Installations
npm install @hoangvvo/graphql-jit
Score
72.9
Supply Chain
98.1
Quality
74.7
Maintenance
100
Vulnerability
98.9
License
Releases
Unable to fetch releases
Developer
Developer Guide
Module System
CommonJS
Min. Node Version
Typescript Support
Yes
Node Version
18.7.0
NPM Version
8.15.0
Statistics
139 Commits
1 Watching
5 Branches
1 Contributors
Updated on 03 Feb 2022
Languages
TypeScript (99.78%)
JavaScript (0.22%)
Total Downloads
Cumulative downloads
Total Downloads
15,344
Last day
80%
9
Compared to previous day
Last week
-82.4%
12
Compared to previous week
Last month
-30.8%
305
Compared to previous month
Last year
153.2%
8,060
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
5
Peer Dependencies
1
Dev Dependencies
28
GraphQL JIT
This is a fork of zalando-incubator/graphql-jit that features the following improvements:
Support for GraphQL Subscription(merged in upstream)- Custom JSON Stringify factory function
- Minimal dependencies for lightweight bundle
Why?
GraphQL-JS is a very well written runtime implementation of the latest GraphQL spec. However, by compiling to JS, V8 is able to create optimized
code which yields much better performance. graphql-jit
leverages this behaviour of V8 optimization by compiling the queries into functions to significantly improve performance (See benchmarks below)
Benchmarks
GraphQL-JS 16 on Node 16.13.0
1$ yarn benchmark skip-json 2Starting introspection 3graphql-js x 1,941 ops/sec ±2.50% (225 runs sampled) 4graphql-jit x 6,158 ops/sec ±2.38% (222 runs sampled) 5Starting fewResolvers 6graphql-js x 26,620 ops/sec ±2.41% (225 runs sampled) 7graphql-jit x 339,223 ops/sec ±2.94% (215 runs sampled) 8Starting manyResolvers 9graphql-js x 16,415 ops/sec ±2.36% (220 runs sampled) 10graphql-jit x 178,331 ops/sec ±2.73% (221 runs sampled) 11Starting nestedArrays 12graphql-js x 127 ops/sec ±1.43% (220 runs sampled) 13graphql-jit x 1,316 ops/sec ±2.58% (219 runs sampled) 14Done in 141.25s.
Support for GraphQL spec
The goal is to support the June 2018 version of the GraphQL spec.
Differences to graphql-js
In order to achieve better performance, the graphql-jit
compiler introduces some limitations.
The primary limitation is that all computed properties must have a resolver and only these can return a Promise
.
Install
1yarn add graphql-jit
Example
For complete working examples, check the examples/ directory
Create a schema
1const typeDefs = ` 2type Query { 3 hello: String 4} 5`; 6const resolvers = { 7 Query: { 8 hello() { 9 return new Promise((resolve) => setTimeout(() => resolve("World!"), 200)); 10 } 11 } 12}; 13 14const { makeExecutableSchema } = require("@graphql-tools/schema"); 15const schema = makeExecutableSchema({ typeDefs, resolvers });
Compile a Query
1const query = ` 2{ 3 hello 4} 5`; 6const { parse } = require("graphql"); 7const document = parse(query); 8 9const { compileQuery, isCompiledQuery } = require("graphql-jit"); 10const compiledQuery = compileQuery(schema, document); 11// check if the compilation is successful 12 13if (!isCompiledQuery(compiledQuery)) { 14 console.error(compiledQuery); 15 throw new Error("Error compiling query"); 16}
Execute the Query
1const executionResult = await compiledQuery.query(root, context, variables); 2console.log(executionResult);
Subscribe to the Query
1const result = await compiledQuery.subscribe(root, context, variables); 2for await (const value of result) { 3 console.log(value); 4}
API
compiledQuery = compileQuery(schema, document, operationName, compilerOptions)
Compiles the document
AST, using an optional operationName and compiler options.
-
schema
{GraphQLSchema} -graphql
schema object -
document
{DocumentNode} - document query AST ,can be obtained byparse
fromgraphql
-
operationName
{string} - optional operation name in case the document contains multiple operations(queries/mutations/subscription). -
compilerOptions
{Object} - Configurable options for the compilerdisableLeafSerialization
{boolean, default: false} - disables leaf node serializers. The serializers validate the content of the field at runtime so this option should only be set to true if there are strong assurances that the values are valid.customSerializers
{Object as Map, default: {}} - Replace serializer functions for specific types. Can be used as a safer alternative for overly expensive serializerscustomJSONSerializer
{function, default: undefined} - A function to be called withCompilationContext
to produce also a JSON serializer function. The default stringifier function isJSON.stringify
compiledQuery.query(root: any, context: any, variables: Maybe<{ [key: string]: any }>)
the compiled function that can be called with a root value, a context and the required variables.
compiledQuery.subscribe(root: any, context: any, variables: Maybe<{ [key: string]: any }>)
(available for GraphQL Subscription only) the compiled function that can be called with a root value, a context and the required variables to produce either an AsyncIterator (if successful) or an ExecutionResult (error).
compiledQuery.stringify(value: any)
the compiled function for producing a JSON string. It will be JSON.stringify
unless compilerOptions.customJSONSerializer
is a function.
The value argument should be the return of the compiled GraphQL function.
LICENSE
MIT
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Warn: project license file does not contain an FSF or OSI license.
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/build.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish.yml:1
- Info: no jobLevel write permissions found
Reason
Found 0/30 approved changesets -- score normalized to 0
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/hoangvvo/graphql-jit/build.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/hoangvvo/graphql-jit/build.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/hoangvvo/graphql-jit/build.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/hoangvvo/graphql-jit/publish.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/hoangvvo/graphql-jit/publish.yml/main?enable=pin
- Info: 0 out of 5 GitHub-owned GitHubAction dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'main'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 1 are checked with a SAST tool
Reason
24 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-6c8f-qphg-qjgp
- Warn: Project is vulnerable to: GHSA-82v2-mx6x-wq7q
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-6fw4-hr69-g3rv
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-4g88-fppr-53pp
- Warn: Project is vulnerable to: GHSA-4jqc-8m5r-9rpr
- Warn: Project is vulnerable to: GHSA-3f95-r44v-8mrg
- Warn: Project is vulnerable to: GHSA-28xr-mwxg-3qc8
- Warn: Project is vulnerable to: GHSA-9p95-fxvg-qgq2
- Warn: Project is vulnerable to: GHSA-9w5j-4mwv-2wj8
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-558p-m34m-vpmq
- Warn: Project is vulnerable to: GHSA-cf4h-3jhx-xvhq
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
3.1
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More