create-payload-app creates project with duplicate graphql versions

[lorenjerickson]

Link to reproduction

No response

Describe the Bug

A newly scaffolded payload app will not start due to conflicting internal references to graphql pacakges. The fill error message is copied below.

~/dev/sample-app/node_modules/payload/node_modules/graphql/jsutils/instanceOf.js:43
            throw new Error(`Cannot use ${className} "${stringifiedValue}" from another module or realm.
                  ^
Error: Cannot use GraphQLScalarType "EmailAddress" from another module or realm.

Ensure that there is only one instance of "graphql" in the node_modules
directory. If different versions of "graphql" are the dependencies of other
relied on modules, use "resolutions" to ensure only one version is installed.

https://yarnpkg.com/en/docs/selective-version-resolutions

Duplicate "graphql" modules cannot be used at the same time since different
versions may have different capabilities and behavior. The data from one
version used in the function from another could produce confusing and
spurious results.
    at instanceOf (/home/loren/dev/wanderlust/node_modules/payload/node_modules/graphql/jsutils/instanceOf.js:43:19)
    at isScalarType (/home/loren/dev/wanderlust/node_modules/payload/node_modules/graphql/type/definition.js:117:37)
    at isType (/home/loren/dev/wanderlust/node_modules/payload/node_modules/graphql/type/definition.js:92:5)
    at new GraphQLList (/home/loren/dev/wanderlust/node_modules/payload/node_modules/graphql/type/definition.js:348:5)
    at reduce (/home/loren/dev/wanderlust/node_modules/payload/src/graphql/schema/withOperators.ts:305:19)
    at Array.reduce (<anonymous>)
    at withOperators (/home/loren/dev/wanderlust/node_modules/payload/src/graphql/schema/withOperators.ts:288:28)
    at getFieldSchema (/home/loren/dev/wanderlust/node_modules/payload/src/graphql/schema/fieldToWhereInputSchemaMap.ts:63:24)
    at /home/loren/dev/wanderlust/node_modules/payload/src/graphql/schema/buildWhereInputType.ts:60:29
    at Array.reduce (<anonymous>)
[20:24:03] INFO (payload): Connected to MongoDB server successfully!
[20:24:03] INFO (payload): Starting Payload...
[nodemon] app crashed - waiting for file changes before starting...

To Reproduce

1. create a new project with npx create-payload-app@latest
2. once the project is scaffolded, immediate run npm run dev.
3. observe that the server crashes with the error below

create-payload-app output:

$ npx create-payload-app@latest

  Welcome to Payload. Let's create a project! 

✔ Project name? … cms
✔ Choose project template › blank
✔ Select a database › MongoDB
✔ Enter MongoDB connection string … mongodb://127.0.0.1/cms

  Creating project in /home/loren/dev/wanderlust/apps/cms

✔ Dependencies installed
✔ .env file created
✔ Payload project successfully created

  ★ Launch Application:

    - cd ./cms
    - npm run dev or follow directions in README.md

  ★ Documentation:

    - Getting Started
    - Configuration

npm run dev output:

Error: Cannot use GraphQLScalarType "EmailAddress" from another module or realm.

Ensure that there is only one instance of "graphql" in the node_modules
directory. If different versions of "graphql" are the dependencies of other
relied on modules, use "resolutions" to ensure only one version is installed.

4. run npm ls graphql and find that the only references to graphql are by Payload CMS and it's internal dependencies, which are in fact different versions

   sample-app@ ~/dev/sample-app
   └─┬ cms@1.0.0 -> ./apps/cms
   └─┬ payload@2.28.0
   ├─┬ graphql-http@1.21.0
   │ └── graphql@16.9.0
   ├─┬ graphql-query-complexity@0.12.0
   │ └── graphql@16.9.0 deduped
   ├─┬ graphql-scalars@1.22.2
   │ └── graphql@16.9.0 deduped
   ├─┬ graphql-type-json@0.3.2
   │ └── graphql@16.9.0 deduped
   └── graphql@16.8.1

5. using resolutions in package.json as the full error message suggests does not fix the problem

   "resolutions": {
   "graphql": "^16.9.0"
   }

Payload Version

2.28.0

Adapters and Plugins

none

[lorenjerickson]

Should have also added the following context.

Node: v20.11.1
npm: v10.2.4
TypeScript: v5.3.3

Repository is a turbo monorepo, but no other package in the monorepo references graphql. After adding the resolution it appears that only graphql@16.9.0 is installed but the error message at startup persists.