Release notes from graphql-java

25.1

2026-08-24T00:12:34Z

This is a bugfix release for the 25 version of GraphQL Java

24.4

2026-08-24T00:04:40Z

This is a bugfix release for the 24 version of GraphQL Java

26.1

2026-08-24T00:53:48Z

26.1

This is a bugfix release for 26.

It contains a couple of fixes and no breaking changes.

List of PRs

#4452 Backport 26.1: Remove dependency annotations from shaded classes
#4443 Backport to 26.1: Fix nullable bound on DataFetcherResult.newResult
#4444 Backport to 26.1: Fix covariance checks for SDL type extensions
#4448 Backport 26.1: Fix input cycle validation for non-null lists
#4447 Backport 26.1: Allow empty unions to be completed by extensions
#4449 Backport 26.1: Fix subscription alternative call context cleanup
#4446 Backport 26.1: Fix schema rebuild after root type deletion
#4457 Backport 26.1: Mark InstrumentationState callback params as @nullable
#4451 Backport 26.1: Reject cyclical SDL directive definitions
#4450 Backport 26.1: validate circular default values

Full Changelog: v26.0...v26.1

26.0

2026-04-24T00:02:47Z

This is the 26.0 release of graphql-java. Highlights are summarized below; the full list of merged PRs is at the end.

⚠️ Breaking Changes

Query complexity limits are now enforced by default

New QueryComplexityLimits validation checks maxDepth (default 100) and maxFieldsCount (default 100,000) as part of standard validation. Queries exceeding these limits will now fail with new MaxQueryDepthExceeded / MaxQueryFieldsExceeded validation errors.

Set custom limits via GraphQLContext using QueryComplexityLimits.KEY.
Disable entirely with QueryComplexityLimits.NONE.

Introduced in #4256.

Validation rule filtering API changed

In #4228 the rule-filter predicate changed from Predicate<Class<?>> to Predicate<OperationValidationRule> in Validator.validateDocument(...) and ParseAndValidate.parseAndValidate(...). Callers that filtered by class (e.g. rule -> rule != NoUnusedFragments.class) must migrate to the enum (rule -> rule != OperationValidationRule.NO_UNUSED_FRAGMENTS). The @Internal classes AbstractRule and RulesVisitor were removed.

Built-in directive handling consolidated (#4229)

DirectiveInfo was removed. Replace usages:
- DirectiveInfo.isGraphqlSpecifiedDirective(...) → Directives.isBuiltInDirective(...)
- DirectiveInfo.GRAPHQL_SPECIFICATION_DIRECTIVES → Directives.BUILT_IN_DIRECTIVES
- DirectiveInfo.GRAPHQL_SPECIFICATION_DIRECTIVE_MAP → Directives.BUILT_IN_DIRECTIVES_MAP
Directive ordering is now consistent: all 7 built-in directives appear first, followed by user-defined directives.
GraphQLSchema.Builder.clearDirectives() was initially removed then re-added in #4276 with new semantics — it clears all additionalDirectives, but built-in directives are always re-added automatically at build time.

OneOf inhabitability validation (#4248)

New validator rejects OneOf input types that cannot be populated with a finite value (e.g. input A @oneOf { a: A }). Schemas that previously validated may now be rejected.

Non-null field validation for code-built schemas (#4194)

Code-built schemas now perform the same deprecated-on-non-null field validation as SDL-built ones. Schemas relying on the gap may now fail validation.

`GraphQLSchema.getCodeRegistry()` is no longer `@Nullable` (#4247)

The return type was incorrectly annotated nullable. Callers may now drop redundant null checks; downstream nullness tooling will reflect the change.

JSpecify nullability annotations rolled out broadly

Waves 2 and 3 (#4184, #4274) plus many individual PRs annotated hundreds of classes across graphql.analysis, graphql.execution, graphql.language, graphql.schema and others with @NullMarked/@NullUnmarked/@Nullable. Kotlin and other null-aware callers will now see stricter nullability contracts; code that relied on previously-permissive signatures may need adjustment.

✨ New Features

GraphQLSchema.FastBuilder (#4197) — a more restrictive but ~5× faster schema builder that reduces both time and memory for large schemas.
Query complexity limits (#4256) — depth/field-count guardrails baked into validation (see breaking changes above for the enforcement side).
QueryAppliedDirective on operations and documents (#4297) — directives applied at the operation/document level are now exposed as QueryAppliedDirectives.
New instrumentation hook for post-exception-handling results (#4206, #4207) — observe the DataFetcherResult after DataFetcherExceptionHandler has mapped exceptions to errors. ChainedInstrumentation delegates the new hook correctly.
Generic DataFetcherResult.newBuilder(T data) (#4254) — removes the need for explicit type witnesses on the common DataFetcherResult.<T>newResult().data(x)... pattern.
Re-added GraphQLSchema.Builder.clearDirectives() (#4276) — useful with GraphQLSchema.transform to rewrite non-built-in directives; built-ins are always re-added.
toString() on AST directives holders (#4195).

⚡ Performance

Incremental @defer execution starts earlier (#4174) — begins processing deferred payloads as soon as the first incremental call is detected instead of waiting for the initial result to complete.
Validation consolidation (#4228) — all operation validation rules run in a single OperationValidator pass, significantly cutting validation overhead.
Reduced allocations on the execution hot path (#4252):
- Async$Many.materialisedList() — replaced ArrayList copy with a zero-copy Arrays.asList() wrapper.
- ResultPath.toStringValue — lazy computation; the string form is only built on first toString() (typically only during error reporting).
- New GraphQLCodeRegistry.getDataFetcher(String, String, GraphQLFieldDefinition) overload avoiding per-fetch FieldCoordinates allocations (~54 KB/op reduction).
FastBuilder for schema construction (#4197) — see New Features.
Fixed ShallowTypeRefCollector to also resolve type refs inside applied directive arguments and enum value definitions (#4288) — correctness fix enabling FastBuilder to be used on more schemas.

🐛 Other Noteworthy Changes

Execution / data fetching

DataLoader dispatch with multiple @defer fragments (#4270) — fixes a case where DataLoaders were not dispatched correctly when multiple deferred fragments were in play.
CompletionStageSubscriber race condition (#4296) — completion signal could be lost if an in-flight CompletionStage resolved concurrently. Fix is backed by new jcstress stress tests.
PropertyDataFetcher on non-public classes (#4287) — properties on non-public classes that implement public interfaces (e.g. TreeMap.Entry) now fetch correctly on Java 16+ by searching public interfaces.
ExecutableNormalizedField respects GraphqlFieldVisibility (#4204) — selection-set APIs now use the schema's configured visibility instead of going straight to the type.
ScheduledDataLoaderRegistry "dispatch all" fix (#4164).
ChainedInstrumentation onExceptionHandled delegation (#4207).

Schema / field visibility

Fixes for complex field-visibility transformer cases and schema transformation when deletions cascade (#4203, #4205, #4208, #4209, #4212, #4213, #4275).
Overlapping-fields null-type regression fixed (#4291).
GraphQLTypeCollectingVisitor now recursively traverses indirect strong references (#4213).
SchemaTraverser::depthFirst overload signature fix (#4165).

Build / packaging / security

Bytecode-modified classes no longer ship in published JARs (#4343) — the @Generated annotation injected for coverage reporting was leaking into published artifacts. JARs now contain pristine compiler output.
Trojan Source / glassworm Unicode detection (#4344) — pre-commit hook and CI workflow now reject dangerous BiDi/zero-width/control characters in source.
Windows compatibility (#4239) — removed colons from performance-results/ filenames, split the oversized large-schema-5.graphqls, added pre-commit + CI checks.

Tooling / DX

getDataLoader type bounds improved (#4180).
Build and test on Java 25 (#4173, #4330).
Many dependency updates (Reactor, Jackson, Kotlin, Groovy, Gradle, ByteBuddy, errorprone, etc.) across the release.

Full PR list

Expand to see all merged PRs

use dispatch all to not break ScheduledDataLoaderRegistry by @andimarek in #4164
Upgrade to Gradle 9.2.0 by @Copilot in #4171
fix build after gradle 9 upgrade by @andimarek in #4175
GQLGW-5297-optimise-incremental-part-execution-for-defer-requests by @llin2 in #4174
Bump actions/checkout from 5 to 6 by @dependabot in #4178
Bump net.bytebuddy:byte-buddy from 1.17.8 to 1.18.1 by @dependabot in #4176
Bump io.projectreactor:reactor-core from 3.7.12 to 3.8.0 by @dependabot in #4168
Bump com.google.errorprone:error_prone_core from 2.43.0 to 2.44.0 by @dependabot in #4167
Fix error: Unusable type signature for overload of graphql.schema.SchemaTraverser::depthFirst #4147 by @marktech0813 in #4165
Getdataloader type bounds by @ctbarbour in #4180
All fields removed from object/interface via field visibility transformer which is reachable via additional types by @andimarek in #4203
fixes complex case for Field visibility transformer. See test case by @andimarek in #4205
Proposal for an additional instrumentation hook point by @tinnou in #4206
Call onExceptionHandled in ChainedInstrumentation by @tinnou in #4207
Add documentation and test for additionalTypes in GraphQLSchema by @andimarek in #4208
Fix schema transformation and Field Visibility for complex deletion cases by @andimarek in #4209
fix javadoc and add github job to verify it explicitly by @andimarek in #4210
Build and test using Java 25 by @yeikel in #4173
#4190 - AST directives holder has a toString() by @bbakerman in #4195
#4182 - code built schemas should perform deprecated non null field validations as well as SDL built ones by @bbakerman in #4194
fixes and improves field visibility by @andimarek in #4212
Fix type collecting for indirect references by @andimarek in #4213
Fix testWithJava21 task running zero tests by @andimarek in #4227
Fix ExecutableNormalizedField to respect GraphqlFieldVisibility by @Samjin in #4204
Consolidate built-in directive handling and move helpers to Directives class by @andimarek in #4229
Add more large schemas for performance testing by @andimarek in #4233
feat: GraphQLSchema.FastBuilder for High-Performance Schema Construction by @rstata in #4197
Bump EnricoMi/publish-unit-test-result-action from 2.21.0 to 2.22.0 by @dependabot in #4199
Bump com.gradleup.shadow from 9.0.0 to 9.3.0 by @dependabot in #4189
Update Objenesis, Spock and Groovy by @m1ngyuan in #4240
Bump gradle-wrapper from 9.2.0 to 9.3.1 by @dependabot in #4236
Bump com.gradleup.shadow from 9.3.0 to 9.3.1 by @dependabot in #4235
Bump org.jetbrains.kotlin.jvm from 2.2.21 to 2.3.0 by @dependabot in #4234
JSpecify big wave 2 by @dondonz in #4184
Fix Windows compatibility: rename files with reserved chars, split large files, add pre-commit hook and CI validation by @Copilot in #4239
Remove incorrect @nullable from GraphQLSchema.getCodeRegistry() by @andimarek in #4247
OneOf Inhabitability by @jbellenger in #4248
Consolidate validation rules into single OperationValidator and improve performance by @andimarek in #4228
Reduce allocations in Async$Many and ResultPath on execution hot path by @andimarek in #4252
Bump aws-actions/configure-aws-credentials from 5 to 6 by @dependabot in #4241
Bump org.testng:testng from 7.11.0 to 7.12.0 by @dependabot in #4242
Bump com.fasterxml.jackson.core:jackson-databind from 2.20.1 to 2.21.0 by @dependabot in #4243
Bump net.ltgt.errorprone from 4.3.0 to 5.0.0 by @dependabot in #4246
Fix SchemaTransformerBenchmark to pass schema validation by @andimarek in #4255
Add generic DataFetcherResult.newBuilder(T data) method by @jord1e in #4254
Benchmark introspection against multiple large schemas by @andimarek in #4260
Bump net.bytebuddy:byte-buddy from 1.18.1 to 1.18.5 by @dependabot in #4265
Bump com.fasterxml.jackson.core:jackson-databind from 2.21.0 to 2.21.1 by @dependabot in #4266
Bump me.bechberger:ap-loader-all from 4.0-10 to 4.3-12 by @dependabot in #4264
Bump com.google.errorprone:error_prone_core from 2.44.0 to 2.47.0 by @dependabot in #4244
Bump EnricoMi/publish-unit-test-result-action from 2.22.0 to 2.23.0 by @dependabot in #4262
Re-add GraphQLSchema.Builder.clearDirectives() by @rstata in #4276
Add performance results dashboard subproject by @andimarek in #4277
Fix jar file naming when branch contains slashes by @andimarek in #4290
Fix overlapping fields null type regression from 072165b by @andimarek in #4291
Small typo fixed by @zkozina in #4273
Check in field visibility transformer test - union member error now fixed by @dondonz in #4275
Add test & coverage reporting to PR comments and master baseline by @andimarek in #4292
Fix spec303 flaky failure in ordered publisher TCK tests by @andimarek in #4293
Add unified allBuildAndTestSuccessful CI check by @andimarek in #4294
Fix CompletionStageSubscriber race condition, add jcstress tests and CI coverage gate by @andimarek in #4296
Extract shared JaCoCo parser and fix self-closing tag bug by @andimarek in #4300
Add Dependabot auto-merge workflow by @dondonz in #4298
Bump net.bytebuddy:byte-buddy from 1.18.5 to 1.18.7 by @dependabot in #4286
Bump net.ltgt.errorprone from 5.0.0 to 5.1.0 by @dependabot in #4285
Bump io.projectreactor:reactor-core from 3.8.0 to 3.8.3 by @dependabot in #4283
Bump org.jetbrains.kotlin.jvm from 2.3.0 to 2.3.10 by @dependabot in #4282
Bump actions/upload-pages-artifact from 3 to 4 by @dependabot in #4281
Add agentic CI doctor workflow by @dondonz in #4258
Bump com.google.errorprone:error_prone_core from 2.47.0 to 2.48.0 by @dependabot in #4284
Fix Dependabot auto-merge showing as skipped check on all PRs by @dondonz in #4304
Add JSpecify annotations to execution instrumentation classes (10 more) by @dondonz in #4272
Add unit tests for ExhaustedDataLoaderDispatchStrategy by @andimarek in #4306
Fix flaky DataLoaderPerformanceTest with deterministic synchronization by @andimarek in #4299
Add unit tests for PerLevelDataLoaderDispatchStrategy coverage by @andimarek in #4308
Fix findPubliclyAccessibleMethod to search interfaces for accessible methods by @andimarek in #4287
Fix dataloader dispatch in @defer when multiple deferred fragments exist by @timward60 in #4270
Bump actions/upload-artifact from 4 to 7 by @dependabot in #4315
Bump org.ow2.asm:asm from 9.7.1 to 9.9.1 by @dependabot in #4318
Bump org.junit.jupiter:junit-jupiter from 5.14.1 to 5.14.3 by @dependabot in #4321
Improve coverage gate: hybrid regression check + method-level detail reporting by @andimarek in #4324
Fix ShallowTypeRefCollector: resolve type refs in applied directive arguments by @rstata in #4288
Bump actions/download-artifact from 4 to 8 by @dependabot in #4323
Bump actions/github-script from 7 to 8 by @dependabot in #4322
Bump github/gh-aw from 0.49.0 to 0.56.2 by @dependabot in #4319
Update agents.md to improve AI assisted PRs by @dondonz in #4305
Add deterministic CAS retry tests for ExhaustedDataLoaderDispatchStrategy by @andimarek in #4329
Default test task to Java 25 only by @andimarek in #4330
Change Dependabot update schedule from weekly to monthly by @dondonz in #4326
Bump gradle-wrapper from 9.3.1 to 9.4.0 by @dependabot in #4333
Bump github/gh-aw from 0.56.2 to 0.57.2 by @dependabot in #4334
Bump org.junit.platform:junit-platform-launcher from 1.14.1 to 1.14.3 by @dependabot in #4335
Bump io.projectreactor:reactor-core from 3.8.3 to 3.8.4 by @dependabot in #4336
Bump com.gradleup.shadow from 9.3.1 to 9.3.2 by @dependabot in #4337
Agentic CI doctor to ignore coverage gate warnings by @dondonz in #4340
This adds support for QueryAppliedDirective on operations and documents by @bbakerman in #4297
Never package bytecode-modified class files in published JARs by @andimarek in #4343
Add dangerous Unicode character detection (Trojan Source / glassworm) by @andimarek in #4344
Add JSpecify annotations to language package nodes - redo (12 more) by @dondonz in #4257
Add JSpecify annotations to 10 classes in graphql.language package and improve annotation prompt by @Copilot in #4216
Disable no-op issue reporting for CI Failure Doctor by @dondonz in #4346
Add JSpecify annotations to 10 graphql.language classes by @Copilot in #4217
Add query complexity limits and refactor GoodFaithIntrospection to use validation by @andimarek in #4256
Remove agentic CI doctor pipeline by @dondonz in #4354
Bump net.bytebuddy:byte-buddy from 1.18.7 to 1.18.8 by @dependabot in #4356
Bump gradle/actions from 5 to 6 by @dependabot in #4357
Bump actions/deploy-pages from 4 to 5 by @dependabot in #4358
Bump org.jetbrains.kotlin.jvm from 2.3.10 to 2.3.20 by @dependabot in #4360
Bump me.bechberger:ap-loader-all from 4.3-12 to 4.3-13 by @dependabot in #4361
Bump org.apache.groovy:groovy from 5.0.4 to 5.0.5 by @dependabot in #4363
Bump actions/configure-pages from 5 to 6 by @dependabot in #4359
Add JSpecify annotations to 10 language package classes by @Copilot in #4218
Add JSpecify annotations to 10 language package classes by @Copilot in #4219
JSpecify big wave 3 by @dondonz in #4274

New Contributors

@Copilot made their first contribution in #4171
@llin2 made their first contribution in #4174
@marktech0813 made their first contribution in #4165
@ctbarbour made their first contribution in #4180
@Samjin made their first contribution in #4204
@rstata made their first contribution in #4197
@m1ngyuan made their first contribution in #4240
@zkozina made their first contribution in #4273

Full Changelog: v25.0...v26.0

untagged-d490dedfce686c22b2ab

2026-04-23T01:01:38Z

Update test baseline [skip ci]

26.0.beta-2

2026-02-19T23:07:30Z

A word of warning

While all features are tested and we consider them ready to be used, we don't guarantee that this is a stable version: this means there will be more breaking changes until we reach 26.0.

This version is intended for testing and providing feedback to the GraphQL Java team.

What's Changed

Breaking Changes

Validation rules consolidated into single OperationValidator — The 31 individual rule classes in graphql.validation.rules.*, AbstractRule, and RulesVisitor have been removed. The rule filtering predicate type changed from Predicate<Class<?>> to Predicate<OperationValidationRule> (a new @PublicApi enum). Code that filters rules by class reference must migrate to the enum. (#4228)
DirectiveInfo class removed — Use Directives.isBuiltInDirective() and Directives.BUILT_IN_DIRECTIVES instead. GraphQLSchema.Builder.clearDirectives() has also been removed — all 7 built-in directives are now always present. Built-in directives now consistently appear first in schema.getDirectives(). (#4229)
JSpecify nullability annotations — big wave 2 — ~50 classes annotated with @NullMarked and @Nullable. This may surface new warnings or errors in projects using NullAway or Kotlin. (#4184)

Performance

23-39% execution throughput improvement — Reduce allocations in Async$Many (zero-copy list), ResultPath (lazy toString()), and GraphQLCodeRegistry (fast-path DataFetcher lookup avoiding throwaway FieldCoordinates allocation). (#4252)
14-40% faster validation — Single OperationValidator eliminates per-rule visitor overhead and reduces collection allocations on hot paths. (#4228)

New Features

feat: GraphQLSchema.FastBuilder for high-performance schema construction by @rstata in #4197
Add OneOf inhabitability validation by @jbellenger in #4248
Call onExceptionHandled in ChainedInstrumentation by @tinnou in #4207
New transformSchemaWithDeletes method for complex deletion cases in #4209

Bug Fixes

Fix ExecutableNormalizedField to respect GraphqlFieldVisibility by @Samjin in #4204
Fix type collecting for indirect references in #4213
Fix and improve field visibility in #4212
Code-built schemas now perform deprecated non-null field validations (same as SDL-built) in #4194
Remove incorrect @Nullable from GraphQLSchema.getCodeRegistry() in #4247

Other Improvements

AST directives holder has a toString() in #4195
Add documentation and test for additionalTypes in GraphQLSchema in #4208
Build and test using Java 25 by @yeikel in #4173
Update Objenesis, Spock and Groovy by @m1ngyuan in #4240
Bump Gradle wrapper to 9.3.1, Shadow to 9.3.1, Kotlin to 2.3.0

New Contributors

@jbellenger made their first contribution in #4248
@rstata made their first contribution in #4197
@Samjin made their first contribution in #4204
@m1ngyuan made their first contribution in #4240
@yeikel made their first contribution in #4173

Full Changelog: v26.0.beta-1...v26.0.beta-2

26.0.beta-1

2026-01-14T03:25:08Z

This is a beta release for the upcoming version 26.

A word of warning

While all features are tested and we consider them ready to be used, we don't guarantee that this is a stable version: this means there will be more breaking changes until we reach 26.0.

This version is intended for testing and providing feedback to the GraphQL Java team.

What's Changed

use dispatch all to not break ScheduledDataLoaderRegistry by @andimarek in #4164
Upgrade to Gradle 9.2.0 by @Copilot in #4171
fix build after gradle 9 upgrade by @andimarek in #4175
GQLGW-5297-optimise-incremental-part-execution-for-defer-requests by @llin2 in #4174
Bump actions/checkout from 5 to 6 by @dependabot[bot] in #4178
Bump net.bytebuddy:byte-buddy from 1.17.8 to 1.18.1 by @dependabot[bot] in #4176
Bump io.projectreactor:reactor-core from 3.7.12 to 3.8.0 by @dependabot[bot] in #4168
Bump com.google.errorprone:error_prone_core from 2.43.0 to 2.44.0 by @dependabot[bot] in #4167
Fix error: Unusable type signature for overload of graphql.schema.SchemaTraverser::depthFirst #4147 by @marktech0813 in #4165
Getdataloader type bounds by @ctbarbour in #4180
All fields removed from object/interface via field visibility transformer which is reachable via additional types by @andimarek in #4203
fixes complex case for Field visibility transformer. See test case by @andimarek in #4205
Proposal for an additional instrumentation hook point by @tinnou in #4206

New Contributors

@Copilot made their first contribution in #4171
@llin2 made their first contribution in #4174
@marktech0813 made their first contribution in #4165
@ctbarbour made their first contribution in #4180

Full Changelog: v25.0...v26.0.beta-1

25.0

2025-11-10T01:21:35Z

Key changes

Dataloader

Refactoring strategy

The existing PerLevelDataLoaderStrategy has been refactored which lead to simplifications and performance improvements.

New strategies

Two new strategies were introduced: CHAINED and EXHAUSTED. Both can be configured via UnusalConfiguration (see next section).

CHAINED allow for chained DataLoaders to be used while keeping a per level dispatch strategies.

EXHAUSTED is a completely new strategy that works on the basis to dispatch once the engine is not busy. It mirrors the JS data loader dispatch strategy, but for a multi threaded system.

Unusual Configuration

A more generalised configuration mechanism has been added for "unusual configuration". By that we mean configuation we dont expect many people to use but if they do its now in a more common place

For example if you wanted to change the maximum depth the document parser will accept you could call the following methods.

        var parserOptions = newParserOptions().maxRuleDepth(99).build()
        GraphQL.unusualConfiguration().parsing().setDefaultParserOptions(parserOptions)

JSpecify Annotations

The team are starting to embrace https://jspecify.dev/ annotations as the way to indicate nullable and non nullable fields. Many important classes have had these annotations added to help make it more semantically clear when a value can be null or not.

Breaking Changes

A wrapping FetchedValue object is not always returned on field fetchers for performance reasons. This means that graphql.execution.instrumentation.parameters.InstrumentationFieldCompleteParameters#getFetchedObject was created to replace the older getFetchedValue method and the returns object can sometimes be a FetchedValue or sometimes a simple POJO value.

Performance improvements

A series of performance improvements have been made to reduce the memory footprint of the library. Also the Java .stream() operator can be slower than a more direct loop and many of these calls have been changed for performance reasons.

avoid wrapping materialized fieldValueObject in a CompletableFuture by @samuelAndalon in #3943
ExecutionStrategyParameters now has a direct transform without a Builder by @bbakerman in #3935
ExecutionStepInfo now has a direct transform without a Builder by @bbakerman in #3934
FpKit now longer uses streams for performance reasons by @bbakerman in #3932
Implement toString/hashCode/equals for DataFetcherResult by @AlexandreCarlton in #3964
Introduce a filter and map imperative method to replace .stream() calls by @bbakerman in #3931
Removing some of the Optional.map() and .stream() for performance reasons by @bbakerman in #3930
Stop creating NonNullableFieldValidator every for every object or list field by @bbakerman in #3929

What's Changed

Bump EnricoMi/publish-unit-test-result-action from 2.18.0 to 2.19.0 by @dependabot[bot] in #3906
Add JSpecify nullability annotations to DataFetcherResult by @dondonz in #3891
Clean up ReactiveSupport by @hantsy in #3908
Remove unused import by @ngocnhan-tran1996 in #3905
Bump com.tngtech.archunit:archunit-junit5 from 1.2.0 to 1.4.0 by @dependabot[bot] in #3907
add dataloader performance test by @andimarek in #3913
Fix and improve EngineRunning state by @andimarek in #3911
move jmh tests into dedicated folder by @andimarek in #3916
Revert "New spec validation: Subscriptions root field must not contain @Skip nor @include on root selection set" by @dondonz in #3917
Bump org.junit.jupiter:junit-jupiter from 5.12.1 to 5.12.2 by @dependabot[bot] in #3915
Bump com.google.code.gson:gson from 2.12.1 to 2.13.0 by @dependabot[bot] in #3914
Bump io.projectreactor:reactor-core from 3.7.4 to 3.7.5 by @dependabot[bot] in #3923
Large in memory query benchmark by @bbakerman in #3921
Bad naming in runner by @bbakerman in #3928
Bump com.google.code.gson:gson from 2.13.0 to 2.13.1 by @dependabot[bot] in #3937
Bump com.fasterxml.jackson.core:jackson-databind from 2.18.3 to 2.19.0 by @dependabot[bot] in #3936
avoid wrapping materialized fieldValueObject in a CompletableFuture by @samuelAndalon in #3943
Test by @andimarek in #3946
Test by @andimarek-atlassian in #3947
reduce forks to 2 to make perf tests faster by @andimarek in #3948
ResponseMapFactory #3857 by @dfa1 in #3894
OSGI - Make org.jspecify.* imports optional by @schulm in #3949
Specify nullness for some graphql.schema.idl classes by @mk868 in #3895
fix case when a fragment is deferred and non deferred at the same time for overlapping fields by @andimarek in #3953
Make JSpecify optional import more specific by @dondonz in #3959
Retriveing singleton property fetchers will not create DataFetcherFactoryEnvironment objects by @bbakerman in #3942
ExecutionStrategyParameters now has a direct transform without a Builder by @bbakerman in #3935
ExecutionStepInfo now has a direct transform without a Builder by @bbakerman in #3934
FpKit now longer uses streams for performance reasons by @bbakerman in #3932
Implement toString/hashCode/equals for DataFetcherResult by @AlexandreCarlton in #3964
add defer test case by @andimarek in #3967
Add DataLoader 5.0.0 by @dondonz in #3958
Introduce a filter and map imperative method to replace .stream() calls by @bbakerman in #3931
Removing some of the Optional.map() and .stream() for performance reasons by @bbakerman in #3930
Stop creating NonNullableFieldValidator every for every object or list field by @bbakerman in #3929
Enable DataLoader chaining (nesting) by @andimarek in #3872
Avoid rare TCK test failure by @andimarek in #3975
Bump com.tngtech.archunit:archunit-junit5 from 1.4.0 to 1.4.1 by @dependabot[bot] in #3957
A generalised configuration mechanism by @bbakerman in #3945
update gradle wrapper validation by @andimarek in #3982
Bump io.projectreactor:reactor-core from 3.7.5 to 3.7.6 by @dependabot[bot] in #3977
deterministic SourceLocation serialization by @jbellenger in #3987
make dataloader work inside defer blocks by @andimarek in #3980
Bump EnricoMi/publish-unit-test-result-action from 2.19.0 to 2.20.0 by @dependabot[bot] in #3990
Add ArchUnit rule to ban javax & JetBrains nullability annotations by @dondonz in #3985
Query generator by @felipe-gdr in #3979
upgrade antlr by @andimarek in #3997
a bit more efficient load in case the strategy doesn't fit by @andimarek in #4001
Bump org.apache.groovy:groovy-json from 4.0.26 to 4.0.27 by @dependabot[bot] in #3998
Bump org.junit.jupiter:junit-jupiter from 5.12.2 to 5.13.0 by @dependabot[bot] in #3999
Response factory as config by @bbakerman in #3950
Bump org.apache.groovy:groovy from 4.0.26 to 4.0.27 by @dependabot[bot] in #4000
minimize work done when chained dataloaders are disabled by @andimarek in #4003
ensure DFEImpl graphql context is never null by @andimarek in #4004
make DFE more nullable aware by @andimarek in #4005
add method to parse field definition from Parser by @andimarek in #4006
DataLoader dispatching for Subscriptions by @andimarek in #3988
Add the new Sonatype URL by @dondonz in #4009
Adding errorprone support and fix chained dataloader bug by @bbakerman in #4002
Bump net.bytebuddy:byte-buddy from 1.17.5 to 1.17.6 by @dependabot[bot] in #4012
Bump net.bytebuddy:byte-buddy-agent from 1.17.5 to 1.17.6 by @dependabot[bot] in #4013
Bump io.projectreactor:reactor-core from 3.7.6 to 3.7.7 by @dependabot[bot] in #4014
Bump com.fasterxml.jackson.core:jackson-databind from 2.19.0 to 2.19.1 by @dependabot[bot] in #4015
Bump org.junit.jupiter:junit-jupiter from 5.13.0 to 5.13.1 by @dependabot[bot] in #4007
Bump com.google.errorprone:error_prone_core from 2.37.0 to 2.39.0 by @dependabot[bot] in #4030
Bump net.ltgt.errorprone from 4.2.0 to 4.3.0 by @dependabot[bot] in #4031
Bump com.gradleup.shadow from 8.3.6 to 8.3.7 by @dependabot[bot] in #4029
Bump org.jetbrains.kotlin.jvm from 2.1.21 to 2.2.0 by @dependabot[bot] in #4018
Added support for Flow publishers coming back from the subscription field data fetcher by @bbakerman in #3910
Bump org.junit.jupiter:junit-jupiter from 5.13.1 to 5.13.2 by @dependabot[bot] in #4032
A few adjustments in the QueryGenerator util by @felipe-gdr in #4011
Bump com.uber.nullaway:nullaway from 0.12.6 to 0.12.7 by @dependabot[bot] in #4019
Add interface addition event in SchemaDiff by @mgadda in #3984
Added Unit test cases for Pair.java by @surajdm123 in #4036
Added Unit Test cases for EscapeUtil by @surajdm123 in #4035
Added a read only copy of a type registry for performance reasons by @bbakerman in #4021
A more memory efficient AstPrinter by @bbakerman in #4028
Cancel support of operations by @bbakerman in #3890
A more memory efficient directives container by @bbakerman in #4027
Allows creating mock schemas where there are default values on custom schemas by @bbakerman in #4039
Add UAT for TreeTransformerUtil by @surajdm123 in #4037
Added test cases for QueryGeneratorOptions by @surajdm123 in #4038
Bump org.junit.jupiter:junit-jupiter from 5.13.2 to 5.13.3 by @dependabot[bot] in #4042
Bump com.gradleup.shadow from 8.3.7 to 8.3.8 by @dependabot[bot] in #4041
Bump com.graphql-java:java-dataloader from 5.0.0 to 5.0.1 by @dependabot[bot] in #4043
This removes the FetchedValue wrapping by default by @bbakerman in #3924
Improved access speed of isPossibleType by @bbakerman in #4040
Improve Execution input nullability by @andimarek in #4046
Removed more .streams() with our filterAndMap code by @bbakerman in #4044
Bump com.google.errorprone:error_prone_core from 2.39.0 to 2.40.0 by @dependabot[bot] in #4052
adding Profiler by @andimarek in #3976
Support null query when running APQ request by @timward60 in #4049
fix repeat until failure usage by @andimarek in #4054
simplify delayed dataloader dispatching by not using a batch window by @andimarek in #4055
Possibility to run JMH benchmarks without JAR build by @dfa1 in #4057
Removing the GraphQL java agent by @andimarek in #4058
Bump org.apache.groovy:groovy from 4.0.27 to 4.0.28 by @dependabot[bot] in #4066
Bump com.fasterxml.jackson.core:jackson-databind from 2.19.1 to 2.19.2 by @dependabot[bot] in #4065
Bump com.graphql-java:java-dataloader from 5.0.1 to 5.0.2 by @dependabot[bot] in #4064
Bump io.projectreactor:reactor-core from 3.7.7 to 3.7.8 by @dependabot[bot] in #4062
Bump com.google.errorprone:error_prone_core from 2.40.0 to 2.41.0 by @dependabot[bot] in #4067
A smidge faster unwrap non-null by @bbakerman in #4059
comment out the processor by default by @andimarek in #4071
cleanup of no longer used Agent class by @andimarek in #4070
Profiler tweaks for JSON serialisation by @dondonz in #4068
MergedField single field support by @bbakerman in #4056
Prohibit JMH tests from having more than 2 forks by @dondonz in #4075
Remove unused imports by @ngocnhan-tran1996 in #4078
Require JSpecify annotations on new Public API and Experimental API classes by @dondonz in #3892
Specify nullness for nodes in the graphql.language package by @mk868 in #3899
Update badges and add book link by @dondonz in #4079
Bump com.gradleup.shadow from 8.3.8 to 9.0.1 by @dependabot[bot] in #4080
Fix IncrementalExecutionResult.transform() to preserve incremental fields by @AndreaRomani in #4073
Type extension field name uniqueness is checked only once by @bbakerman in #4076
Bump com.uber.nullaway:nullaway from 0.12.7 to 0.12.8 by @dependabot[bot] in #4081
Bump actions/checkout from 4 to 5 by @dependabot[bot] in #4082
Fixed deferred support to have proper Instrumentation by @bbakerman in #4083
Prohibit Map.of and provide alternative methods by @dondonz in #4086
Bump io.projectreactor:reactor-core from 3.7.8 to 3.7.9 by @dependabot[bot] in #4090
Bump com.gradleup.shadow from 9.0.1 to 9.0.2 by @dependabot[bot] in #4091
Bump org.eclipse.jetty:jetty-server from 11.0.25 to 11.0.26 by @dependabot[bot] in #4092
Bump org.jetbrains.kotlin.jvm from 2.2.0 to 2.2.10 by @dependabot[bot] in #4093
Bump net.bytebuddy:byte-buddy from 1.17.6 to 1.17.7 by @dependabot[bot] in #4094
Add @NullUnmarked to builders by @dondonz in #4087
Try revert this shadow change with JMH debugging by @dondonz in #4095
Bump com.uber.nullaway:nullaway from 0.12.8 to 0.12.9 by @dependabot[bot] in #4100
Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #4101
Bump actions/stale from 9 to 10 by @dependabot[bot] in #4110
Bump aws-actions/configure-aws-credentials from 4 to 5 by @dependabot[bot] in #4109
Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.20.0 by @dependabot[bot] in #4106
Removed ' character from introspection messages by @bbakerman in #4112
Dont include Kotlin stdlib as a dependency by @bbakerman in #4113
Bump io.projectreactor:reactor-core from 3.7.9 to 3.7.11 by @dependabot[bot] in #4117
Bump org.jetbrains.kotlin.jvm from 2.2.10 to 2.2.20 by @dependabot[bot] in #4116
Bump com.google.code.gson:gson from 2.13.1 to 2.13.2 by @dependabot[bot] in #4114
Chained dl performance improvements with no locking by @andimarek in #4123
chained data loader performance improvements by @andimarek in #4122
Bump com.google.errorprone:error_prone_core from 2.41.0 to 2.42.0 by @dependabot[bot] in #4125
5.0.3 version of dataloader by @bbakerman in #4126
Per level tracking simplification and performance improvements by @andimarek in #4128
cleanup and comments for dataloader tracking by @andimarek in #4129
Bump com.uber.nullaway:nullaway from 0.12.9 to 0.12.10 by @dependabot[bot] in #4124
New Exhaustion based data loader dispatching strategy by @andimarek in #4130
Bump gradle/actions from 4 to 5 by @dependabot[bot] in #4132
Memoize ResultPath level by @AlexandreCarlton in #4135
More Chained DataLoaders performance improvements by @andimarek in #4136
Bump net.bytebuddy:byte-buddy from 1.17.7 to 1.17.8 by @dependabot[bot] in #4137
ENF: mergedField containing duplicates and causing Query directives to fail by @andimarek in #4139
remove unnecessary synchronized by @andimarek in #4138
Record test times and slowests tests by @bbakerman in #4140
Update to Shadow 9.x and configure special task by @dondonz in #4097
Revert "Update to Shadow 9.x and configure special task" by @dondonz in #4143
Bump io.projectreactor:reactor-core from 3.7.11 to 3.7.12 by @dependabot[bot] in #4144
Fix sizing of some maps and collections by @kilink in #4148
Avoid List and String allocation in inRightLocation by @kilink in #4149
Reproduction of issue 4133 by @bbakerman in #4142
Fix nullability annotations for mapAndDropNulls by @kilink in #4150
Optimize GraphqlTypeComparators by @kilink in #4151
Improve FpKit.concat, presize collections / maps by @kilink in #4152
Fix FpKit.concat parameters by @kilink in #4154
Bump org.jetbrains.kotlin.jvm from 2.2.20 to 2.2.21 by @dependabot[bot] in #4156
Bump com.google.errorprone:error_prone_core from 2.42.0 to 2.43.0 by @dependabot[bot] in #4155
Add Copilot instructions by @dondonz in #4158
assert with constants where possible by @kilink in #4153
Adding Instrumentation for reactive results and when they finish by @bbakerman in #4084
Parse hex strings to numbers more efficiently by @kilink in #4160
Shadow 9.0 upgrade by @dondonz in #4159
make DataFetcherResult jspecify better by @andimarek in #4141
Bump EnricoMi/publish-unit-test-result-action from 2.20.0 to 2.21.0 by @dependabot[bot] in #4163
Bump com.fasterxml.jackson.core:jackson-databind from 2.20.0 to 2.20.1 by @dependabot[bot] in #4161
Update to DataLoader 6.0.0 by @dondonz in #4157

New Contributors

@hantsy made their first contribution in #3908
@ngocnhan-tran1996 made their first contribution in #3905
@andimarek-atlassian made their first contribution in #3947
@schulm made their first contribution in #3949
@mk868 made their first contribution in #3895
@mgadda made their first contribution in #3984
@surajdm123 made their first contribution in #4036
@AndreaRomani made their first contribution in #4073

Full Changelog: v23.0...v25.0

25.0.beta-9

2025-10-13T22:46:00Z

This is another beta release for the upcoming version 25.

A word of warning

While all features are tested and we consider them ready to be used, we don't guarantee that this is a stable version: this means there will be more breaking changes until we reach 25.0.

This version is intended for testing and providing feedback to the GraphQL Java team.

What's Changed

Bump gradle/actions from 4 to 5 by @dependabot[bot] in #4132
Memoize ResultPath level by @AlexandreCarlton in #4135
More Chained DataLoaders performance improvements by @andimarek in #4136

Full Changelog: v25.0.beta-7...v25.0.beta-9

25.0.beta-8

2025-09-28T12:10:37Z

This is another beta release for the upcoming version 25.

It contains a new Data Loader dispatching strategy ... see #4130

A word of warning

While all features are tested and we consider them ready to be used, we don't guarantee that this is a stable version: this means there will be more breaking changes until we reach 25.0.

This version is intended for testing and providing feedback to the GraphQL Java team.

What's Changed

Bump com.google.errorprone:error_prone_core from 2.41.0 to 2.42.0 by @dependabot[bot] in #4125
5.0.3 version of dataloader by @bbakerman in #4126
Per level tracking simplification and performance improvements by @andimarek in #4128
cleanup and comments for dataloader tracking by @andimarek in #4129
Bump com.uber.nullaway:nullaway from 0.12.9 to 0.12.10 by @dependabot[bot] in #4124
New Exhaustion based data loader dispatching strategy by @andimarek in #4130

Full Changelog: 25.0.beta-6...v25.0.beta-8

Release notes from graphql-java

25.1

24.4

26.1

26.1

List of PRs

26.0

⚠️ Breaking Changes

Query complexity limits are now enforced by default

Validation rule filtering API changed

Built-in directive handling consolidated (#4229)

OneOf inhabitability validation (#4248)

Non-null field validation for code-built schemas (#4194)

GraphQLSchema.getCodeRegistry() is no longer @Nullable (#4247)

JSpecify nullability annotations rolled out broadly

✨ New Features

⚡ Performance

🐛 Other Noteworthy Changes

Execution / data fetching

Schema / field visibility

Build / packaging / security

Tooling / DX

Full PR list

New Contributors

untagged-d490dedfce686c22b2ab

26.0.beta-2

A word of warning

What's Changed

Breaking Changes

Performance

New Features

Bug Fixes

Other Improvements

New Contributors

26.0.beta-1

A word of warning

What's Changed

New Contributors

25.0

Key changes

Dataloader

Refactoring strategy

New strategies

Unusual Configuration

JSpecify Annotations

Breaking Changes

Performance improvements

What's Changed

New Contributors

25.0.beta-9

A word of warning

What's Changed

25.0.beta-8

A word of warning

What's Changed

`GraphQLSchema.getCodeRegistry()` is no longer `@Nullable` (#4247)