feature: Upgrade graphql-java to 26.+

[iuliiasobolevska]

Describe the Feature Request

Upgrade the DGS Framework from com.graphql-java:graphql-java:25.0 to 26.+.

GraphQL Java is currently constrained to 25.0 in graphql-dgs-platform/build.gradle.kts.

Describe Preferred Solution

• Update the DGS platform constraint to GraphQL Java 26.+.
• Regenerate the affected dependency locks.
• Address any source or test incompatibilities.
• Verify the complete build and published BOM metadata.
• Review and build upon Update gql.resolver to unlock the ability to attach more error information #2259, which already tested a GraphQL Java 26 snapshot and uses APIs introduced in 26.x.
• Coordinate the upgrade with Spring for GraphQL 2.1.0, whose compatibility generation targets GraphQL Java 26 and Spring Boot 4.2.

Spring for GraphQL compatibility generations: https://github.com/spring-projects/spring-graphql/wiki/Spring-for-GraphQL-Versions#generations

Upgrade Risks and Validation Plan

Things to review during the GraphQL Java 26 upgrade:

• Query complexity limits: GraphQL Java 26 enforces a maximum depth of 100 and maximum field count of 100,000 by default. Verify expected validation errors, custom limits through GraphQLContext, disabling limits, and behavior through APQ and preparsed-document paths.
• Kotlin nullability: GraphQL Java 26 adds broad JSpecify annotations. Expect possible Kotlin compilation or inferred-type changes. In particular, test nullable DataLoader values and review bug: Regression (11.1.0): getDataLoader's V : Any bound makes a nullable DataLoader value inexpressible in Kotlin, though MappedBatchLoader returns null for absent keys #2345; the DGS class-based getDataLoader helper currently retains <V : Any>.
• Validation filtering API: Predicates accepted by Validator.validateDocument and ParseAndValidate.parseAndValidate now receive OperationValidationRule rather than rule classes. DGS has no direct usage, but this is a breaking API change exposed to consumers through the platform.
• Removed internal validation APIs: AbstractRule and RulesVisitor were removed. DGS has no direct references, but downstream consumers using these internal types will break.
• Built-in directives: DirectiveInfo was removed in favor of Directives. Built-in directives are now always added and appear before custom directives. Check schema printing, introspection snapshots, federation directives, and custom schema transformations.
• Schema validation: Previously accepted schemas may now fail if they contain uninhabitable recursive @oneOf inputs or deprecated non-null fields in programmatically built schemas.
• Instrumentation: GraphQL Java 26 adds onExceptionHandled. Use Update gql.resolver to unlock the ability to attach more error information #2259 as the starting point and verify instrumentation ordering, chained instrumentation, error classification, resolver metrics, and exception-handler results.
• Field visibility and schema transformation: Version 26 contains substantial correctness changes in these areas. Exercise custom GraphqlFieldVisibility, deleted or hidden fields, additional types, selection sets, and transformed schemas.
• DataLoader and @defer: Retest DataLoader dispatch, scheduled dispatch, multiple deferred fragments, subscriptions, and exceptional completion paths.
• Companion-library compatibility: Confirm compatible versions of java-dataloader, graphql-java-extended-scalars, graphql-java-extended-validation, and Apollo federation support. The current federation dependency requests GraphQL Java 22.3 and is overridden by the DGS platform.
• Spring compatibility and dependency management: Upgrade with Spring for GraphQL 2.1.0, which targets GraphQL Java 26 and Spring Boot 4.2. Ensure Spring Boot's managed version does not override or conflict with the DGS platform. Verify the final result with dependencyInsight; Update gql.resolver to unlock the ability to attach more error information #2259 required an explicit snapshot override and enforcedPlatform.
• Dependency locks and published BOM: Regenerate every affected Nebula lock file and verify that both DGS BOM publications expose GraphQL Java 26.
• Consumer compatibility: Run Java and Kotlin compilation tests against the published BOM, not only the repository's internal test suite.

Upstream release notes:

• https://github.com/graphql-java/graphql-java/releases/tag/v26.+
• https://github.com/graphql-java/graphql-java/releases/tag/v26.1

Starting implementation: #2259