Gathering detailed insights and metrics for @graphql-inspector/core
Gathering detailed insights and metrics for @graphql-inspector/core
🕵️♀️ Validate schema, get schema change notifications, validate operations, find breaking changes, look for similar types, schema coverage
Installations
npm install @graphql-inspector/coreReleases
92
November 13, 2024
release-1731490071726
Published on 13 Nov 2024
June 03, 2024
release-1717403590269
Published on 03 Jun 2024
May 26, 2024
release-1716735735584
Published on 26 May 2024
May 26, 2024
release-1716727014081
Published on 26 May 2024
November 29, 2023
release-1701263349990
Published on 29 Nov 2023
July 11, 2023
release-1689086705050
Published on 11 Jul 2023
Developer
Developer Guide
BETA
Module System
ESM
Min. Node Version
>=18.0.0
Typescript Support
No
Node Version
18.20.4
NPM Version
10.7.0
Statistics
1,653 Stars
2,337 Commits
185 Forks
10 Watching
94 Branches
76 Contributors
Updated on 23 Nov 2024
Bundle Size
94.27 kB
Minified
18.32 kB
Minified + Gzipped
Languages
TypeScript (86.38%)
MDX (12.04%)
JavaScript (1.38%)
Dockerfile (0.13%)
CSS (0.08%)
Total Downloads
Cumulative downloads
Total Downloads
44,477,338
Last day
-9.8%
52,703
Compared to previous day
Last week
-2%
282,776
Compared to previous week
Last month
6.2%
1,243,753
Compared to previous month
Last year
12.4%
13,055,437
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
3
Peer Dependencies
1
Versions
GraphQL Inspector outputs a list of changes between two GraphQL schemas. Every change is precisely explained and marked as breaking, non-breaking or dangerous. It helps you validate documents and fragments against a schema and even find similar or duplicated types.
You may like GraphQL Hive as well!
It's an open-source performance monitoring tool and schema registry for GraphQL.
GraphQL Hive is currently available as a hosted service but it offers self-hosting as well.
Use GraphQL Inspector however you want:
Features
- Compares schemas
- Detect breaking or dangerous changes
- Schema change notifications
- Use serverless functions validate changes
- Validates Operations and Fragments against a schema
- Finds similar / duplicated types
- Schema coverage based on Operations and Fragments
- Serves a GraphQL server with faked data and GraphiQL
- Docker Image
Use on GitHub
Use everywhere
Installation and Usage
Visit our website graphql-inspector.com to learn more about the project.
Documentation
Documentation is available at graphql-inspector.com/docs.
Related
Some part of the library was ported to NodeJS from Ruby's GraphQL Schema Comparator
Contributions
Contributions, issues and feature requests are very welcome. If you are using this package and fixed a bug for yourself, please consider submitting a PR!
And if this is your first time contributing to this project, please do read our Contributor Workflow Guide before you get started off.
Code of Conduct
Help us keep GraphQL Inspector open and inclusive. Please read and follow our Code of Conduct as adopted from Contributor Covenant
License
MIT © Kamil Kisiela
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/docker.yml:11
Reason
4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Reason
Found 3/24 approved changesets -- score normalized to 1
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/actions.yml:1
- Warn: no topLevel permission defined: .github/workflows/ci.yml:1
- Warn: no topLevel permission defined: .github/workflows/docker.yml:1
- Warn: no topLevel permission defined: .github/workflows/github.yml:1
- Warn: no topLevel permission defined: .github/workflows/pr.yml:1
- Warn: no topLevel permission defined: .github/workflows/release.yml:1
- Warn: no topLevel permission defined: .github/workflows/website.yml:1
- Info: no jobLevel write permissions found
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/actions.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/actions.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/ci.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/docker.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/docker.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/docker.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/docker.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/github.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/github.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/github.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/github.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/website.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/website.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/website.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/website.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/website.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/kamilkisiela/graphql-inspector/website.yml/master?enable=pin
- Warn: containerImage not pinned by hash: Dockerfile:1
- Warn: containerImage not pinned by hash: Dockerfile:13
- Warn: npmCommand not pinned by hash: Dockerfile:9
- Warn: npmCommand not pinned by hash: Dockerfile:24
- Info: 0 out of 7 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 7 third-party GitHubAction dependencies pinned
- Info: 0 out of 2 containerImage dependencies pinned
- Info: 0 out of 2 npmCommand dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Reason
34 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-gx9m-whjm-85jf
- Warn: Project is vulnerable to: GHSA-mmhx-hmjr-r674
- Warn: Project is vulnerable to: GHSA-f6v4-cf5j-vf3w
- Warn: Project is vulnerable to: GHSA-434g-2637-qmqr
- Warn: Project is vulnerable to: GHSA-49q7-c7j4-3p7m
- Warn: Project is vulnerable to: GHSA-977x-g7h5-7qgw
- Warn: Project is vulnerable to: GHSA-f7q4-pwc6-w24p
- Warn: Project is vulnerable to: GHSA-fc9h-whq2-v747
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-3wc5-fcw2-2329
- Warn: Project is vulnerable to: GHSA-64fm-8hw2-v72w
- Warn: Project is vulnerable to: GHSA-cvr6-37gx-v8wc
- Warn: Project is vulnerable to: GHSA-f98w-7cxr-ff2h
- Warn: Project is vulnerable to: GHSA-m4gq-x24j-jpmf
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-g77x-44xx-532m
- Warn: Project is vulnerable to: GHSA-gp8f-8m3g-qvj9
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-353f-5xf4-qw67
- Warn: Project is vulnerable to: GHSA-c24v-8rfc-w8vw
- Warn: Project is vulnerable to: GHSA-8jhw-289h-jh2g
- Warn: Project is vulnerable to: GHSA-64vr-g452-qvp3
- Warn: Project is vulnerable to: GHSA-9cwx-2883-4wfx
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-m95q-7qp3-xv42
Score
3.6
/10
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More