chore(deps): update dependency graphql to ^16.12.0

[mend-5034428]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
graphql	^16.3.0 -> ^16.12.0

---

Release Notes

graphql/graphql-js (graphql)

v16.12.0: 16.12.0

Compare Source

v16.12.0 (2025-11-01)

New Feature 🚀

• #​4482 Implement changes for executable descriptions (@​JoviDeCroock)
• #​4493 Backport schema coordinates (@​JoviDeCroock)

Bug Fix 🐞

• #​4392 Catch unhandled exception in abstract resolution (@​JoviDeCroock)

Docs 📝

28 PRs were merged

• #​4374 docs: testing graphQL servers (@​sarahxsanders)
• #​4376 docs: type generation for graphql servers (@​sarahxsanders)
• #​4380 docs: add guides for custom scalars (@​sarahxsanders)
• #​4381 docs: anatomy of a resolver (@​sarahxsanders)
• #​4382 docs: understanding graphql errors (@​sarahxsanders)
• #​4383 docs: N+1 problem and DataLoader (@​sarahxsanders)
• #​4391 docs: cursor-based pagination guide (@​sarahxsanders)
• #​4393 docs: add page on abstract types (@​sarahxsanders)
• #​4394 docs: editorial on abstract types page (@​benjie)
• #​4395 docs: editorial for recent documentation updates (@​benjie)
• #​4396 docs: add page on authorization strategies (@​sarahxsanders)
• #​4398 docs: update "going to production" guide (@​sarahxsanders)
• #​4399 Update mutations-and-input-types.mdx (@​roman-lakhnov)
• #​4400 Remove CJS from docs (@​JoviDeCroock)
• #​4401 docs: add guide on directives (@​sarahxsanders)
• #​4402 docs: add guide for operation complexity controls (@​sarahxsanders)
• #​4405 docs: add guide on nullability (@​sarahxsanders)
• #​4406 docs: add guide on subscriptions (@​sarahxsanders)
• #​4411 docs: add guide on caching strategies (@​sarahxsanders)
• #​4414 docs: guide on scaling your API (@​sarahxsanders)
• #​4416 Editorial for #​4405 (nullability) (@​benjie)
• #​4417 Indicate that field arguments should always be preferred over directives (@​benjie)
• #​4418 docs: trusted documents (@​benjie)
• #​4419 docs: cleanup and fixes (@​sarahxsanders)
• #​4436 Suggestions for federation links (@​Urigo)
• #​4444 Fix navigation (@​JoviDeCroock)
• #​4452 fix(docs/mutations-and-input-types.mdx): root being inside of SDL (@​alesculek)
• #​4473 docs: remove fourth permutation of the visit API (@​janmeier)

Polish 💅

• #​4453 Remove oneof validation from values of correct type (@​JoviDeCroock)

Internal 🏠

3 PRs were merged

• #​4390 Add the version support policy (@​benjie)
• #​4412 internal: use empty merge commit to clean up git diff from 16.x.x (@​yaacovCR)
• #​4479 updated location of ModelSim gitignore file (@​magicmark)

Committers: 9

• Aleš Culek(@​alesculek)
• Benjie(@​benjie)
• Jan Aagaard Meier(@​janmeier)
• Jovi De Croock(@​JoviDeCroock)
• Mark Larah(@​magicmark)
• null(@​roman-lakhnov)
• Sarah Sanders(@​sarahxsanders)
• Uri Goldshtein(@​Urigo)
• Yaacov Rydzinski (@​yaacovCR)

v16.11.0: 16.11.0

Compare Source

v16.11.0 (2025-04-26)

New Feature 🚀

• #​4363 Ensure we validate for using nullable variables in oneOf input fields (@​JoviDeCroock)
• #​4366 feat(execution): add max coercion errors option to execution context (@​cristunaranjo)

Bug Fix 🐞

• #​4367 fix(coerce-input-value): input object coercion rejects arrays (@​cristunaranjo)

Docs 📝

11 PRs were merged

• #​4310 First draft for upgrade guide to v17 (@​JoviDeCroock)
• #​4331 fix sidebar for documentation and /api-v16 (@​dimaMachina)
• #​4335 Add cspell exception (@​JoviDeCroock)
• #​4340 Improve flow of documentation around GraphiQL (@​benjie)
• #​4343 typofix: removes extra parenthesis from getting started code snippet (@​rabahalishah)
• #​4351 fixed wrong variable name (@​fto-dev)
• #​4352 docs(getting-started): promises current links (@​guspan-tanadi)
• #​4368 Update docs for execution options (@​JoviDeCroock)
• #​4369 Correct some syntax (@​JoviDeCroock)
• #​4372 Refactor every code-first example to leverage resolve (@​JoviDeCroock)
• #​4373 docs: Update getting-started.mdx (@​Shubhdeep12)

Polish 💅

• #​4312 Increase print/visit performance (@​JoviDeCroock)

Internal 🏠

4 PRs were merged

• #​4327 Add redirect for /api (@​JoviDeCroock)
• #​4377 Chore: bump setup-node (@​JoviDeCroock)
• #​4378 Change to gqlConf 2025 (@​JoviDeCroock)
• #​4379 Add missing parenthesis (@​benjie)

Committers: 8

• Benjie(@​benjie)
• Cris Naranjo (@​cristunaranjo)
• Dimitri POSTOLOV(@​dimaMachina)
• Fatih Ozdemir(@​fto-dev)
• Guspan Tanadi(@​guspan-tanadi)
• Jovi De Croock(@​JoviDeCroock)
• Rabah Ali Shah(@​rabahalishah)
• Shubhdeep Chhabra(@​Shubhdeep12)

v16.10.0: 16.10.0

Compare Source

v16.10.0 (2024-12-15)

New Feature 🚀

• #​4286 fix: properly type extensions in GraphQLFormattedError (@​tpoisseau)
• #​4292 Expose tokenCount on the DocumentNode (@​JoviDeCroock)

Bug Fix 🐞

• #​4137 backport(v16): Require non-empty directive locations (#​4100) (@​benjie)
• #​4168 fix(validation): catch OverlappingFieldsCanBeMergedRule violations with nested fragments (@​sachindshinde)
• #​4226 Backport introspection type fix (@​JoviDeCroock)
• #​4291 Address empty selection-set (@​JoviDeCroock)

Docs 📝

10 PRs were merged

• #​4240 Convert from docusaurus to nextra (@​JoviDeCroock)
• #​4248 Add content from https://github.com/graphql/graphql.github.io/pull/1782 (@​JoviDeCroock)
• #​4249 Styling fixes (@​JoviDeCroock)
• #​4256 Various fixes to docs (@​JoviDeCroock)
• #​4279 Solve some low hanging fruit in the documentation (@​JoviDeCroock)
• #​4283 Add overview page and add stackblitz to tutorial (@​JoviDeCroock)
• #​4284 Provide people with tabs so they can use classes as well (@​JoviDeCroock)
• #​4289 Add note about defer/stream being v17 (@​JoviDeCroock)
• #​4290 Write about @oneOf in the graphql-js documentation (@​JoviDeCroock)
• #​4295 Split up in v16 API documentation (@​JoviDeCroock)

Internal 🏠

4 PRs were merged

• #​4138 Upgrade codecov action and pass token (@​benjie)
• #​4139 Fix codecov workflow (@​benjie)
• #​4157 Add GraphQLConf 2024 banner (@​bignimbus)
• #​4193 Upgrade deprecated actions (@​JoviDeCroock)

Committers: 5

• Benjie(@​benjie)
• Jeff Auriemma(@​bignimbus)
• Jovi De Croock(@​JoviDeCroock)
• Sachin D. Shinde(@​sachindshinde)
• tpoisseau(@​tpoisseau)

v16.9.0

Compare Source

v16.9.0 (2024-06-21)

New Feature 🚀

• #​4119 backport[v16]: Introduce "recommended" validation rules (@​benjie)
• #​4122 backport[v16]: Enable passing values configuration to GraphQLEnumType as a thunk (@​benjie)
• #​4124 backport[v16]: Implement OneOf Input Objects via @oneOf directive (@​benjie)

Committers: 1

• Benjie(@​benjie)

v16.8.2

Compare Source

v16.8.2 (2024-06-12)

Bug Fix 🐞

• #​4022 fix: remove globalThis check and align with what bundlers can accept (@​JoviDeCroock)

Internal 🏠

• #​4104 Fix publish scripts (@​benjie)

Committers: 2

• Benjie(@​benjie)
• Jovi De Croock(@​JoviDeCroock)

v16.8.1

Compare Source

v16.8.1 (2023-09-19)

Bug Fix 🐞

• #​3967 OverlappingFieldsCanBeMergedRule: Fix performance degradation (@​AaronMoat)

Committers: 1

• Aaron Moat(@​AaronMoat)

v16.8.0

Compare Source

v16.8.0 (2023-08-14)

New Feature 🚀

• #​3950 Support fourfold nested lists (@​gschulze)

Committers: 1

• Gunnar Schulze(@​gschulze)

v16.7.1

Compare Source

v16.7.1 (2023-06-22)

📢 Big shout out to @​phryneas, who managed to reproduce this issue and come up with this fix.

Bug Fix 🐞

• #​3923 instanceOf: workaround bundler issue with process.env (@​IvanGoncharov)

Committers: 1

• Ivan Goncharov(@​IvanGoncharov)

v16.7.0

Compare Source

v16.7.0 (2023-06-21)

New Feature 🚀

• #​3887 check "globalThis.process" before accessing it (@​kettanaito)

Bug Fix 🐞

• #​3707 Fix crash in node when mixing sync/async resolvers (backport of #​3706) (@​chrskrchr)
• #​3838 Fix/invalid error propagation custom scalars (backport for 16.x.x) (@​stenreijers)

Committers: 3

• Artem Zakharchenko(@​kettanaito)
• Chris Karcher(@​chrskrchr)
• Sten Reijers(@​stenreijers)

v16.6.0

Compare Source

v16.6.0 (2022-08-16)

New Feature 🚀

• #​3645 createSourceEventStream: introduce named arguments and deprecate positional arguments (@​yaacovCR)
• #​3702 parser: limit maximum number of tokens (@​IvanGoncharov)

Bug Fix 🐞

• #​3686 Workaround for codesandbox having bug with TS enums (@​IvanGoncharov)
• #​3701 Parser: allow 'options' to explicitly accept undefined (@​IvanGoncharov)

Committers: 2

• Ivan Goncharov(@​IvanGoncharov)
• Yaacov Rydzinski (@​yaacovCR)

v16.5.0

Compare Source

v16.5.0 (2022-05-09)

New Feature 🚀

• #​3565 Expose GraphQLErrorOptions type (#​3554) (@​IvanGoncharov)

Committers: 1

• Ivan Goncharov(@​IvanGoncharov)

v16.4.0

Compare Source

v16.4.0 (2022-04-25)

New Feature 🚀

• #​3465 refactor: use object for GraphQLError constructor (@​n1ru4l)
• #​3487 feat: expose getArgumentValues (@​saihaj)

Bug Fix 🐞

• #​3514 GraphQLError: switch constructor overload order (@​glasser)

Docs 📝

2 PRs were merged

• #​3505 correct outdated documentation (@​Ginhing)
• #​3512 Update documentation on deprecated formatError(..) (@​dwelch2344)

Polish 💅

3 PRs were merged

• #​3522 tests(execution): add missing new lines (@​IvanGoncharov)
• #​3524 tests(printSchema): test omitting schema of common names (@​IvanGoncharov)
• #​3537 ESLint: disallow using node globals in src/tests (@​IvanGoncharov)

Internal 🏠

26 PRs were merged

• #​3468 ci: add stub action for canary releases on PRs (@​IvanGoncharov)
• #​3470 ci: implement canary releases on PRs (@​IvanGoncharov)
• #​3472 ci: remove NPM caching on canary release script (@​IvanGoncharov)
• #​3473 ci: Pass 'GITHUB_TOKEN' to GitHub CLI (@​IvanGoncharov)
• #​3475 ci: checkout repo in canary workflow (@​IvanGoncharov)
• #​3477 ci: fix & cleanup script for modifying NPM package into canary (@​IvanGoncharov)
• #​3479 ci: Add missing require to canary script (@​IvanGoncharov)
• #​3481 ci: fix missing PR number in canary release workflow (@​IvanGoncharov)
• #​3483 ci: fix missing PR number in canary release workflow (@​IvanGoncharov)
• #​3484 ci: Moving GH Action template syntax to env variables (@​IvanGoncharov)
• #​3486 ci: improve comment on canary releases (@​IvanGoncharov)
• #​3488 ci: Extract branch publishing into separate workflow (@​IvanGoncharov)
• #​3489 ci: use '.node-version' file to configure node version used for CI (@​IvanGoncharov)
• #​3491 ci: use separate workflows for 'push' and 'pull_request' (@​IvanGoncharov)
• #​3493 ci: remove unused 'workflow_id' input (@​IvanGoncharov)
• #​3496 ci: fix deprecation of canary package (@​IvanGoncharov)
• #​3497 ci: use environments to track deployments (@​IvanGoncharov)
• #​3502 ci: fix deployments of npm & deno branches (@​IvanGoncharov)
• #​3503 ci: Add '@​github-actions' bot (@​IvanGoncharov)
• #​3523 github-actions-bot: replace 'octokit/request-action' action (@​IvanGoncharov)
• #​3525 github-actions-bot: Fix collapsing of unrelated comments (@​IvanGoncharov)
• #​3530 integrationTests/node: fix crash on Mac with M1 by using docker (@​IvanGoncharov)
• #​3534 github-actions-bot: fix publishing of canary releases (@​IvanGoncharov)
• #​3536 github-actions-bot: fix usage of NPM_CANARY_PR_PUBLISH_TOKEN (@​IvanGoncharov)
• #​3538 github-actions-bot: fix reply on commands (@​IvanGoncharov)
• #​3543 pass valid value to codecov config (@​is2ei)

Dependency 📦

2 PRs were merged

• #​3485 Update deps (@​IvanGoncharov)
• #​3533 Update deps (@​IvanGoncharov)

Committers: 7

• David Glasser(@​glasser)
• David Welch(@​dwelch2344)
• Ginhing(@​Ginhing)
• Horie Issei(@​is2ei)
• Ivan Goncharov(@​IvanGoncharov)
• Laurin Quast(@​n1ru4l)
• Saihajpreet Singh(@​saihaj)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box