Skip to content

build(deps): bump the graphql group across 1 directory with 2 updates#2745

Merged
sjinks merged 1 commit intotrunkfrom
dependabot/npm_and_yarn/graphql-6ff8613244
Feb 25, 2026
Merged

build(deps): bump the graphql group across 1 directory with 2 updates#2745
sjinks merged 1 commit intotrunkfrom
dependabot/npm_and_yarn/graphql-6ff8613244

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 24, 2026

Bumps the graphql group with 2 updates in the / directory: @apollo/client and graphql.

Updates @apollo/client from 4.1.4 to 4.1.6

Release notes

Sourced from @​apollo/client's releases.

@​apollo/client@​4.1.6

Patch Changes

  • #13128 6c0b8e4 Thanks @​pavelivanov! - Fix useQuery hydration mismatch when ssr: false and skip: true are used together

    When both options were combined, the server would return loading: false (because useSSRQuery checks skip first), but the client's getServerSnapshot was returning ssrDisabledResult with loading: true, causing a hydration mismatch.

@​apollo/client@​4.1.5

Patch Changes

Changelog

Sourced from @​apollo/client's changelog.

4.1.6

Patch Changes

  • #13128 6c0b8e4 Thanks @​pavelivanov! - Fix useQuery hydration mismatch when ssr: false and skip: true are used together

    When both options were combined, the server would return loading: false (because useSSRQuery checks skip first), but the client's getServerSnapshot was returning ssrDisabledResult with loading: true, causing a hydration mismatch.

4.1.5

Patch Changes

Commits

Updates graphql from 16.12.0 to 16.13.0

Release notes

Sourced from graphql's releases.

16.13.0

v16.13.0 (2026-02-24)

New Feature 🚀

Bug Fix 🐞

  • #4336 add deprecated note to assertValidExecutionArguments (@​yaacovCR)
  • #4517 fix(validation): incorrect validation errors when variable descriptions are used (@​phryneas)

Internal 🏠

Committers: 4

Commits
  • 7569989 16.13.0
  • 49450d8 Revert "deprecate (internal) buildResolveInfo in favor of (internal) ResolveI...
  • 4149722 deprecate (internal) buildResolveInfo in favor of (internal) ResolveInfo clas...
  • 4c057eb add deprecated note to assertValidExecutionArguments (#4336)
  • 3f8f27a fix(validation): incorrect validation errors when variable descriptions are u...
  • b34a4cd update contributing (#4524)
  • abddd09 Sibling errors should not be added after propagation (#4458)
  • d26810b Alter contributing
  • 5f4602d 16.12.0
  • d239841 chore: always ignore scripts (#4514)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@github-actions
Copy link
Contributor

github-actions bot commented Feb 24, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/@apollo/client 4.1.6 🟢 5.8
Details
CheckScoreReason
Code-Review🟢 5Found 4/7 approved changesets -- score normalized to 5
Maintained🟢 1030 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/graphql 16.13.0 🟢 8.1
Details
CheckScoreReason
Code-Review🟢 7Found 22/29 approved changesets -- score normalized to 7
Maintained🟢 1010 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits

Scanned Files

  • package.json

@sjinks
Copy link
Member

sjinks commented Feb 25, 2026

@dependabot rebase

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/graphql-6ff8613244 branch from 557009d to bf2bc3a Compare February 25, 2026 09:59
@sjinks
Copy link
Member

sjinks commented Feb 25, 2026

@dependabot rebase

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 25, 2026

Looks like this PR is already up-to-date with trunk! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@sjinks
Copy link
Member

sjinks commented Feb 25, 2026

@dependabot rebase

Bumps the graphql group with 2 updates in the / directory: [@apollo/client](https://github.com/apollographql/apollo-client) and [graphql](https://github.com/graphql/graphql-js).


Updates `@apollo/client` from 4.1.4 to 4.1.6
- [Release notes](https://github.com/apollographql/apollo-client/releases)
- [Changelog](https://github.com/apollographql/apollo-client/blob/main/CHANGELOG.md)
- [Commits](https://github.com/apollographql/apollo-client/compare/@apollo/client@4.1.4...@apollo/client@4.1.6)

Updates `graphql` from 16.12.0 to 16.13.0
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v16.12.0...v16.13.0)

---
updated-dependencies:
- dependency-name: "@apollo/client"
  dependency-version: 4.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: graphql
- dependency-name: graphql
  dependency-version: 16.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: graphql
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/graphql-6ff8613244 branch from bf2bc3a to f29b9f0 Compare February 25, 2026 10:08
@sonarqubecloud
Copy link

@sjinks sjinks self-assigned this Feb 25, 2026
@sjinks sjinks merged commit 22e7651 into trunk Feb 25, 2026
19 checks passed
@sjinks sjinks deleted the dependabot/npm_and_yarn/graphql-6ff8613244 branch February 25, 2026 10:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant