[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/vektah/gqlparser/v2	v2.5.31 → v2.5.60

---

Release Notes

vektah/gqlparser (github.com/vektah/gqlparser/v2)

v2.5.60

Compare Source

Changelog

• 4e17d6e ast: cover the quoting cases mutants slipped through (#​485)
• 1abdeea ast: quote string values as GraphQL, not Go (#​483)
• cea8f64 formatter: escape """ inside descriptions (#​484)

Verifying this release

# 1. cosign signature over the checksum file (identity = the release workflow).
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity 'https://github.com/StevenACoffman/gqlparser/.github/workflows/release.yml@refs/tags/v2.5.60' \
  checksums.txt

# 2. source tarball + SBOM hash to the now-trusted checksums.
shasum -a 256 -c checksums.txt

# 3. GitHub build provenance.
gh attestation verify gqlparser_2.5.60_source.tar.gz --repo StevenACoffman/gqlparser

The SBOM is gqlparser_2.5.60_source.tar.gz.sbom.json (SPDX-2.3).

---

Released by GoReleaser.

v2.5.59

Compare Source

Changelog

• 7bd8ce2 Avoid iterator allocations in overlapping field validator (#​481)
• 3ccd437 Benchmarks, a benchmark gate, property tests and mutation testing (#​482)
• 6ddb710 Index fragments by name in the validator walker (#​472)
• b312a14 build(deps): bump brace-expansion in /validator/imported (#​480)
• dce6e66 build(deps-dev): bump prettier (#​473)
• 3e25eab feat(validator): Add new validator.EmptyDefinitionError (#​474)
• eaee109 lexer: combine surrogate pair escapes in string literals (#​476)
• 1c204b4 validator: make MaxIntrospectionDepth linear in fragment spreads (#​471)
• b99f91a validator: stop OverlappingFieldsCanBeMerged recursing forever on fragment cycles (revised #​477) (#​478)

Verifying this release

# 1. cosign signature over the checksum file (identity = the release workflow).
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity 'https://github.com/StevenACoffman/gqlparser/.github/workflows/release.yml@refs/tags/v2.5.59' \
  checksums.txt

# 2. source tarball + SBOM hash to the now-trusted checksums.
shasum -a 256 -c checksums.txt

# 3. GitHub build provenance.
gh attestation verify gqlparser_2.5.59_source.tar.gz --repo StevenACoffman/gqlparser

The SBOM is gqlparser_2.5.59_source.tar.gz.sbom.json (SPDX-2.3).

---

Released by GoReleaser.

v2.5.58

Compare Source

Changelog

• 9a84c0a Compare composite argument values in sameValue (#​108) (#​459)
• 42cda29 build(deps): bump browserslist in /validator/imported (#​464)
• 991cd11 build(deps): bump the actions-deps group across 1 directory with 7 updates (#​467)
• 5d4af16 build(deps): bump the actions-deps group with 2 updates (#​465)
• dc52fbe validator: add OverlappingFieldsCanBeMerged spec cases

Verifying this release

# 1. cosign signature over the checksum file (identity = the release workflow).
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity 'https://github.com/StevenACoffman/gqlparser/.github/workflows/release.yml@refs/tags/v2.5.58' \
  checksums.txt

# 2. source tarball + SBOM hash to the now-trusted checksums.
shasum -a 256 -c checksums.txt

# 3. GitHub build provenance.
gh attestation verify gqlparser_2.5.58_source.tar.gz --repo StevenACoffman/gqlparser

The SBOM is gqlparser_2.5.58_source.tar.gz.sbom.json (SPDX-2.3).

---

Released by GoReleaser.

v2.5.37

Compare Source

Changelog

• Fix default values for inline variable fields by @​surbhi-singh in #​447
• fix(validator): Reject non-null input cycles by @​romshark in #​456
• validator: add opt-in source-aware validation errors by @​virgil-king in #​461
• Update and pin by @​StevenACoffman in #​462
• Add Go releaser and SBOM by @​StevenACoffman in #​463
• build(deps): bump the actions-deps group in /validator/imported with 2 updates by @​dependabot[bot] in #​446
• build(deps): bump brace-expansion from 5.0.6 to 5.0.9 in /validator/imported by @​dependabot[bot] in #​455
• build(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 in the actions-deps group across 1 directory by @​dependabot[bot] in #​452
• build(deps): bump actions/setup-go from 6 to 7 in the actions-deps group across 1 directory by @​dependabot[bot] in #​450
• build(deps): bump the actions-deps group across 1 directory with 3 updates by @​dependabot[bot] in #​453
• build(deps): bump js-yaml from 5.2.3 to 5.4.1 in /validator/imported in the actions-deps group across 1 directory by @​dependabot[bot] in #​458
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 in the actions-deps group across 1 directory by @​dependabot[bot] in #​457

New Contributors

• @​surbhi-singh made their first contribution in #​447
• @​romshark made their first contribution in #​456
• @​virgil-king made their first contribution in #​461

Full Changelog: vektah/gqlparser@v2.5.36...v2.5.37

Verifying this release

# 1. cosign signature over the checksum file (identity = the release workflow).
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity 'https://github.com/StevenACoffman/gqlparser/.github/workflows/release.yml@refs/tags/v2.5.37' \
  checksums.txt

# 2. source tarball + SBOM hash to the now-trusted checksums.
shasum -a 256 -c checksums.txt

# 3. GitHub build provenance.
gh attestation verify gqlparser_2.5.37_source.tar.gz --repo StevenACoffman/gqlparser

The SBOM is gqlparser_2.5.37_source.tar.gz.sbom.json (SPDX-2.3).

---

Released by GoReleaser.

v2.5.36

Compare Source

What's Changed

• Reject duplicate union member types by @​greymoth-jp in #​442
• Improve duplicate union error message by @​StevenACoffman in #​443
• lexer: render invalid-character codepoint as hex, not decimal by @​c-tonneslan in #​431
• build(deps): bump actions/checkout from 6 to 7 in the actions-deps group by @​dependabot[bot] in #​440
• build(deps): bump the actions-deps group in /validator/imported with 7 updates by @​dependabot[bot] in #​441
• build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 in the actions-deps group by @​dependabot[bot] in #​445
• build(deps): bump the actions-deps group in /validator/imported with 2 updates by @​dependabot[bot] in #​444

New Contributors

• @​greymoth-jp made their first contribution in #​442
• @​c-tonneslan made their first contribution in #​431

Full Changelog: vektah/gqlparser@v2.5.35...v2.5.36

v2.5.35

Compare Source

What's Changed

• Migrate yaml dependency to go.yaml.in/yaml/v3 by @​atzedus in #​437
• fix nullable nested list variable coercion by @​jbellenger in #​439
• build(deps-dev): bump prettier from 3.8.3 to 3.8.4 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​438

Full Changelog: vektah/gqlparser@v2.5.34...v2.5.35

v2.5.34

Compare Source

What's Changed

• fix fragment definition directive variable handling by @​jbellenger in #​426
• Remove github.com/andreyvit/diff dependency by @​jeolted in #​430
• fix: reject duplicate enum values and repeated non-repeatable directives by @​advoretsky in #​436
• build(deps): bump @​babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4 in /validator/imported by @​dependabot[bot] in #​428
• build(deps): bump @​babel/preset-env from 7.29.2 to 7.29.3 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​427
• build(deps): bump @​babel/preset-env from 7.29.3 to 7.29.5 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​429
• build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 in the actions-deps group by @​dependabot[bot] in #​433
• build(deps): bump the actions-deps group across 1 directory with 7 updates by @​dependabot[bot] in #​434

New Contributors

• @​jbellenger made their first contribution in #​426
• @​jeolted made their first contribution in #​430
• @​advoretsky made their first contribution in #​436

Full Changelog: vektah/gqlparser@v2.5.33...v2.5.34

v2.5.33

Compare Source

What's Changed

• fix: allow repeatable directives on GraphQL document by @​fredzqm in #​418
• feat: create a new ScalarLeafsRuleWithoutSuggestions validator rule by @​XuankangLin in #​413
• refactor: format lines in scalar_leafs.go by @​XuankangLin in #​423
• Fix negative Position.Column for definitions with block string descriptions (#​254) by @​riwal42c in #​422
• Update spec to 2023 version by @​StevenACoffman in #​401
• Bump picomatch from 2.3.1 to 2.3.2 in /validator/imported by @​dependabot[bot] in #​420
• Bump @​babel/preset-env from 7.29.0 to 7.29.2 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​419
• Bump brace-expansion from 1.1.12 to 1.1.13 in /validator/imported by @​dependabot[bot] in #​421
• Bump prettier from 3.8.1 to 3.8.2 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​424
• Bump prettier from 3.8.2 to 3.8.3 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​425
• Bump minimatch from 3.0.4 to 3.1.5 in /validator/imported by @​dependabot[bot] in #​417

New Contributors

• @​XuankangLin made their first contribution in #​413
• @​riwal42c made their first contribution in #​422

Full Changelog: vektah/gqlparser@v2.5.32...v2.5.33

v2.5.32

Compare Source

What's Changed

• lint and format by @​StevenACoffman in #​414
• Add formatter.WithNonIntrospectionBuiltin by @​fredzqm in #​415
• [Refactor] Fix linter error in dumper.go & path.go by @​fredzqm in #​416
• Bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 in the actions-deps group by @​dependabot[bot] in #​398
• Bump js-yaml from 4.1.0 to 4.1.1 in /validator/imported by @​dependabot[bot] in #​399
• Bump chai from 6.2.0 to 6.2.1 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​400
• Bump the actions-deps group with 2 updates by @​dependabot[bot] in #​402
• Bump prettier from 3.6.2 to 3.7.3 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​403
• Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 in the actions-deps group by @​dependabot[bot] in #​405
• Bump prettier from 3.7.3 to 3.7.4 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​404
• Bump chai from 6.2.1 to 6.2.2 in /validator/imported in the actions-deps group by @​dependabot[bot] in #​406
• Bump the actions-deps group across 1 directory with 6 updates by @​dependabot[bot] in #​410
• Bump the actions-deps group across 1 directory with 4 updates by @​dependabot[bot] in #​412

Full Changelog: vektah/gqlparser@v2.5.31...v2.5.32

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package	Change
github.com/stretchr/testify	v1.11.1 -> v1.12.1
go.yaml.in/yaml/v3	v3.0.4 -> v3.0.5