Skip to content

Validation of deprecated non-nullable non-default argument is not correct #4182

Closed

Description

@Blemicek

Describe the bug
GraphQL specification prohibits deprecation directive on non-nullable arguments without a default value, but graphql-java allows creation of such schema programmatically although there is validation (DeprecatedInputObjectAndArgumentsAreValid) that should prevent that.

Let say a new argument is created like this:

GraphQLArgument deprecatedArg = GraphQLArgument.newArgument()
  .name("argument")
  .type(GraphQLNonNull.nonNull(Scalars.GraphQLString))
  .deprecate("Some very good reason")
  .build();

The validation then tries to find deprecated applied directive:

GraphQLAppliedDirective deprecatedDirective = argument.getAppliedDirective(Directives.DEPRECATED_DIRECTIVE_DEFINITION.getName());

But deprecatedDirective is null, and so it's reported as valid schema. The fix seems to be calling of argument.isDeprecated(), or combination of both approaches.

To Reproduce

GraphQLArgument deprecatedArg = GraphQLArgument.newArgument()
        .name("input")
        .type(GraphQLNonNull.nonNull(Scalars.GraphQLString))
        .deprecate("Some very good reason")
        .build();

GraphQLFieldDefinition field = GraphQLFieldDefinition.newFieldDefinition()
        .name("field")
        .type(Scalars.GraphQLString)
        .argument(deprecatedArg)
        .dataFetcher(env -> env.getArgument("input")) // for simplicity
        .build();

GraphQLObjectType queryType = GraphQLObjectType.newObject()
        .name("Query")
        .field(field)
        .build();

GraphQLSchema.newSchema()
        .query(queryType)
        .build(); // this method internally do the validation and should throw exception

Equivalent schema (implicit parts are omitted):

type Query {
  field(input: String! @deprecated(reason : "Some very good reason")): String
}

Activity

  1. bbakerman commented on Dec 18, 2025

    @bbakerman
    Member

    Ok I had a look at this and I know the reason its failing.

    When types are created via SDL then code kicks in that notices the @deprecatedArg directive and then calls graphql.schema.GraphQLArgument.Builder#deprecate to set the deprecation string into the argument

    However the DeprecatedInputObjectAndArgumentsAreValid validation code only looks for the actual directive. This is present in the case of SDL build schema but not direct like this.

    I will think more on how we can fix it.

  2. added 2 commits that reference this issue on Dec 18, 2025
  3. bbakerman commented on Dec 18, 2025

    @bbakerman
    Member

    Fixed

  4. added a commit that references this issue on Jan 21, 2026
  5. github-actions commented on Feb 17, 2026

    @github-actions
    Contributor

    Hello, this issue has been inactive for 60 days, so we're marking it as stale. If you would like to continue this discussion, please comment within the next 30 days or we'll close the issue.

  6. bbakerman commented on Feb 18, 2026

    @bbakerman
    Member

    Done

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions