GraphQL Java 25.1

Apply the Java 21 baseline first. GraphQL Java 25.1 is the current bugfix release of the 25 line, compiles to Java 11 bytecode, is tested on JDK 11, 17, and 21, and depends on java-dataloader 6.0.0. These rules cover the 25 line's configuration surface, limits, execution controls, and the features it introduced. When Spring for GraphQL serves this line, also apply the Spring Security prompt for its installed version.

Version scope and dependencies

• Pin com.graphql-java:graphql-java:25.1 and follow the 25 branch specifically, because the project ships security and critical bug backports as separate patch releases per maintained line.
• Audit every custom CacheMap when you upgrade from the 24 line, since java-dataloader 6.0.0 replaced synchronized dispatch with compare-and-swap and now requires cache implementations to be atomically thread safe.
• Keep the stock ConcurrentHashMap-backed cache unless you have a measured reason to replace it, because concurrent loads of one key must receive the same cached future through CacheMap.putIfAbsentAtomically.
• Rewrite instrumentation that called InstrumentationFieldCompleteParameters.getFetchedValue(), which 25 replaced with getFetchedObject() that may return a plain POJO instead of a FetchedValue.
• Re-test any hook that inspects or rewrites completed field values after that change, because quietly handling the wrong shape turns a redaction or authorization check into a no-op.

Startup configuration

• Route parser, introspection, and property-fetching settings through GraphQL.unusualConfiguration() so