Gathering detailed insights and metrics for mercurius
Gathering detailed insights and metrics for mercurius
Installations
npm install mercuriusDeveloper
Developer Guide
BETA
Module System
CommonJS
Min. Node Version
^20.9.0 || >=22.0.0
Typescript Support
Yes
Node Version
20.18.0
NPM Version
10.8.2
Statistics
2,358 Stars
814 Commits
237 Forks
32 Watching
12 Branches
157 Contributors
Updated on 24 Nov 2024
Languages
JavaScript (94.64%)
TypeScript (3.42%)
HTML (1.79%)
Shell (0.16%)
Total Downloads
Cumulative downloads
Total Downloads
10,330,039
Last day
-3.9%
14,310
Compared to previous day
Last week
14.4%
83,712
Compared to previous week
Last month
4%
334,378
Compared to previous month
Last year
346.3%
7,439,235
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
15
Peer Dependencies
1
Versions
mercurius
Mercurius is a GraphQL adapter for Fastify
Features:
- Caching of query parsing and validation.
- Automatic loader integration to avoid 1 + N queries.
- Just-In-Time compiler via graphql-jit.
- Subscriptions.
- Federation support via @mercuriusjs/federation, including Subscriptions.
- Gateway implementation via @mercuriusjs/gateway, including Subscriptions.
- Batched query support.
- Customisable persisted queries.
Docs
- Install
- Quick Start
- Examples
- API
- Context
- Loaders
- Hooks
- Lifecycle
- Federation
- Subscriptions
- Batched Queries
- Persisted Queries
- TypeScript Usage
- HTTP
- GraphQL over WebSocket
- Integrations
- Related Plugins
- Faq
- Acknowledgements
- License
Install
1npm i fastify mercurius graphql 2# or 3yarn add fastify mercurius graphql
The previous name of this module was fastify-gql (< 6.0.0).
Quick Start
1'use strict' 2 3const Fastify = require('fastify') 4const mercurius = require('mercurius') 5 6const app = Fastify() 7 8const schema = ` 9 type Query { 10 add(x: Int, y: Int): Int 11 } 12` 13 14const resolvers = { 15 Query: { 16 add: async (_, { x, y }) => x + y 17 } 18} 19 20app.register(mercurius, { 21 schema, 22 resolvers 23}) 24 25app.get('/', async function (req, reply) { 26 const query = '{ add(x: 2, y: 2) }' 27 return reply.graphql(query) 28}) 29 30app.listen({ port: 3000 })
Examples
Check GitHub repo for more examples.
Acknowledgements
The project is kindly sponsored by:
The Mercurius name was gracefully donated by Marco Castelluccio. The usage of that library was described in https://hacks.mozilla.org/2015/12/web-push-notifications-from-irssi/, and you can find that codebase in https://github.com/marco-c/mercurius.
License
MIT
Stable Version
The latest stable version of the package.
Stable Version
15.1.0
HIGH
1
HIGH
7.5/10
Summary
Uncaught Exception in mercurius
Affected Versions
>= 8.10.0, < 8.11.2
Patched Versions
8.11.2
MODERATE
2
MODERATE
5.3/10
Summary
mercurius has Uncaught Exception when using subscriptions
Affected Versions
< 8.13.2
Patched Versions
8.13.2
MODERATE
5.3/10
Summary
mercurius has Uncaught Exception when using subscriptions
Affected Versions
>= 9.0.0, < 11.5.0
Patched Versions
11.5.0
Reason
9 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
Found 18/26 approved changesets -- score normalized to 6
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/ci.yml:26
- Warn: no topLevel permission defined: .github/workflows/backport.yml:1
- Warn: no topLevel permission defined: .github/workflows/ci.yml:1
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/backport.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/mercurius-js/mercurius/backport.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/mercurius-js/mercurius/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/mercurius-js/mercurius/ci.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/mercurius-js/mercurius/ci.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:19
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
- Warn: branch protection not enabled for branch 'v8.x'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 22 are checked with a SAST tool
Score
5.6
/10
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More