[dependabot]

Bumps the security group with 2 updates in the / directory: @graphql-tools/utils and qs.

Updates @graphql-tools/utils from 11.2.2 to 12.1.0

Changelog

Sourced from @​graphql-tools/utils's changelog.

12.1.0

Minor Changes

• #8445 82457d1 Thanks @​ardatan! - Fix: Preserve symbol-keyed GraphQL extensions when building, merging, or extracting schemas.

  GraphQL.js v17 allows string | symbol keys on schema/type/field extensions (via toObjMapWithSymbols). @graphql-tools was dropping those symbol keys in two places:

  1. mergeDeep only walked enumerable string keys (for...in), so symbol extensions were lost when applying schemaExtensions.
  2. extractExtensionsFromSchema did not copy non-enumerable own symbol keys (enumerable symbols already survive object rest/spread; the explicit loop covers the non-enumerable case).

  Example (bug)

  import { makeExecutableSchema } from '@graphql-tools/schema'
  const META = Symbol('META')
  const schema = makeExecutableSchema({
  typeDefs: /* GraphQL */ type Query { hello: String },
  schemaExtensions: {
  schemaExtensions: {
  [META]: { source: 'app' },
  tagged: true,
  },
  types: {},
  },
  })
  // Before: only string keys survived
  // schema.extensions === { tagged: true }
  // After: symbol keys are preserved
  // schema.extensions[META] === { source: 'app' }
  // schema.extensions.tagged === true

  Schema extension merge/extract and resolver merging always enable { enumerable: true, nonEnumerable: true } so symbol keys survive in tools' own merge/extract paths on every supported GraphQL.js major. (GraphQL.js itself may still drop symbol keys from field configs below v17 when rebuilding types.)

  mergeDeep API

  mergeDeep now accepts an options object. The old positional boolean arguments still work but are deprecated.

  import { mergeDeep } from '@graphql-tools/utils'

... (truncated)

Commits

• 3634233 chore(release): update monorepo packages versions (#8505)
• a75d725 fix(utils): keep argument types of defined directives in pruneSchema (#8493)
• 98673c3 fix(utils): coerce GraphQL 17 argument defaults in getArgumentValues (#8513)
• 82457d1 fix: preserve symbol-keyed schema extensions (#8445)
• 691cbd7 build(deps): bump the actions-deps group across 1 directory with 16 updates (...
• 28d08e8 chore(release): update monorepo packages versions (#8486)
• fd95dc9 fix(utils): skip empty descriptions in getDescriptionNode (#8499)
• a73dd1d build(deps-dev): bump the actions-deps group across 1 directory with 3 update...
• 944121e Upcoming Release Changes (#8483)
• 19f5b33 fix(utils): compare path keys to proto at the property access (#8482)
• Additional commits viewable in compare view

Updates qs from 6.15.3 to 6.16.2

Changelog

Sourced from qs's changelog.

6.16.2

• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [meta] use double quotes for better OS support
• [Dev Deps] update evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
• [Fix] stringify: ignore inherited array format names (#622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#583)
• [Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
• [Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @​Yeaseen)
• [Docs] document that qs and flat parsers disagree about parameter names
• [Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
• [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
• [meta] fix changelog indents
• [actions] set least-privilege cache-mode
• [Tests] utils: decode: add missing cases
• [Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)
• [Tests] parse: allowDots: cover stray close brackets before a dot
• [Dev Deps] update @ljharb/eslint-config, eslint, tape

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

6.15.4

• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [meta] use double quotes for better OS support
• [Dev Deps] update @ljharb/eslint-config, evalmd, npmignore, tape
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

Commits

• 136912a v6.16.2
• 6ed1c73 [Dev Deps] update evalmd, npmignore
• a09bc29 [meta] use double quotes for better OS support
• 5d3b1b9 [Fix] stringify: encode keys when allowEmptyArrays is set
• f13ec6c [Tests] stringify: pin allowEmptyArrays output for keys that need no enco...
• 2471b66 v6.16.1
• 51f736e [Docs] document that qs and flat parsers disagree about parameter names
• 40239f7 [Dev Deps] update tape
• d219359 [Fix] parse: do not mutate an object input
• 98157dc [Fix] stringify: stop re-encoding structural separator dots when `encodeDot...
• Additional commits viewable in compare view

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	plcc-web	ee6f8c5	Commit Preview URL Branch Preview URL	Nov 10 2026, 07:00 AM

[timsneath]

@dependabot rebase