Not sure if it's a bug or a misunderstanding of the spec. I'm migrating from 5.1.1 to 7.2.0 and found that in some cases, the HttpStatus Code changed from 200 to 400. For example, when the required field is missing from the query, I'm getting now BadRequest (400)

{
  "errors": [
    {
      "message": "Argument 'testInput' has invalid value. Missing required field 'name' of type 'String'.",
      "locations": [
        {
          "line": 1,
          "column": 52
        }
      ],
      "extensions": {
        "code": "GRAPHQL_VALIDATION",
        "codes": [
          "ARGUMENTS_OF_CORRECT_TYPE"
        ],
        "number": "5.6.1",
      }
    }
  ]
}

The spec for application/json says:

Note: A status code in the 4xx or 5xx ranges or status code 203 (and maybe others) could originate from intermediary servers; since the client cannot determine if an application/json response with arbitrary status code is a well-formed GraphQL response (because it cannot trust the source) the server must use 200 status code to guarantee to the client that the response has not been generated or modified by an intermediary.

And also:

Note: For compatibility with legacy servers, this specification allows the use of 4xx or 5xx status codes for failed requests where the response uses the application/json media type, but it is strongly discouraged. To use 4xx and 5xx status codes, please use the application/graphql-response+json media type.