fix: graphql@17.0.0 compatibility

[Tony133]

Proposal:

• Fixes mercurius compatibility with graphql@17.0.0, while keeping support for graphql@16 at the same time so users who can't upgrade yet aren't forced to. Without the graphql@17 fixes, 73/376 tests failed after bumping the dependency (see here for preview: https://github.com/mercurius-js/mercurius/actions/runs/29320645825/job/87044889698#step:5:14).

Changes:

• index.js: buildExecutionContext was removed from graphql/execution/execute in graphql 17 → feature-detected against its drop-in successor validateExecutionArgs (same signature/behavior), falling back to buildExecutionContext on graphql@16.
• lib/errors.js: GraphQLError's positional constructor was fully removed in graphql 17 (it's supported since graphql@16.3, so this works on both). toGraphQLError() used the old positional args, which silently dropped originalError — breaking status code mapping (validation/CSRF/persisted-query errors returned 200 instead of 400/405). Switched to the new options-object signature.
• index.js: graphql 17 tags AST loc.source with a non-cloneable Symbol, so structuredClone() crashed on pre-parsed documents (e.g. graphql-tag). Replaced with rfdc (already in the fastify dep tree) for cloning — faster than structuredClone/JSON, and it naturally skips the Symbol-keyed brand without needing to strip loc.
• package.json: widened peerDependencies.graphql to ^16.8.0 || ^17.0.0; added rfdc as an explicit dependency.
• test/directives.test.js: the scalar-coercion error message wording differs between graphql-js 16 and 17, so the expected string is now resolved at runtime based on the installed graphql version (via the version export — require('graphql/package.json') no longer works on @17, its exports map blocks arbitrary subpaths).
• test/app-decorator.test.js: fixed a wrong assertion — mercurius wraps validation GraphQLErrors in MER_ERR_GQL_VALIDATION.errors[], the test was checking the wrong object (e instead of e.errors[0]).
• .github/workflows/ci.yml: added a graphql-version: [16, 17] matrix dimension, with a step that installs the matrix's graphql version after the regular install (--no-save), so both majors are covered in CI. Add node 26 to test matrix.

Note:

• This PR should resolve build(deps-dev): bump graphql from 16.14.2 to 17.0.2 #1249

[mcollina]

I would prefer if we could support both 16 and 17 at the same time, as a lot of people would not be able to upgrade graphql in time. This would require to fiddle with CI so that we run tests for both versions.

[Tony133]

I would prefer if we could support both 16 and 17 at the same time, as a lot of people would not be able to upgrade graphql in time. This would require to fiddle with CI so that we run tests for both versions.

yes I agree, I just wanted to know what you thought first 😉

[Tony133]

I updated the files so as to have compatibility for graphql 16 and 17 and I also updated the CI file so it separates the tests for graphql 16 and 17, plus I added nodejs v26 🔥

[mcollina]

index.js has a lot of pure formatting changes (prettier?). Please revert them

[mcollina]

keeping as semver-major as safety measure.

[Tony133]

index.js has a lot of pure formatting changes (prettier?). Please revert them

I think it's my editor that formats everything to a maximum of 80 columns 😄

[mcollina]

Please revert, this is very hard to review

[Tony133]

Please revert, this is very hard to review

Ok, I think I've fixed it, see commit here: 7a38023. Sorry about the issues with the code indentation 🙏🏻

[mcollina]

lgtm

[mcollina]

there are conflicts

[Tony133]

there are conflicts

I don't see any conflicts to resolve 😄, the CI is all green 🙌 ✅

[Tony133]

I accidentally closed the PR 😅, sorry

[Tony133]

ok, the CI is all green 🙌 ✅