chore(deps): grafast 1.1.2, postgraphile 5.1.4

[pyramation]

Last step of the Graphile alignment work. Pairs with constructive-io/constructive-db#2972 — land this one first, since that repo consumes what this one publishes.

What and why

package	from	to
grafast	1.1.1	1.1.2
postgraphile	5.1.3	5.1.4

Both released 2026-08-07, and they are coupled: postgraphile@5.1.4 declares grafast: ^1.1.2, so neither moves alone.

Updated in the ten packages that pin them exactly and in the workspace override. Both have to agree: the package manifests are what downstream consumes (constructive-db resolves this stack from @constructive-io/*), while the override is what collapses upstream's wide peer ranges into a single copy here.

Nothing else in the stack has moved

grafserv, graphile-build, graphile-build-pg, graphile-config, graphile-utils, pg-sql2, pg-introspection, tamedevil, @dataplan/pg, @dataplan/json, @graphile/lru — all already at their latest published versions.

graphql stays on 16

npm calls graphql@17.0.2 latest, but every package in this stack — grafast, postgraphile, graphile-build, @dataplan/pg — declares graphql: ^16.9.0, and graphql-upload@13 caps at 16 as well. 17 is not available to us until Graphile ships support. The 16.13.0 pin is the ecosystem ceiling, not caution.

Verification

$ pnpm install
grafast@1.1.2        postgraphile@5.1.4      ← one version each
graphile-build@5.1.1 graphile-config@1.1.0
graphql@16.13.0

$ CI=true pnpm install --frozen-lockfile
Lockfile is up to date, resolution step is skipped

$ pnpm pnpm-policy check
pnpm-workspace.yaml matches the policy

$ pnpm exec tsc --version
Version 5.9.3

dist/package.json copies also carry these pins but are gitignored build artifacts, so the diff is the ten source manifests plus the override.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V6watrJsLurfsr3uhnqibB

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	grafast@​1.1.2
	postgraphile@​5.1.4

View full report