Merge remote-tracking branch 'origin/16.x.x' into backport-16.x.x

Author: JoviDeCroock

.github/workflows/pull_request.yml

@@ -7,6 +7,8 @@ jobs:
       contents: read # for actions/checkout
       security-events: write # for codeql-action
     uses: ./.github/workflows/ci.yml
+    secrets:
+      codecov_token: ${{ secrets.CODECOV_TOKEN }}
 
   dependency-review:
     name: Security check of added dependencies

.github/workflows/push.yml

@@ -7,6 +7,8 @@ jobs:
       contents: read # for actions/checkout
       security-events: write
     uses: ./.github/workflows/ci.yml
+    secrets:
+      codecov_token: ${{ secrets.CODECOV_TOKEN }}
   deploy-to-npm-branch:
     name: Deploy to `npm` branch
     needs: ci

README.md

@@ -1,3 +1,5 @@
+[![GraphQLConf 2024 Banner: September 10-12, San Francisco. Hosted by the GraphQL Foundation](https://github.com/user-attachments/assets/2d048502-e5b2-4e9d-a02a-50b841824de6)](https://graphql.org/conf/2024/?utm_source=github&utm_medium=graphql_js&utm_campaign=readme)
+
 # GraphQL.js
 
 The JavaScript reference implementation for GraphQL, a query language for APIs created by Facebook.

cspell.yml

@@ -20,6 +20,13 @@ overrides:
     words:
       - clsx
       - infima
+      - noopener
+      - Vite
+      - craco
+      - esbuild
+      - swcrc
+      - noreferrer
+      - xlink
 
 validateDirectives: true
 ignoreRegExpList:

src/execution/__tests__/variables-test.ts

@@ -32,7 +32,7 @@ const TestFaultyScalarGraphQLError = new GraphQLError(
   'FaultyScalarErrorMessage',
   {
     extensions: {
-      code: 'FaultyScalarErrorExtensionCode',
+      code: 'FaultyScalarErrorMessageExtensionCode',
     },
   },
 );
@@ -271,6 +271,27 @@ describe('Execute: Handles inputs', () => {
       });
     });
 
+    it('errors on faulty scalar type input', () => {
+      const result = executeQuery(`
+        {
+          fieldWithObjectInput(input: {c: "foo", e: "bar"})
+        }
+      `);
+
+      expectJSON(result).toDeepEqual({
+        data: {
+          fieldWithObjectInput: null,
+        },
+        errors: [
+          {
+            message: 'Argument "input" has invalid value {c: "foo", e: "bar"}.',
+            path: ['fieldWithObjectInput'],
+            locations: [{ line: 3, column: 39 }],
+          },
+        ],
+      });
+    });
+
     describe('using variables', () => {
       const doc = `
         query ($input: TestInputObject) {

src/jsutils/instanceOf.ts

@@ -1,5 +1,11 @@
 import { inspect } from './inspect.js';
 
+/* c8 ignore next 3 */
+const isProduction =
+  globalThis.process &&
+  // eslint-disable-next-line no-undef
+  process.env.NODE_ENV === 'production';
+
 /**
  * A replacement for instanceof which includes an error warning when multi-realm
  * constructors are detected.
@@ -9,7 +15,7 @@ import { inspect } from './inspect.js';
 export const instanceOf: (value: unknown, constructor: Constructor) => boolean =
   /* c8 ignore next 6 */
   // FIXME: https://github.com/graphql/graphql-js/issues/2317
-  globalThis.process != null && globalThis.process.env.NODE_ENV === 'production'
+  isProduction
     ? function instanceOf(value: unknown, constructor: Constructor): boolean {
         return value instanceof constructor;
       }

src/language/ast.ts

@@ -343,11 +343,12 @@ export interface OperationDefinitionNode {
   readonly selectionSet: SelectionSetNode;
 }
 
-export enum OperationTypeNode {
+enum OperationTypeNode {
   QUERY = 'query',
   MUTATION = 'mutation',
   SUBSCRIPTION = 'subscription',
 }
+export { OperationTypeNode };
 
 export interface VariableDefinitionNode {
   readonly kind: Kind.VARIABLE_DEFINITION;

src/language/directiveLocation.ts

@@ -1,7 +1,7 @@
 /**
  * The set of allowed directive location values.
  */
-export enum DirectiveLocation {
+enum DirectiveLocation {
   /** Request Definitions */
   QUERY = 'QUERY',
   MUTATION = 'MUTATION',

src/language/kinds.ts

@@ -1,7 +1,7 @@
 /**
  * The set of allowed kind values for AST nodes.
  */
-export enum Kind {
+enum Kind {
   /** Name */
   NAME = 'Name',
 
@@ -72,3 +72,5 @@ export enum Kind {
   ENUM_TYPE_EXTENSION = 'EnumTypeExtension',
   INPUT_OBJECT_TYPE_EXTENSION = 'InputObjectTypeExtension',
 }
+
+export { Kind };

src/language/parser.ts

@@ -91,6 +91,15 @@ export interface ParseOptions {
    */
   maxTokens?: number | undefined;
 
+  /**
+   * Parser CPU and memory usage is linear to the number of tokens in a document
+   * however in extreme cases it becomes quadratic due to memory exhaustion.
+   * Parsing happens before validation so even invalid queries can burn lots of
+   * CPU time and memory.
+   * To prevent this you can set a maximum number of tokens allowed within a document.
+   */
+  maxTokens?: number | undefined;
+
   /**
    * @deprecated will be removed in the v17.0.0
    *