Update dependency @graphql-codegen/cli to v7.4.6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@graphql-codegen/cli (source)	7.2.0 → 7.4.6

---

Release Notes

dotansimha/graphql-code-generator (@​graphql-codegen/cli)

v7.4.6

Compare Source

Patch Changes

• #​10985
  d8aa07f
  Thanks @​eddeee888! - Build with strict: true, which changes
  these emitted type declarations:

  • @graphql-codegen/cli: mkdirp returns Promise<string | undefined>, and the require (-r)
    CLI option's default is typed never[] instead of any[].
  • @graphql-codegen/visitor-plugin-common: BaseResolversVisitor and BaseTypesVisitor
SchemaDefinition()/SchemaExtension() return null instead of any.
  • @graphql-codegen/visitor-plugin-common: BaseSelectionSetProcessor.typeCache is keyed by
    Location | undefined.
  • @graphql-codegen/visitor-plugin-common: SelectionSetToObject.buildSelectionSet returns
    typeInfo as { name: string; type: string } | null.
  • @graphql-codegen/visitor-plugin-common: getPossibleTypes accepts null as the type, which
    graphql 15's schema.getType() can return.
  • @graphql-codegen/visitor-plugin-common: removeDescription returns nodes with
    description: undefined instead of any.
  • @graphql-codegen/typescript: TsIntrospectionVisitor's constructor takes pluginConfig as
    TypeScriptPluginConfig | undefined, DirectiveDefinition() returns null and
    ObjectTypeDefinition() returns string | null.
  • @graphql-codegen/client-preset: the babel preset accepts options as
    ClientBabelPresetOptions | null | undefined.
  • @graphql-codegen/testing: mockGraphQLServer returns nock.Scope | null.
  • @graphql-codegen/graphql-modules-preset: a schema without extensions (graphql 15) throws the
    "requires to use GraphQL SDL" error instead of a TypeError.

  Generated output is unchanged.

• Updated dependencies
  [d8aa07f]:

  • @​graphql-codegen/client-preset@6.2.3

v7.4.5

Compare Source

Patch Changes

• #​11043
  31761f9
  Thanks @​eddeee888! - dependencies updates:

  • Updated dependency
    @graphql-tools/apollo-engine-loader@^8.0.38 ↗︎
    (from ^8.0.28, in dependencies)
  • Updated dependency
    @graphql-tools/code-file-loader@^8.1.41 ↗︎
    (from ^8.1.39, in dependencies)
  • Updated dependency
    @graphql-tools/git-loader@^8.0.44 ↗︎
    (from ^8.0.32, in dependencies)
  • Updated dependency
    @graphql-tools/github-loader@^9.1.11 ↗︎
    (from ^9.0.6, in dependencies)
  • Updated dependency
    @graphql-tools/graphql-file-loader@^8.1.22 ↗︎
    (from ^8.1.11, in dependencies)
  • Updated dependency
    @graphql-tools/json-file-loader@^8.0.36 ↗︎
    (from ^8.0.26, in dependencies)
  • Updated dependency
    @graphql-tools/load@^8.1.19 ↗︎
    (from ^8.1.8, in dependencies)
  • Updated dependency
    @graphql-tools/merge@^9.2.6 ↗︎
    (from ^9.2.4, in dependencies)
  • Updated dependency
    @graphql-tools/url-loader@^9.1.12 ↗︎
    (from ^9.0.6, in dependencies)
  • Updated dependency
    @graphql-tools/utils@^12.0.3 ↗︎
    (from ^11.2.0, in dependencies)
  • Updated dependency
    graphql-config@^5.1.8 ↗︎ (from
    ^5.1.6, in dependencies)

• #​11043
  31761f9
  Thanks @​eddeee888! - Update @graphql-tools/utils to v12, and
  other @graphql-tools/* dependencies and graphql-config to releases that use it, to pick up the
  fix for GHSA-7mx3-vvmw-hjmv (prototype
  pollution in mergeDeep, @graphql-tools/utils <= 12.0.0).

  @graphql-codegen/cli now unwraps the AggregateError that newer @graphql-tools/load versions
  throw, so schema and document syntax errors still print the native GraphQLError with its file
  location.

• Updated dependencies
  [31761f9,
  31761f9,
  31761f9,
  31761f9]:

  • @​graphql-codegen/client-preset@6.2.2
  • @​graphql-codegen/core@6.2.2
  • @​graphql-codegen/plugin-helpers@7.4.2

v7.4.4

Compare Source

Patch Changes

• #​11025
  43d0f65
  Thanks @​BuddhaBing! - Widen
  Types.SchemaWithLoaderOptions['loader'] to accept a custom loader function
  (CustomSchemaLoaderFn) in addition to a path string.

  A per-entry schema custom loader ({ '<pointer>': { loader, ...options } }) is resolved by
  @graphql-tools/load's useCustomLoader, which already accepts either a path string (resolved
  via require()) or a function value at runtime (typeof loaderPointer === 'function'). Only the
  TypeScript type restricted loader to string, forcing consumers who pass an imported loader
  function (or a class instance exposing a bound loader property) to cast the schema array to
  bypass the type error, even though it worked correctly at runtime.

  This is additive and backward compatible — loader: string continues to type-check exactly as
  before.

  Also fixes a schema-cache collision for function loaders in @graphql-codegen/cli: the cache key
  is JSON.stringify(schemaPointerMap), and JSON.stringify drops functions, so two generates
  targets using different loader functions for the same pointer
  ({ 'schema.graphql': { loader: fnA } } vs { loader: fnB }) both keyed as
  {"schema.graphql":{}} and the second silently reused the first's schema. Function values are now
  keyed by object identity (via the existing getJsObjectId), so distinct loaders load separately
  while one function reused across targets still loads once.

• #​11020
  82ebbb5
  Thanks @​eddeee888! - Fix type errors in cli under
  strict: true:

  • @graphql-codegen/cli: loadCodegenConfig returns Promise<LoadCodegenConfigResult | null>,
    matching the null it resolves to when no config file is found. YamlCliFlags includes the
    kebab-case ignore-no-documents, emit-legacy-common-js-imports and import-extension flags
    that the CLI reads. CodegenContext.filepath is optional, and watch mode only watches the
    config file when the context has a filepath. CodegenContext.getConfig() without an argument
    returns Types.Config, and getConfig(extraConfig) returns T & Types.Config.
    CodegenContext.checkModeStaleFiles is typed as string[]. Adds @types/yargs,
    @types/babel__generator and @types/babel__template as dev dependencies.
  • @graphql-codegen/plugin-helpers: normalizeInstanceOrArray and normalizeConfig accept
    null and undefined, returning [].

  Generated output is unchanged.

• Updated dependencies
  [43d0f65,
  82ebbb5,
  e972b6d,
  eae0e62,
  1f7566f]:

  • @​graphql-codegen/plugin-helpers@7.4.1
  • @​graphql-codegen/client-preset@6.2.1

v7.4.3

Compare Source

Patch Changes

• #​10983
  8512e51
  Thanks @​eddeee888! - Add missing --check in CLI --help config

v7.4.2

Compare Source

Patch Changes

• #​10956
  cec9c1c
  Thanks @​eddeee888! - Fix dynamically-loaded plugins/presets in ESM
  builds. Previously, ESM used the bare module specifier without resolving it relative to the
  consuming project first, so a plugin only loaded if it happened to be reachable from the CLI
  package's own node_modules. Resolving it the same way the CJS build already does
  (relativeRequire.resolve(mod)) fixes that, but the resolved absolute path also has to be
  converted to a file:// URL (pathToFileURL(...).href) before being passed to import() —
  otherwise, on Windows, the loader misparses a raw path like C:\... as a c: protocol scheme and
  throws ERR_UNSUPPORTED_ESM_URL_SCHEME.

• #​10966
  3029b60
  Thanks @​eddeee888! - Fix lifecycle hook scripts (e.g.
  hooks: { afterAllFileWrite: ['prettier --write'] } }) failing on Windows when the file paths
  passed to them contain a backslash or other POSIX shell-special character. Hook arguments were
  always quoted using POSIX single-quoting, but child_process.exec() runs through cmd.exe on
  Windows by default, which doesn't strip single quotes — so the hook script received the literal
  quote characters as part of its argument and failed to find the file. Arguments are now quoted
  per-platform: POSIX quoting stays unchanged elsewhere, and Windows arguments are wrapped in double
  quotes only when they actually need it, matching cmd.exe's own convention.

• #​10959
  7dffaae
  Thanks @​eddeee888! - Fix the CLI reporting success (exit code 0)
  when a generates output's preset can't be resolved. The error was shown in the terminal but
  never counted toward the run's failure state, so allowPartialOutputs: false (the default) never
  took effect for this case.

v7.4.1

Compare Source

Patch Changes

• #​10935
  fb1a7c4
  Thanks @​eddeee888! - dependencies updates:

  • Updated dependency
    @graphql-tools/code-file-loader@^8.1.39 ↗︎
    (from ^8.1.28, in dependencies)

• #​10942
  57c3e7b
  Thanks @​eddeee888! - dependencies updates:

  • Updated dependency
    @graphql-tools/merge@^9.2.4 ↗︎
    (from ^9.0.6, in dependencies)

• #​10942
  57c3e7b
  Thanks @​eddeee888! - Bump @graphql-tools/merge from ^9.0.6 to
  ^9.2.4.

• #​10935
  fb1a7c4
  Thanks @​eddeee888! - Fix a Windows-specific import() failure on
  absolute paths when loading a schema/document from a .js/.cjs/.mjs file (via
  @graphql-tools/code-file-loader), and when loading modules passed to that loader's own require
  option. Node's dynamic import() rejects raw absolute Windows paths (the drive letter is parsed
  as a URL scheme). Fixed by bumping @graphql-tools/code-file-loader to 8.1.39, which contains
  the upstream fix
  (ardatan/graphql-tools#8421).

• #​10936
  9521c0c
  Thanks @​eddeee888! - Fix watch mode's generated ignore glob
  patterns using the platform path separator (\ on Windows), which @parcel/watcher never
  matched, so generated output files were watched (and could re-trigger builds) instead of being
  ignored. Ignore patterns are now always forward-slash, as @parcel/watcher expects.

  Also fixes the test suite's TempDir.clean() helper on Windows, where rimraf.sync() rejected
  its own glob-style cleanup pattern as containing illegal path characters; now passes
  { glob: true }. This is a test-only change (tests/utils.ts is not part of the published
  package) included here since it was needed to get the suite green on Windows alongside the
  watch-mode fix.

v7.4.0

Compare Source

Minor Changes

• #​10928
  90229a5
  Thanks @​eddeee888! - Add
  contentComparison?: 'cache-first' | 'disk' to control disk-vs-cache write comparison in watch
  mode.

  In watch mode the CLI caches the hash of the content it last wrote per file and compares new
  output against that cached hash to skip redundant writes. This assumes generated output is a pure
  function of the codegen inputs. An output whose content depends on the file's existing content
  (e.g. a preset that reads the file and rewrites part of it) breaks that assumption: if the file is
  changed on disk and codegen regenerates content identical to a previous run, the cached hash still
  matches and the write is skipped, so the on-disk change is never corrected.

  contentComparison: 'disk' opts an output into comparing the generated content against the file
  on disk instead of the in-memory record of what codegen last wrote, so the file is rewritten when
  it was changed externally. It can be set:

  • by a preset, on the GenerateOptions it returns from buildGeneratesSection, or
  • on the output config (generates[output].contentComparison) for any output, including plain
    plugin outputs without a preset.

  When both are present, the preset's value takes precedence. The default, 'cache-first', keeps
  the existing in-memory-cache behaviour for outputs that are a pure function of their inputs.

Patch Changes

• #​10930
  448431a
  Thanks @​eddeee888! - Fix overwrite being ignored for
  preset-based generates outputs.

  A generates entry that used a preset and set overwrite (e.g.
  overwrite: { removeStaleFiles: false }) had that setting silently ignored, so in watch mode its
  generated files could still be deleted as stale.

  The CLI resolved overwrite per generated file by looking the file's path up in
  config.generates. That fails for a preset: its generates entry is keyed by the preset's
  baseOutputDir, not by any generated file's path (and a preset can emit files outside that
  directory), and the lookup additionally required a plugins key that preset entries don't have.
  Both cases fell through to the global config.overwrite (default true).

• Updated dependencies
  [90229a5,
  448431a]:

  • @​graphql-codegen/plugin-helpers@7.3.0

v7.3.1

Compare Source

Patch Changes

• #​10924
  0c8f5ba
  Thanks @​eddeee888! - Fix profiler output not being written to the
  filesystem in watch mode (--profile --watch)

  The profiler trace was only written on the non-watch code path, after the watch-mode early return,
  so a profiled watch session never produced a codegen-*.json file.

  The profiler now writes a fresh trace file after the initial run and after every rebuild, with
  each file containing only that run's events. A failed rebuild does not produce a trace and its
  events are discarded so they don't leak into the next successful run.

  The Profiler now owns its own trace lifecycle:

  • a new clear() method starts a new trace
  • a new outputName property provides the filename for the current trace (null for the noop
    profiler)
  • filename generation was removed from CodegenContext

• Updated dependencies
  [0c8f5ba]:

  • @​graphql-codegen/plugin-helpers@7.2.1

v7.3.0

Compare Source

Minor Changes

• #​10921
  58cdb31
  Thanks @​eddeee888! - Extend overwrite with
  overwrite.removeStaleFiles and overwrite.updateExistingFiles

  overwrite was being used to both remove stale files in watch mode and update existing files.
  Some plugins such as Server Preset may dynamically return files to write between watch runs (for
  performance purposes).

  The overwrite can now take an object with overwrite.removeStaleFiles and
  overwrite.updateExistingFiles fields to allow granular control over actions.

  This is not a breaking change because overwrite=true|false still works.

Patch Changes

• Updated dependencies
  [58cdb31]:
  • @​graphql-codegen/plugin-helpers@7.2.0

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "after 2am and before 8am on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: eesast-web@2024.0.0
npm error Found: graphql@17.0.2
npm error node_modules/graphql
npm error   graphql@"17.0.2" from the root project
npm error
npm error Could not resolve dependency:
npm error peer graphql@"^15.0.0 || ^16.0.0" from @apollo/client@3.14.1
npm error node_modules/@apollo/client
npm error   @apollo/client@"3.14.1" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-09T12_31_40_049Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-09T12_31_40_049Z-debug-0.log

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request