Bump GraphQL codegen dependencies to patch immutable

[szdziedzic]

Why

Resolve https://github.com/expo/eas-cli/security/dependabot/295 by removing the vulnerable transitive immutable@3.7.6 dependency without overriding its declared semver range.

How

Re-resolved the existing @graphql-tools/relay-operation-optimizer@^7.0.0 dependency to 7.1.6. Its current dependency chain selects:

• @ardatan/relay-compiler@13.0.1
• @graphql-tools/utils@11.2.0
• immutable@5.1.9

This removes the top-level Yarn resolution and deletes the legacy Relay/Babel dependency subtree from the lockfile. The direct GraphQL Codegen dependencies remain unchanged.

Updated the changelog entry to describe the transitive GraphQL codegen upgrade.

Security

• immutable@5.1.9 is newer than the patched 5.1.5 release for GHSA-wf6x-7x77-mvgw.
• A full recursive npm audit reports no advisories for the upgraded dependency chain.
• Compared with the previous tree, the upgrade introduces no known advisories and removes the vulnerable y18n@4.0.0 path.
• The upgraded releases publish npm registry signatures and provenance attestations.

Test Plan

• corepack yarn oxfmt package.json CHANGELOG.md yarn.lock
• corepack yarn install --immutable --check-resolutions
• corepack yarn why immutable -R
• GRAPHQL_SCHEMA_URL=./graphql.schema.json corepack yarn workspace eas-cli generate-graphql-code
• Verified the local-schema GraphQL generation produces no tracked changes
• corepack yarn build
• corepack yarn typecheck
• corepack yarn lint (0 errors, 14 warnings after merging current main)
• corepack yarn fmt:check package.json CHANGELOG.md yarn.lock
• corepack yarn lint-changelog
• corepack yarn npm audit --all --recursive --no-deprecations --json (no advisories for the upgraded chain; unrelated monorepo findings remain)
• EAS CLI Jest suite: 236 suites passed in the sandbox; the six environment-blocked suites were rerun with network and local socket access and all 78 tests passed
• git diff --check

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.57%. Comparing base (a716925) to head (0f719c9).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3972   +/-   ##
=======================================
  Coverage   60.57%   60.57%           
=======================================
  Files         955      955           
  Lines       42069    42069           
  Branches     8832     8832           
=======================================
  Hits        25480    25480           
  Misses      16495    16495           
  Partials       94       94           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Subscribed to pull request

File Patterns	Mentions
**/*	@douglowder

Generated by CodeMention

Warning: The preamble and epilogue options in commentConfiguration are deprecated. Use template instead.

[sjchmiela]

By yarn.lock this is a much bigger change than just immutable.

[github-actions]

✅ Thank you for adding the changelog entry!

[sjchmiela]

Can you confirm if this is still needed after #4009?

[douglowder]

This looks ok, although the yarn.lock diff is large enough to be a little concerning...

[sjchmiela]

Do we still need this after #4009? It looks like that already fixed the immutable alert, and this PR is now conflicting with main.

[douglowder]

Closing this. @szdziedzic please rebase against main, and reopen if you find that this is still needed.