chore: update auto merge on patch or minor

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
graphql	16.14.0 → 16.14.1
pnpm (source)	11.5.0 → 11.5.1
pnpm (source)	11.5.0 → 11.5.1

---

Release Notes

graphql/graphql-js (graphql)

v16.14.1

Compare Source

v16.14.1 (2026-06-02)

Docs 📝

9 PRs were merged

• #​4737 docs: refresh upgrade guide and v17 topics (@​yaacovCR)
• #​4741 docs: add v16 API docs lint coverage (@​yaacovCR)
• #​4748 docs: update banner (@​yaacovCR)
• #​4750 docs: use api docs generated from inline jsdoc comments (@​yaacovCR)
• #​4754 docs: update website caniuse-lite data (@​yaacovCR)
• #​4755 docs: hide internal type member __validationErrors (@​yaacovCR)
• #​4757 docs: fix inline examples, deprecation descriptions, type category (@​yaacovCR)
• #​4759 docs: fix static export redirect config (@​yaacovCR)
• #​4767 docs: fix Post_body example variable (@​fallintoplace)

Polish 💅

• #​4738 chore(tests): add test for directive extensions without flag enabled (@​yaacovCR)

Internal 🏠

• #​4778 fix: generated version documentation (@​yaacovCR)

Committers: 2

• Minh Vu(@​fallintoplace)
• Yaacov Rydzinski (@​yaacovCR)

pnpm/pnpm (pnpm)

v11.5.1

Compare Source

Patch Changes

• Improve pnpm audit performance by pruning non-vulnerable lockfile subtrees and stopping path enumeration once vulnerable findings reach the path cap.
• Avoid crashing when the workspace state cache is partially written or malformed.
• Set npm_config_user_agent for root lifecycle scripts during headless installs.
• Preserve the integrity field of a remote (non-registry) tarball dependency when its lockfile entry is rebuilt. Re-resolving such a dependency without re-fetching it (for example via pnpm update, or when another dependency changes) produced a resolution with no integrity — URL/tarball resolvers only learn the integrity after the tarball is downloaded — so the previously recorded integrity was dropped, making later installs fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY #​12067.
• Normalize a string repository field into the { type, url } object form when creating the publish manifest, matching npm's behavior. Some registries (e.g. Gitea/Codeberg) reject a string repository with a 500 Internal Server Error during pnpm publish #​12099.
• Preserve compatible optional peer versions already present in the lockfile when resolving dependencies.
• Fixed inconsistent resolution of a peer dependency that is shared through a diamond. When a package peer-depends on both another package and one of that package's own peer dependencies (for example @typescript-eslint/eslint-plugin peer-depends on both @typescript-eslint/parser and typescript, and @typescript-eslint/parser peer-depends on typescript), pnpm no longer reuses a hoisted instance of the shared peer that was resolved against a different version #​12079.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0d31980

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR