chore(deps): bump graphql-java from 16.2 to 19.1 in /graphql-spqr

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps graphql-java from 16.2 to 19.1.

Release notes

Sourced from graphql-java's releases.

19.1

This bug fix release was made to address a specific NullPointerException problem if consumers are explicitly setting the ExecutionInput to null

See graphql-java/graphql-java#2908 for the code details.

The other fixes are included because they are... well... fixes and where ready at the time.

What's Changed

• Defaults Locale when calling validation by @​bbakerman in graphql-java/graphql-java#2908
• Handles isDeprecated not being present in the json by @​bbakerman in graphql-java/graphql-java#2910
• Fix typo in description of skip directive by @​acanda in graphql-java/graphql-java#2915
• Xuorig Fix PR - Edge case with GraphQLTypeReference and Schema Transforms by @​bbakerman in graphql-java/graphql-java#2906
• Reduce calculation for fragments in ExecutableNormalizedOperation by @​dondonz in graphql-java/graphql-java#2911

New Contributors

• @​acanda made their first contribution in graphql-java/graphql-java#2915

Full Changelog: graphql-java/graphql-java@v19.0...v19.1

19.0

This is release 19.0 of GraphQL Java. It contains one breaking change.

It contains one security related bugfix hardening GraphQL Java more against malicious requests: #2892

GraphQL Java now shades Antlr runtime to prevent any further dependency conflicts. Antlr is used internally for parsing and validating of GraphQL requests and SDL. #2854

It includes some performance improvements (#2786, #2769, #2839) and several bugfixes and general improvements.

Breaking change

#2769 is an improvement to reduce object allocation. It can contain a breaking change if you would implement your own ChainedInstrumentation.

Change in behaviour

#2878 introduces i18n for validation error messages, and by default will set locale to the JVM default locale

#2799 changes the behaviour of the AST printer to use the shortest form available for query operation if possible. While semantically this is not a change, it might affect you.

Bugfixes

#2892 Security bugfix to prevent DOS attacks

#2818 Fix silent thread leak for chained instrumentation

#2825 Fixup Introspection input field deprecation filterting

#2842 fix runtime exception for deep async queries

#2856 SchemaPrinter description bugfix

... (truncated)

Commits

• 9479cc0 Merge pull request #2911 from graphql-java/benchmark_enf
• 9f8aaed Added test fore intersection
• fb507ad Xuorig Fix PR - Edge case with GraphQLTypeReference and Schema Transforms (#2...
• dbc0476 Merge branch 'master' into benchmark_enf
• faf6337 Fix typo in description of skip directive (#2915)
• c7936ea Merge pull request #2910 from graphql-java/harden_introspection_to_result
• b710226 Add smaller set first optimisation
• 4256831 Cheaper calculation for narrowing down possible objects in ENO
• 5831bc4 Handles isDeprecated not being present in the json
• 49d012e Defaults Locale when calling validation (#2908)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[hantsy]

@dependabot ignore this minor version

[dependabot]

OK, I won't notify you about version 19.1.x again, unless you re-open this PR or update to a 19.1.x release yourself.

[hantsy]

@dependabot ignore this major version

[dependabot]

OK, I won't notify you about version 19.x.x again, unless you re-open this PR or update to a 19.x.x release yourself.