
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
postgraphile-plugin-many-create-update-delete
Advanced tools
Postgraphile plugin that enables many create, update, & delete mutations in a single transaction.
This plugin implements mutations that allow many creates, updates, and deletes in a single transaction.
To support, Please 🌟 if you used / like this library.
Here's the plan:
View the postgraphile docs for information about loading the plugin via the CLI or as a NodeJS library.
This plugin respects the default option to disable mutations all together via graphileBuildOptions
.
postgraphile(pgConfig, schema, {
graphileBuildOptions: {
pgDisableDefaultMutations: true
}
});
You must use smart comments to enable the many create, update, and delete mutations for a table, since they are not enabled by default to prevent crowding with the other autogenerated postgraphile default mutations. The single tag @mncud
is all that's needed.
comment on table public."Test" is
E'@mncud\n The test table is just for showing this example with comments.';
The plugin creates new mutations that allow you to batch create, update, and delete items from a given table. It works with primary keys for updates and deletes using the input patch that postgraphile generates. All creates, updates, and deletes have scoped names with "mn" in front of the mutation name to prevent conflicts with other mutations.
mnCreateTest
would be an example mutation name, and we'll say it has attributes of test1 (a boolean), and name (a varchar). You'll see the required input has the clientMutationId and also a field called mnTest
, where mnTest
will take an array of items that use the table input type. Since it uses the table input type, the required items are all listed as expected. When creating records, any attributes left off will have their values set to default
.
mnUpdateTestByName
would be the update example name, assuming the name is the primary key. Updates have a required input with the clientMutatationId and a patch. The patch field accepts an array of table patch items. You MUST provide the primary key within the patch items b/c that is what's used in the where clause to update the correct row(s). Attributes that are not provided in the list of provided values, will not be updated. With that said, you can update different attributes in one record and leave them off in another and it will update both as expected.
mnDeleteTestByName
would be the delete example name. Deletes have a required input with the clientMutationId and a patch. The patch field accepts an array of table patch items, but only the primary key items are used. You MUST provide the primary key(s) within the patch items b/c that is what's used in the where clause to delete the correct row(s).
git checkout -b my-new-feature
git commit -am "Add some feature"
git push origin my-new-feature
MIT
FAQs
Postgraphile plugin that enables many create, update, & delete mutations in a single transaction.
The npm package postgraphile-plugin-many-create-update-delete receives a total of 1,099 weekly downloads. As such, postgraphile-plugin-many-create-update-delete popularity was classified as popular.
We found that postgraphile-plugin-many-create-update-delete demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.