Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
< 1 kB
GraphQL query minifier (3.4 kB
(gzip) if you include its only dependency, Moo).
This library removes all insignificant whitespace within a GraphQL query, as well as comments.
npm install gqlmin
import gqlmin from 'gqlmin';
const query = `
query allProducts {
products {
name
price
image {
medium
large
}
}
}
`;
const minified = gqlmin(query);
console.log(minified);
// query allProducts{products{name price …
npx gqlmin ./query.graphql -o ./query.min.graphql
If you don’t know if you need this, you probably don’t. In many apps, the whitespace within graphql queries isn’t significant. However, there are 2 scenarios where this can have big benefits:
GET
requests and need better caching. An underused feature of many GraphQL
servers is the ability to send GET
rather than POST
requests for queries (mutations don’t
support this). Minifying your GraphQL queries here can have some big benefits in reducing
unnecessary URL length, as well as deduplicating caches where queries differ by whitespace only.This library is useful because it can run at runtime (ES Modules) or as a build step (CLI).
Because the goals of this library are small file size and performance, it’s important to note this doesn’t validate GraphQL queries. This library assumes you have already done that.
This means that if you minify a malformed GraphQL query, it won’t err; it will just silently output the wrong thing. It’s assumed if you have a bad GraphQL query, your problems are probably bigger than minification. Either way, validation won’t be a part of this project because it would add weight.
FAQs
< 1 kB GraphQL query minifier
The npm package gqlmin receives a total of 5,274 weekly downloads. As such, gqlmin popularity was classified as popular.
We found that gqlmin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.