graphql-yoga

This release patches a prototype pollution vulnerability in the multipart parser for graphql-yoga. Several related packages have also been updated to reflect this change.

This release primarily consists of patch updates across various graphql-yoga packages, fixing an issue with provenance attestations when publishing with pnpm in the core graphql-yoga package.

graphql-yoga 5.16.2 and related packages receive patch updates, fixing an error‑masking bug, adding better error codes, and allowing the Prometheus endpoint to be disabled, along with several dependency upgrades.

graphql-yoga 5.16.1 and related packages receive dependency updates, removal of the unused `graphqlEndpoint` option, and the `dset` dependency, requiring minor migration steps.

Version 5.0.0 of the Apollo Link and Urql Exchange packages upgrades runtime and peer dependencies, dropping Node 18 support and older client versions, while fixing a GraphiQL URL loader error.

graphql-yoga 5.14.0 introduces the `withState` utility for shared plugin state, improves error handling inheritance, and upgrades several dependencies, while the Apollo Usage Report plugin becomes production ready with new reporting features.

The release bumps major versions of @graphql-yoga/apollo-link and @graphql-yoga/urql-exchange to 4.0.0, updates @graphql-tools/executor-http to ^2.0.0, and removes an extra error handling plugin from graphql-yoga@5.13.5.

Patch release that updates whatwg-node packages across the @graphql-yoga monorepo and bumps graphql-yoga to 5.13.4 (subscription to 5.0.5); no breaking changes.

This patch release updates numerous @graphql-yoga packages and their peer dependencies, notably bumping tslib to ^2.8.1 and NestJS packages to version 11.