Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
nexus-to-pothos-codemod
Advanced tools
This is a codemod to migrate from Nexus to Pothos
This aims to transform all the nexus types, queries and mutations to Pothos equivalents. Please note that the codemod is by no means complete. You still need some manual adjustments. Below is a list of known missing features.
You can check out the __textfixtures__
folder to see full list of supported transformations.
$ yarn global add nexus-to-pothos-codemod
or
$ npm install -g nexus-to-pothos-codemod
$ nexus-to-pothos-codemod ./**/*.ts --ignore-pattern="**/node_modules/**" --parser=ts
The CLI is the same as in jscodeshift except you can omit the transform file.
Alternatively, you can run the codemod using jscodeshift as follows:
$ yarn global add jscodeshift
$ yarn add nexus-to-pothos-codemod
$ jscodeshift -t node_modules/nexus-to-pothos-codemod/transform.ts --ignore-pattern="**/node_modules/**" ./**/*.js --parser=ts
The codemod might not be 100% accurate. You will need to do some manual adjustments. Might be good to compare the generated GraphQL schema with the old one to see if there are any differences.
automatic import updates
it assumes some conventions such as async nodes((_, args, ctx) {}
instead of nodes: async ((_, args, ctx) => {}
which causes exceptions
does not understand computed fields such as:
export const Object = objectType({
name: 'Object',
definition(t) {
objectFields.forEach(objectField => t.string(objectField));
}
});
might fail on complex types
unionType
not transformed
scalarType
not transformed
lists not handled properly always, []
needs to be mostly added manually
args of connnectionField
not transformed preoperly
authScope
in connectionField and some nested fields not transformed properly
Parts that causes exceptions can be commented out and fixed manually. Rest are fairly easy to compare to the old schema.
Be extra careful with the authScope
.
An example builder config:
import SchemaBuilder from '@pothos/core';
import RelayPlugin from '@pothos/plugin-relay';
import ScopeAuthPlugin from '@pothos/plugin-scope-auth';
import { GraphQLJSONObject } from 'graphql-type-json';
export const builder = new SchemaBuilder<{
Context: {};
DefaultEdgesNullability: false;
DefaultNodeNullability: false;
Scalars: {
ID: {
Output: number | string;
Input: string;
};
JSONObject: {
Output: object;
Input: object;
};
};
}>({
plugins: [ScopeAuthPlugin, RelayPlugin],
authScopes: context => ({}),
scopeAuthOptions: {
unauthorizedError: () => new Error(`Not authorized`)
},
relayOptions: {
clientMutationId: 'omit',
cursorType: 'ID',
edgesFieldOptions: {
nullable: false
},
nodeFieldOptions: {
nullable: false
}
}
});
builder.queryType();
builder.mutationType();
builder.addScalarType('JSONObject', GraphQLJSONObject, {});
Contributions are more than welcome! Some useful tools for developing this are https://astexplorer.net/ and your editors builtin debugger.
FAQs
Codemod to migrate from Nexus to Pothos
The npm package nexus-to-pothos-codemod receives a total of 2 weekly downloads. As such, nexus-to-pothos-codemod popularity was classified as not popular.
We found that nexus-to-pothos-codemod demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.