fix(deps): update minor-and-patch (lts)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@apollo/server (source)	5.0.0 -> 5.1.0
@babel/core (source)	7.28.4 -> 7.28.5
@babel/preset-env (source)	7.28.3 -> 7.28.5
@graphql-tools/merge (source)	9.1.1 -> 9.1.2
@graphql-tools/resolvers-composition (source)	7.0.20 -> 7.0.21
@graphql-tools/schema (source)	10.0.25 -> 10.0.26
@graphql-tools/utils (source)	10.9.1 -> 10.10.0
@graphql-tools/wrap (source)	11.0.1 -> 11.0.3
@neo4j/cypher-builder (source)	2.9.0 -> 2.10.0
@types/amqplib (source)	0.10.7 -> 0.10.8
@types/node (source)	20.19.23 -> 20.19.24
graphql	16.11.0 -> 16.12.0
koa (source)	3.0.3 -> 3.1.1
rimraf	6.0.1 -> 6.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

apollographql/apollo-server (@​apollo/server)

v5.1.0

Compare Source

Minor Changes

• #​8148 80a1a1a Thanks @​jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with [email protected]. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.

  Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.

babel/babel (@​babel/core)

v7.28.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​17446 Allow Runtime Errors for Function Call Assignment Targets (@​liuxingbaoyu)
• babel-helper-validator-identifier
  • #​17501 fix: update identifier to unicode 17 (@​fisker)

🐛 Bug Fix

• babel-plugin-proposal-destructuring-private
  • #​17534 Allow mixing private destructuring and rest (@​CO0Ki3)
• babel-parser
  • #​17521 Improve @babel/parser error typing (@​JLHwung)
  • #​17491 fix: improve ts-only declaration parsing (@​JLHwung)
• babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • #​17519 fix: rest correctly returns plain array (@​liuxingbaoyu)
• babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
  • #​17503 Fix JSXIdentifier handling in isReferencedIdentifier (@​JLHwung)
• babel-traverse
  • #​17504 fix: ensure scope.push register in anonymous fn (@​JLHwung)

🏠 Internal

• babel-types
  • #​17494 Type checking babel-types scripts (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​17490 Faster finding of locations in buildCodeFrameError (@​liuxingbaoyu)

ardatan/graphql-tools (@​graphql-tools/merge)

v9.1.2

Compare Source

Patch Changes

• Updated dependencies
  [fd105f4,
  fded91e,
  3b99a9b]:
  • @​graphql-tools/utils@​10.10.0

ardatan/graphql-tools (@​graphql-tools/resolvers-composition)

v7.0.21

Compare Source

Patch Changes

• Updated dependencies
  [fd105f4,
  fded91e,
  3b99a9b]:
  • @​graphql-tools/utils@​10.10.0

ardatan/graphql-tools (@​graphql-tools/schema)

v10.0.26

Compare Source

Patch Changes

• Updated dependencies
  [fd105f4,
  fded91e,
  3b99a9b]:
  • @​graphql-tools/utils@​10.10.0
  • @​graphql-tools/merge@​9.1.2

ardatan/graphql-tools (@​graphql-tools/utils)

v10.10.0

Compare Source

Minor Changes

• #​5269
  fded91e
  Thanks @​uroslates! - Add default values to the arguments

  When the schema is like following;

  type Query {
      getAllPages(currentPage: Int = 0, pageSize: Int = 10, pageType: getAllPages_pageType = ContentPage, sort: String = "asc"): PagesList
  }
  
  enum getAllPages_pageType {
      ContentPage
      CategoryPage
      CatalogPage
  }
  
  type PagesList {
      ...
  }

  The generated operation will be like following;

  query getAllPages_query($currentPage: Int = 0, $pageSize: Int = 10, $pageType: getAllPages_pageType = ContentPage, $sort: String = "asc") {
      getAllPages(currentPage: $currentPage, pageSize: $pageSize, pageType: $pageType, sort: $sort) {
          ...
      }
  }

Patch Changes

• #​7012
  fd105f4
  Thanks @​ardatan! - Fix the bug in mergeDeep;

  The following inputs and outputs are corrected;

  • mergeDeep([{a:2}, undefined]) - Any nullish values should be ignored so it should return
    {a:2}
  • mergeDeep([]) - no sources should return undefined
  • mergeDeep([undefined]) - no sources should return undefined

• #​5294
  3b99a9b
  Thanks @​n1ru4l! - Do not map builtin scalars

graphql-hive/gateway (@​graphql-tools/wrap)

v11.0.3

Compare Source

Patch Changes

• #​1654 efed5e0 Thanks @​dependabot! - dependencies updates:

  • Updated dependency @graphql-tools/schema@^10.0.26 ↗︎ (from ^10.0.25, in dependencies)
  • Updated dependency @graphql-tools/utils@^10.10.0 ↗︎ (from ^10.9.1, in dependencies)

• Updated dependencies [efed5e0]:

  • @​graphql-tools/delegate@​11.1.1

v11.0.2

Compare Source

Patch Changes

• Updated dependencies [a54b0c1, 058ef2f, a8458b2, 20f7a50]:
  • @​graphql-tools/delegate@​11.1.0

neo4j/cypher-builder (@​neo4j/cypher-builder)

v2.10.0

Compare Source

Minor Changes

• #​599 a0e01d0 Thanks @​angrykoala! - Add support for range operator ([ .. ]) in Cypher.List, PropertyRef.range and using Cypher.listRange:

  new Cypher.Variable().property("prop").range(1, -1); // var0["prop"][1..-1]
  new Cypher.List([1, 2, 3, 4]).range(1, -1); // [1, 2, 3, 4][1..-1]
  Cypher.listRange(expr, 2, -1); // expr[2..-1]

• #​600 074ea4a Thanks @​angrykoala! - Add support for .set and .remove in Cypher.With

Patch Changes

• #​596 e3a3447 Thanks @​angrykoala! - Support for a single value in Cypher.minus operator:

  Cypher.minus(var1, var2); // var1 - var2
  Cypher.minus(var1); // -var1

graphql/graphql-js (graphql)

v16.12.0: 16.12.0

Compare Source

v16.12.0 (2025-11-01)

New Feature 🚀

• #​4482 Implement changes for executable descriptions (@​JoviDeCroock)
• #​4493 Backport schema coordinates (@​JoviDeCroock)

Bug Fix 🐞

• #​4392 Catch unhandled exception in abstract resolution (@​JoviDeCroock)

Docs 📝

28 PRs were merged

• #​4374 docs: testing graphQL servers (@​sarahxsanders)
• #​4376 docs: type generation for graphql servers (@​sarahxsanders)
• #​4380 docs: add guides for custom scalars (@​sarahxsanders)
• #​4381 docs: anatomy of a resolver (@​sarahxsanders)
• #​4382 docs: understanding graphql errors (@​sarahxsanders)
• #​4383 docs: N+1 problem and DataLoader (@​sarahxsanders)
• #​4391 docs: cursor-based pagination guide (@​sarahxsanders)
• #​4393 docs: add page on abstract types (@​sarahxsanders)
• #​4394 docs: editorial on abstract types page (@​benjie)
• #​4395 docs: editorial for recent documentation updates (@​benjie)
• #​4396 docs: add page on authorization strategies (@​sarahxsanders)
• #​4398 docs: update "going to production" guide (@​sarahxsanders)
• #​4399 Update mutations-and-input-types.mdx (@​roman-lakhnov)
• #​4400 Remove CJS from docs (@​JoviDeCroock)
• #​4401 docs: add guide on directives (@​sarahxsanders)
• #​4402 docs: add guide for operation complexity controls (@​sarahxsanders)
• #​4405 docs: add guide on nullability (@​sarahxsanders)
• #​4406 docs: add guide on subscriptions (@​sarahxsanders)
• #​4411 docs: add guide on caching strategies (@​sarahxsanders)
• #​4414 docs: guide on scaling your API (@​sarahxsanders)
• #​4416 Editorial for #​4405 (nullability) (@​benjie)
• #​4417 Indicate that field arguments should always be preferred over directives (@​benjie)
• #​4418 docs: trusted documents (@​benjie)
• #​4419 docs: cleanup and fixes (@​sarahxsanders)
• #​4436 Suggestions for federation links (@​Urigo)
• #​4444 Fix navigation (@​JoviDeCroock)
• #​4452 fix(docs/mutations-and-input-types.mdx): root being inside of SDL (@​alesculek)
• #​4473 docs: remove fourth permutation of the visit API (@​janmeier)

Polish 💅

• #​4453 Remove oneof validation from values of correct type (@​JoviDeCroock)

Internal 🏠

3 PRs were merged

• #​4390 Add the version support policy (@​benjie)
• #​4412 internal: use empty merge commit to clean up git diff from 16.x.x (@​yaacovCR)
• #​4479 updated location of ModelSim gitignore file (@​magicmark)

Committers: 9

• Aleš Culek(@​alesculek)
• Benjie(@​benjie)
• Jan Aagaard Meier(@​janmeier)
• Jovi De Croock(@​JoviDeCroock)
• Mark Larah(@​magicmark)
• null(@​roman-lakhnov)
• Sarah Sanders(@​sarahxsanders)
• Uri Goldshtein(@​Urigo)
• Yaacov Rydzinski (@​yaacovCR)

koajs/koa (koa)

v3.1.1

Compare Source

What's Changed

• fix: only original value destroy if the new value is not a stream by @​yowainwright in #​1914

Full Changelog: koajs/koa@v3.1.0...v3.1.1

v3.1.0

Compare Source

==================

fixes

• [2ee32f5] - fix: pin debug@~3.1.0 avoid deprecated warnning (#​1245) (fengmk2 <<fengmk2@​gmail.com>>)

others

• [2180839] - docs: Update koa-vs-express.md (#​1230) (Clayton Ray <[email protected]>)

isaacs/rimraf (rimraf)

v6.1.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e7b8a38

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR