.json b/package.json
@@ -78,7 +78,7 @@
     "@sentry/cli": "2.40.0",
     "@swc/core": "1.13.5",
     "@theguild/eslint-config": "0.12.1",
-    "@theguild/federation-composition": "0.20.2",
+    "@theguild/federation-composition": "0.21.0",
     "@theguild/prettier-config": "2.0.7",
     "@types/node": "22.10.5",
     "bob-the-bundler": "7.0.1",

diff --git a/packages/libraries/cli/package.json b/packages/libraries/cli/package.json
@@ -60,7 +60,7 @@
     "@oclif/core": "^3.26.6",
     "@oclif/plugin-help": "6.0.22",
     "@oclif/plugin-update": "4.2.13",
-    "@theguild/federation-composition": "0.20.2",
+    "@theguild/federation-composition": "0.21.0",
     "cli-table3": "0.6.5",
     "colors": "1.4.0",
     "env-ci": "7.3.0",

diff --git a/packages/services/api/package.json b/packages/services/api/package.json
@@ -37,7 +37,7 @@
     "@sentry/node": "7.120.2",
     "@sentry/types": "7.120.2",
     "@slack/web-api": "7.10.0",
-    "@theguild/federation-composition": "0.20.2",
+    "@theguild/federation-composition": "0.21.0",
     "@trpc/client": "10.45.2",
     "@trpc/server": "10.45.2",
     "@types/bcryptjs": "2.4.6",

diff --git a/packages/services/demo/federation/package.json b/packages/services/demo/federation/package.json
@@ -7,7 +7,7 @@
   },
   "dependencies": {
     "@apollo/subgraph": "2.9.3",
-    "@theguild/federation-composition": "0.20.2",
+    "@theguild/federation-composition": "0.21.0",
     "graphql": "16.9.0",
     "graphql-yoga": "5.13.3"
   },

diff --git a/packages/services/schema/package.json b/packages/services/schema/package.json
@@ -15,7 +15,7 @@
     "@graphql-tools/stitching-directives": "3.1.38",
     "@hive/service-common": "workspace:*",
     "@sentry/node": "7.120.2",
-    "@theguild/federation-composition": "0.20.2",
+    "@theguild/federation-composition": "0.21.0",
     "@trpc/server": "10.45.2",
     "@types/async-retry": "1.4.8",
     "@types/ioredis-mock": "8.2.5",

diff --git a/packages/services/server/package.json b/packages/services/server/package.json
@@ -33,7 +33,7 @@
     "@sentry/integrations": "7.114.0",
     "@sentry/node": "7.120.2",
     "@swc/core": "1.13.5",
-    "@theguild/federation-composition": "0.20.2",
+    "@theguild/federation-composition": "0.21.0",
     "@trpc/client": "10.45.2",
     "@trpc/server": "10.45.2",
     "@whatwg-node/server": "0.10.17",