@stepzen/graphiql-proxy - npm Package Compare versions

Comparing version 0.45.0-experimental.a6f5273 to 0.45.0-experimental.aa7017c

package.json

 {
   "name": "@stepzen/graphiql-proxy",
-  "version": "0.45.0-experimental.a6f5273",
+  "version": "0.45.0-experimental.aa7017c",
   "author": "Darren Waddell <[e-mail]>",
@@ -12,6 +12,6 @@ "license": "MIT",
   "engines": {
-    "node": ">=14.0.1",
-    "npm": ">=6.14"
+    "node": ">=18.0"
   },
-  "main": "src/server",
+  "type": "module",
+  "main": "src/server/index.js",
   "scripts": {
@@ -23,12 +23,13 @@ "dev:server": "nodemon src/dev --watch src/dev --watch src/server",
     "start": "concurrently \"npm run dev:server\" \"npm run dev:ui\"",
-    "test": "nyc --extension .ts mocha --forbid-only \"test/**/*.test.ts\"",
+    "test": "cross-env TS_NODE_PROJECT='test/tsconfig.json' nyc --extension .ts mocha --forbid-only \"test/**/*.test.ts\"",
     "posttest": "prettier . --check"
   },
   "dependencies": {
-    "@stepzen/fetch": "0.45.0-experimental.a6f5273",
+    "@stepzen/fetch": "0.45.0-experimental.aa7017c",
     "chalk": "^4.1.2",
-    "cross-spawn": "^7.0.3",
+    "cross-spawn": "^7.0.6",
     "debug": "^4.3.4",
-    "express": "^4.21.1",
+    "express": "^4.21.2",
     "express-promise-router": "^4.1.1",
+    "helmet": "^8.0.0",
     "open": "^8.4.0",
@@ -44,11 +45,11 @@ "prettier": "^2.8.3"
     "@types/license-checker": "^25.0.1",
-    "@types/mocha": "^10.0.1",
-    "@types/node": "^14.18.36",
+    "@types/mocha": "^10.0.9",
     "@types/sinon-chai": "3.2.8",
     "chai": "^4.3.10",
     "concurrently": "^6.0.2",
+    "cross-env": "^7.0.3",
     "dotenv": "^16.0.3",
     "fancy-test": "^1.4.10",
     "license-checker": "^25.0.1",
-    "mocha": "^10.2.0",
+    "mocha": "^10.8.2",
     "nock": "^13.0.4",
@@ -59,5 +60,10 @@ "nodemon": "^2.0.22",
     "sinon-chai": "3.7.0",
-    "ts-node": "^10.8.2"
+    "ts-node": "^10.9.2",
+    "typescript": ">=5 <5.4"
   },
-  "gitHead": "a6f527388119c84983ac5c1e93150f4403054b01"
+  "overrides": {
+    "--comment--": "workaround for CVE-2024-21538",
+    "cross-spawn": "^7.0.6"
+  },
+  "gitHead": "aa7017cebf412a7829e12158699ea14970b7b2d1"
 }

src/server/api/debugging.js

@@ -1,2 +0,2 @@
-// Copyright IBM Corp. 2020, 2024
+// Copyright IBM Corp. 2020, 2025
 
@@ -19,2 +19,2 @@ const debugging = async (req, res) => {
 
-module.exports = debugging
+export default debugging

src/server/api/details.js

@@ -1,2 +0,2 @@
-// Copyright IBM Corp. 2020, 2024
+// Copyright IBM Corp. 2020, 2025
 
@@ -15,2 +15,2 @@ const details = async (req, res) => {
 
-module.exports = details
+export default details

src/server/api/ping.js

@@ -1,2 +0,2 @@
-// Copyright IBM Corp. 2020, 2024
+// Copyright IBM Corp. 2020, 2025
 
@@ -9,2 +9,2 @@ const ping = async (req, res) => {
 
-module.exports = ping
+export default ping

src/server/api/predicates.js

@@ -1,2 +0,2 @@
-// Copyright IBM Corp. 2020, 2024
+// Copyright IBM Corp. 2020, 2025
 
@@ -23,2 +23,2 @@ const predicates = async (req, res) => {
 
-module.exports = predicates
+export default predicates

src/server/api/proxy.js

@@ -1,7 +0,8 @@
-// Copyright IBM Corp. 2020, 2024
+// Copyright IBM Corp. 2020, 2025
 
-const debug = require('debug')
-const fetch = require('@stepzen/fetch').default
+import debug from 'debug'
+import fetch from '@stepzen/fetch'
+import {createRequire} from 'node:module'
 
-const {version} = require('../../../package.json')
+const {version} = createRequire(import.meta.url)('../../../package.json')
 
@@ -46,2 +47,2 @@ const proxy = async (req, res) => {
 
-module.exports = proxy
+export default proxy

src/server/api/samples.js

@@ -1,5 +0,5 @@
-// Copyright IBM Corp. 2020, 2024
+// Copyright IBM Corp. 2020, 2025
 
-const fs = require('fs')
-const prettier = require('prettier')
+import fs from 'node:fs'
+import prettier from 'prettier'
 
@@ -26,2 +26,2 @@ const samples = async (req, res) => {
 
-module.exports = samples
+export default samples

src/server/index.js

@@ -1,18 +0,23 @@
-// Copyright IBM Corp. 2020, 2024
+// Copyright IBM Corp. 2020, 2025
 
-const debug = require('debug')
-const express = require('express')
-const fs = require('fs')
-const router = require('express-promise-router')()
+import debug from 'debug'
+import express from 'express'
+import fs from 'node:fs'
+import PromiseRouter from 'express-promise-router'
+import path from 'node:path'
+import {fileURLToPath} from 'node:url'
 
-const openBrowser = require('./utils/open-browser')
+import openBrowser from './utils/open-browser.js'
 
-const _debugging = require('./api/debugging')
-const details = require('./api/details')
-const ping = require('./api/ping')
-const _predicates = require('./api/predicates')
-const proxy = require('./api/proxy')
-const samples = require('./api/samples')
+import _debugging from './api/debugging.js'
+import details from './api/details.js'
+import ping from './api/ping.js'
+import _predicates from './api/predicates.js'
+import proxy from './api/proxy.js'
+import samples from './api/samples.js'
+import helmet from 'helmet'
 
-module.exports = async options => {
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+
+export default async function (options) {
   const {
@@ -55,2 +60,4 @@ /** @deprecated use zenservUrl */
 
+  app.use(helmet.frameguard())
+
   app.use(express.static(`${__dirname}/../ui/build`))
@@ -71,2 +78,4 @@ app.use((req, res, next) => {
 
+  const router = PromiseRouter()
+
   router.all('/api/predicates', _predicates)
@@ -73,0 +82,0 @@ router.all('/api/debugging', _debugging)

src/server/utils/open-browser.js

@@ -1,8 +0,8 @@
-// Copyright IBM Corp. 2020, 2024
+// Copyright IBM Corp. 2020, 2025
 // Original code from https://github.com/facebook/create-react-app/blob/0f6fc2bc71d78f0dcae67f3f08ce98a42fc0a57c/packages/react-dev-utils/openChrome.applescript
 
-const chalk = require('chalk')
-const {execSync} = require('child_process')
-const open = require('open')
-const spawn = require('cross-spawn')
+import chalk from 'chalk'
+import {execSync} from 'node:child_process'
+import open from 'open'
+import spawn from 'cross-spawn'
 
@@ -144,2 +144,2 @@ // https://github.com/sindresorhus/open#app
 
-module.exports = openBrowser
+export default openBrowser

Fixed alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

4856234

increased by0.01%

Lines of code

4389

increased by0.16%

Number of low supply chain risk alerts

4

decreased by-33.33%

Number of medium supply chain risk alerts

8

decreased by-11.11%

Is type module

Yes

Worsened metrics

Dependency count

9

increased by12.5%

Dev dependency count

22

increased by4.76%

Dependency changes

• + Addedhelmet@^8.0.0

• + Added@stepzen/[e-mail]7017c(transitive)

• + Addedhelmet@8.0.0(transitive)

• - Removed@stepzen/fetch@0.45.0-experimental.a6f5273(transitive)

• Updated@stepzen/[e-mail]7017c

• Updatedcross-spawn@^7.0.6

• Updatedexpress@^4.21.2