[dependabot]

Bumps github.com/vektah/gqlparser/v2 from 2.5.63 to 2.5.64.

Release notes

Sourced from github.com/vektah/gqlparser/v2's releases.

v2.5.64

Changelog

• 9cb3bccd423fe07961a79a98bd92e2a6636df692 Update Go deps to prepare for release (#519)
• 07488f82112bab5f4621427151d32fb059b47c1c build(deps): bump goreleaser/goreleaser-action (#501)
• 0103d1d359bc2b3c518d0d59409ece09ec9dffd6 build(deps): bump js-yaml (#500)
• 857fcf5b77dbd5839db8cef45a8e6f51a5c8afe1 lexer: cap braced unicode escapes at eight digits (#511)
• 09a444d40c0c68ef5755ae204d651cd78a3e0073 lexer: decode braced unicode escapes in strings (#507)
• cb6ec5801fea55bc7b2305e6a095b1a62f1ed706 parser, validator: accept directives on directive definitions (#515)
• d0c057f4b7a054c665d95b326a9ad02139a9e058 parser: accept implements on an interface extension (#508)
• b5305140513155d430ecc478b60e4489227aa51e parser: bound nesting depth to prevent stack-overflow DoS (#516)
• 56827e1b31273b4e621a3dc72679b91638faf4b9 parser: read descriptions of operations, fragments and variables (#509)
• 16fd6444221d3c1a3e9fb6dc3bc11b2165d70f0b parser: reject empty descriptions on the query shorthand (#513)
• 2c5913775b824d572984e50e167510ae09c81989 validator: align enum value name checks with graphql-js (#517)
• ef1f846a30f48ec3e0f8d9fee73d6253acd0b884 validator: export the prelude for gqlgen (#518)
• 110c3f7b29a3128dd9c14ea1121ec026c1b41389 validator: fix list and leaf type conflict checks (#512)
• 23d1e0d811be250cf0e3b47e2a1829772aa88dec validator: reject repeated and self-implemented interfaces (#499)
• 9b9fd7087d8e072a9e2e12007c9fb3c335805094 validator: reject unions with no member types (#502)
• a494eeef216b9d347f133681fc4503ab9a199905 validator: test repeated and self interfaces on interface extensions (#514)

Verifying this release

# 1. cosign signature over the checksum file (identity = the release workflow).
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity 'https://github.com/StevenACoffman/gqlparser/.github/workflows/release.yml@refs/tags/v2.5.64' \
  checksums.txt
2. source tarball + SBOM hash to the now-trusted checksums.
shasum -a 256 -c checksums.txt
3. GitHub build provenance.
gh attestation verify gqlparser_2.5.64_source.tar.gz --repo StevenACoffman/gqlparser

The SBOM is gqlparser_2.5.64_source.tar.gz.sbom.json (SPDX-2.3).

---

Released by GoReleaser.

Commits

• 9cb3bcc Update Go deps to prepare for release (#519)
• ef1f846 validator: export the prelude for gqlgen (#518)
• 2c59137 validator: align enum value name checks with graphql-js (#517)
• b530514 parser: bound nesting depth to prevent stack-overflow DoS (#516)
• 0103d1d build(deps): bump js-yaml (#500)
• 110c3f7 validator: fix list and leaf type conflict checks (#512)
• cb6ec58 parser, validator: accept directives on directive definitions (#515)
• a494eee validator: test repeated and self interfaces on interface extensions (#514)
• d0c057f parser: accept implements on an interface extension (#508)
• 16fd644 parser: reject empty descriptions on the query shorthand (#513)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: gopherium/AlphOne
• Branch: main
• File: .coderabbit.yaml
• Commit: f0853a3
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 16ef4750-623b-48cf-8f38-0536ed501a6b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codescene-access]

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: Clean Code Collective
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!