
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@graphile/subscriptions-lds
Advanced tools
Subscriptions plugin for PostGraphile using PostgreSQL logicial decoding
PostGraphile schema plugin to provide live updates powered by PostgreSQL logical decoding. Used as part of PostGraphile's live queries support.
For more background, see postgraphile issue #92.
To help us develop this software sustainably under the MIT license, we ask all individuals and businesses that use it to help support its ongoing maintenance and development via sponsorship.
And please give some love to our featured sponsors 🤩:
![]() Surge * | ![]() Netflix * | ![]() Qwick * | ![]() The Guild * |
![]() Chad Furman * | ![]() Fanatics * | ![]() Dovetail * | ![]() Enzuzo * |
![]() Stellate * |
* Sponsors the entire Graphile suite
Install alongside postgraphile, e.g.:
yarn add @graphile/subscriptions-lds
To use this plugin:
wal_level = logical and the wal2json plugin (see "Setting up PostgreSQL" below)--append-plugins (or appendPlugins)--live (or live: true)--owner-connection (or ownerConnectionString)CLI:
postgraphile \
--live \
--owner-connection postgres://db_owner:db_owner_pass@host/db \
--append-plugins @graphile/subscriptions-lds \
...
Library:
app.use(
postgraphile(DB, SCHEMA, {
// ...
// Enable live support in PostGraphile
live: true,
// We need elevated privileges for logical decoding
ownerConnectionString: "postgres://db_owner:db_owner_pass@host/db",
// Add this plugin
appendPlugins: [
//...
require("@graphile/subscriptions-lds").default,
],
})
);
We currently only support PG10+; if you need support for 9.x please get in touch.
TL;DR: set wal_level = logical in postgresql.conf and ensure wal2json
is installed.
This plugin uses logical decoding and wal2json, so you must configure your
PostgreSQL database to support this.
In your postgresql.conf you need to enable wal_level = logical. You
should ensure that the following settings are set (the 10s can be any
number greater than 1; set them to how many PostGraphile instances you're
expecting to run, plus a little buffer for regular replication needs):
wal_level = logical
max_wal_senders = 10
max_replication_slots = 10
You also need to ensure that wal2json is installed. This comes as standard
in many managed PostgreSQL services, such as Amazon RDS, but to install it locally:
which pg_config returns the path to the correct
pg_config binary - the one related to your PostgreSQL install. (For
example, if on a Mac you've installed both Postgres.app and PostgreSQL from
homebrew then you must modify your PATH variable to point at whichever one
you use, e.g. export PATH="/Applications/Postgres.app/Contents/Versions/10/bin/:$PATH")git clone https://github.com/eulerto/wal2json.git
cd wal2json
USE_PGXS=1 make
USE_PGXS=1 make install
Please note that the defaults shown below are likely to change over time based on user feedback. This document will not necessarily be updated with the new defaults.
LD_WAIT (default 125)This environmental variable controls how often in milliseconds we check for changes from the database. Setting it smaller leads to more timely updates but increases overhead. Setting it larger increases efficiency but means each batch takes longer to process which may slow the Node.js event loop.
LIVE_THROTTLE (default 500)This environmental variable is the minimum duration in milliseconds between live updates to the same subscription.
If your server is getting overwhelmed, you may increase this to increase the period between live updates sent to clients.
If your application is not responsive enough, you may decrease this to get closer to real-time updates.
(Throttle fires on both the leading and trailing edge, so decreasing this only affects successive updates, not the initial update.)
LD_TABLE_PATTERN (default "*.*")Set this envvar to e.g. app_public.* to only monitor tables in the
app_public schema. See filter-tables in the wal2json
documentation
If you reach sufficient scale that running @graphile/lds on its own server
makes sense (rather than using the embedded version) then you can do so
easily. Follow the steps in the @graphile/lds README to get the server up
and running, and then set environmental variable LDS_SERVER_URL to the full
websocket URL to your LDS server, e.g. ws://127.0.0.1:9876 (default) before
loading this plugin.
You can determine if your PostgreSQL instance is configured correctly with this:
DO $$
BEGIN
if current_setting('wal_level') is distinct from 'logical' then
raise exception 'wal_level must be set to ''logical'', your database has it set to ''%''. Please edit your `%` file and restart PostgreSQL.', current_setting('wal_level'), current_setting('config_file');
end if;
if (current_setting('max_replication_slots')::int >= 1) is not true then
raise exception 'Your max_replication_slots setting is too low, it must be greater than 1. Please edit your `%` file and restart PostgreSQL.', current_setting('config_file');
end if;
if (current_setting('max_wal_senders')::int >= 1) is not true then
raise exception 'Your max_wal_senders setting is too low, it must be greater than 1. Please edit your `%` file and restart PostgreSQL.', current_setting('config_file');
end if;
perform pg_create_logical_replication_slot('compatibility_test', 'wal2json');
perform pg_drop_replication_slot('compatibility_test');
raise notice 'Everything seems to be in order.';
end;
$$ LANGUAGE plpgsql;
If you see the following message then all should be good:
NOTICE: 00000: Everything seems to be in order.
FAQs
Subscriptions plugin for PostGraphile using PostgreSQL logicial decoding
The npm package @graphile/subscriptions-lds receives a total of 958 weekly downloads. As such, @graphile/subscriptions-lds popularity was classified as not popular.
We found that @graphile/subscriptions-lds demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.