Prevent updates to child cart items via updateCartItems mutation

Author: pmclain

app/code/Magento/QuoteGraphQl/Model/Resolver/UpdateCartItems.php

@@ -105,6 +105,11 @@ private function processCartItems(Quote $cart, array $items): void
             $itemId = (int)$item['cart_item_id'];
             $customizableOptions = $item['customizable_options'] ?? [];
 
+            $cartItem = $cart->getItemById($itemId);
+            if ($cartItem && $cartItem->getParentItemId()) {
+                throw new GraphQlInputException(__('Child items may not be updated.'));
+            }
+
             if (count($customizableOptions) === 0 && !isset($item['quantity'])) {
                 throw new GraphQlInputException(__('Required parameter "quantity" for "cart_items" is missing.'));
             }