We currently have a managed version of 22.0, but spring-graphql uses the version 22.1. I'm not sure that GraphQL Java really does patch releases so might want to consider when/how we should upgrade.
Comment From: bclozel
GraphQL Java doesn't do patch releases. For example, security fixes are pushed and backported in "minor releases", see this announcement. It's also consistent with what we've done so far with upgrades.
Comment From: philwebb
We should update BOMR when we do this (see #41315)
Comment From: wilkinsona
We also need to upgrade to 21.5 in 3.2.x. I've opened #41340 for that.