chore(deps): bump strawberry-graphql from 0.323.2 to 0.327.2

[dependabot]

Bumps strawberry-graphql from 0.323.2 to 0.327.2.

Commits

• See full diff in compare view

[claude]

Review

This is a routine Dependabot version bump (strawberry-graphql 0.323.2 → 0.327.2, semver-minor), scoped to a single line in requirements/base.txt. The change itself is clean:

• Single, minimal diff — no unrelated changes.
• The existing inline comment (# code-first GraphQL; replaced graphene-django (schema parity pinned by config/graphql/schema.graphql)) is preserved correctly.
• No other file pins strawberry-graphql separately, so there's nothing else to keep in sync.
• Not flagged as a security update by Dependabot, so no CVE urgency here.

Risk worth flagging before merging

Per this repo's architecture notes, strawberry-graphql isn't a thin dependency here — config/graphql/core/ contains a hand-built "graphene-parity" port (relay global IDs, connection factories, filter-arg mapping, permission resolvers), and config/graphql/schema.graphql is a golden SDL contract: opencontractserver/tests/test_schema_parity.py fails on any shape drift. A 4-minor-version jump (0.323 → 0.327) is exactly the kind of change that could shift SDL output, directive handling, generic scalar behavior, or extension APIs (AddValidationRules is used directly in schema.py) in subtle ways that a generic dependency-update CI run might not catch if it doesn't specifically exercise the GraphQL test suite.

Before merging, I'd suggest explicitly confirming (rather than relying on default CI green):

1. test_schema_parity.py still passes — if it doesn't, this warrants a deliberate SDL regen (per that test's docstring), not just a rubber-stamp merge.
2. The broader GraphQL test suite (queries/mutations/permissions) passes, since permission-annotation resolution (myPermissions, isPublished, etc.) and the JWT auth backends layer on top of strawberry's request context handling.
3. Nothing in strawberry 0.324–0.327 changelogs affects AddValidationRules/extensions usage in config/graphql/schema.py or the relay connection helpers pinned alongside graphql-relay==3.2.0.

No test coverage changes are expected/needed for a pure dependency bump — that's fine as-is. Overall: safe to merge once the GraphQL-specific test suite (not just default CI) is verified, given how deeply this dependency is embedded rather than used as a black box.

[claude]

Review

This is a routine dependabot dependency bump (strawberry-graphql 0.323.2 → 0.327.2), a single line in requirements/base.txt with no other changes.

Consistency check: I compared this against the two prior merged strawberry-graphql bump PRs (#2198, #2179) — both were also single-line version bumps with no changelog fragment or other changes, so this PR follows established precedent for this repo.

Main risk area: per CLAUDE.md, config/graphql/schema.graphql is a golden SDL contract, and opencontractserver/tests/test_schema_parity.py fails on any shape drift. A minor-version bump of the underlying GraphQL library (4 minor versions: 0.324–0.327) could in principle change SDL rendering (e.g. directive ordering, default-value formatting, deprecation reason formatting) even without any application code changes. I couldn't run the Docker-based backend test suite in this environment to confirm, so:

• Please confirm CI is green, specifically test_schema_parity.py and the broader GraphQL test suite, before merging.
• If test_schema_parity.py fails, that's expected/actionable — regenerate schema.graphql per that test's docstring rather than pinning back the version, unless the schema diff reveals an actual behavioral change worth scrutinizing.

No code quality, security, or test coverage concerns beyond the above — there's no first-party code here to review, just a version pin.

[dependabot]

Superseded by #2312.