Fix/mesh peer deps

[AjazSumaiya]

Description

aio api-mesh init fails with npm error ERESOLVE when user selects npm as package manager.: https://jira.corp.adobe.com/browse/CEXT-4473

Cause

Two independent dependency conflicts in the init template's package.json:

Conflict 1 — utils/types: The template depends on @graphql-mesh/utils transitively (via graphql → store → utils). npm resolves utils@^0.43.20 to the latest matching version from the registry — 0.43.23 — which tightened its peer dependency on @graphql-mesh/types from ^0.91.12 to ^0.91.15. The root project pins types@0.91.12, so npm's strict peer resolution rejects the tree.

root: @graphql-mesh/types@0.91.12 (pinned)
└── @graphql-mesh/graphql@0.34.13
└── needs @graphql-mesh/utils@^0.43.20
└── npm picks utils@0.43.23 (latest matching from registry)
└── needs @graphql-mesh/types@^0.91.15  ← CONFLICT (root has 0.91.12)

Checked registry -

• utils@0.43.20 → requires types@^0.91.12 ✓ → https://registry.npmjs.org/@graphql-mesh/utils/0.43.20
• utils@0.43.23 → requires types@^0.91.15 ✗ → https://registry.npmjs.org/@graphql-mesh/utils/0.43.23

Conflict 2 — cross-helpers (http): @graphql-mesh/http@^0.96.9 belongs to a newer mesh generation and pulls cross-helpers@^0.4.x, while the rest of the stack (runtime@0.46.21) requires cross-helpers@^0.3.4.

@graphql-mesh/http@0.96.14
└── needs @graphql-mesh/cross-helpers@^0.4.x

@graphql-mesh/runtime@0.46.21
└── needs @graphql-mesh/cross-helpers@^0.3.4  ← CONFLICT

Same reproducilbe on diff machine locally

Ajaz-PC adobe-mesh-projects % aio api-mesh:init standard-mesh
? Do you want to create the workspace in /Users/umarajaz/adobe-mesh-projects Yes

? Do you want to initiate git in your workspace? No
? Select a package manager npm
? The directory is not empty. Do you want to create a sub directory with project
 name Yes
Creating workspace in /Users/umarajaz/adobe-mesh-projects/standard-mesh
Installing dependencies
    Error: npm install exection failed
Ajaz-PC adobe-mesh-projects % cd ~/adobe-mesh-projects/standard-mesh
Ajaz-PC standard-mesh % npm install --all
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: [standard-mesh@0.0.1](mailto:standard-mesh@0.0.1)
npm error Found: @graphql-mesh/types@0.91.12
npm error node_modules/@graphql-mesh/types
npm error   @graphql-mesh/types@"0.91.12" from the root project
npm error   peer @graphql-mesh/types@"^0.91.12" from @graphql-mesh/graphql@0.34.13
npm error   node_modules/@graphql-mesh/graphql
npm error     @graphql-mesh/graphql@"0.34.13" from the root project
npm error   1 more (@graphql-mesh/store)
npm error
npm error Could not resolve dependency:
npm error peer @graphql-mesh/types@"^0.91.15" from @graphql-mesh/utils@0.43.23
npm error node_modules/@graphql-mesh/utils
npm error   peer @graphql-mesh/utils@"^0.43.20" from @graphql-mesh/graphql@0.34.13
npm error   node_modules/@graphql-mesh/graphql
npm error     @graphql-mesh/graphql@"0.34.13" from the root project
npm error   peer @graphql-mesh/utils@"^0.43.20" from @graphql-mesh/store@0.9.20
npm error   node_modules/@graphql-mesh/store
npm error     peer @graphql-mesh/store@"^0.9.20" from @graphql-mesh/graphql@0.34.13
npm error     node_modules/@graphql-mesh/graphql
npm error       @graphql-mesh/graphql@"0.34.13" from the root project
npm error     1 more (@graphql-mesh/types)
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /Users/ajaz/.npm/_logs/2026-06-18T10_42_50_085Z-eresolve-report.txt
npm error A complete log of this run can be found in: /Users/ajaz/.npm/_logs/2026-06-18T10_42_50_085Z-debug-0.log


Ajaz-PC standard-mesh % aio plugins
@adobe/aio-cli-plugin-api-mesh 5.7.0

Ajaz-PC standard-mesh % node --version && npm --version
v26.3.0
11.16.0

Why only init fails

The root CLI plugin's package-lock.json locks utils to 0.43.20 (generated when that was the latest), so npm install on the plugin itself respects the lockfile and never hits the conflict. The init template has no lockfile — every aio api-mesh:init does a fresh npm install which resolves from the registry, picking utils@0.43.23.

Why yarn users don't see this

yarn allows multiple versions of a peer dependency to coexist.

Fix :

1. Downgraded @graphql-mesh/http from ^0.96.9 to 0.3.26 — cannot remove from root because @graphql-mesh/cli@0.82.30 uses it internally for its mesh serve command (cli/commands/serve/serve.js imports createMeshHTTPHandler). Pinning to 0.3.26 aligns with the version cli@0.82.30 already depends on.

Checked @graphql-mesh/http is unused:

server.js line 1 (imports runtime, not http):
https://github.com/adobe/aio-cli-plugin-api-mesh/blob/main/src/server.js#L1
server.js line 6 (imports graphql-yoga):
https://github.com/adobe/aio-cli-plugin-api-mesh/blob/main/src/server.js#L6
serverUtils.js (no http import):
https://github.com/adobe/aio-cli-plugin-api-mesh/blob/main/src/serverUtils.js
Template package.json line 27 (only place http appears):
https://github.com/adobe/aio-cli-plugin-api-mesh/blob/main/src/templates/package.json#L27

Tracing why http module history in the package:
@graphql-mesh/http@^0.96.9 was introduced in PR #89[Closed] (Oct 2023, CEXT-1646 "Run Command - Local Dev Server") — it was likely tried as the HTTP transport, then replaced with graphql-yoga, but the dependency was never cleaned up from the template.

2. Added @graphql-mesh/utils: "0.43.20" to overrides — defensive fix so the root is also protected if package-lock.json is ever regenerated.

Impact:

none.
None. The local dev server is unaffected — it never used @graphql-mesh/http. Root retains http at 0.3.26 for cli's internal use.

@graphql-mesh/http is listed in the template but never imported — the local dev server (aio api-mesh run) uses graphql-yoga + fastify directly via @graphql-mesh/runtime.
Confirmed by grep: zero imports of @graphql-mesh/http in CLI source code.

Related Issue

Motivation and Context

How Has This Been Tested?

Tested locally

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have signed the Adobe Open Source CLA.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[macytd]

LGTM