@depup/express-graphql 0.12.0-depup.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) GraphQL Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,34 @@
+# @depup/express-graphql
+
+> Dependency-bumped version of [express-graphql](https://www.npmjs.com/package/express-graphql)
+
+Generated by [DepUp](https://github.com/depup/npm) -- all production
+dependencies bumped to latest versions.
+
+## Installation
+
+```bash
+npm install @depup/express-graphql
+```
+
+| Field | Value |
+|-------|-------|
+| Original | [express-graphql](https://www.npmjs.com/package/express-graphql) @ 0.12.0 |
+| Processed | 2026-03-19 |
+| Smoke test | passed |
+| Deps updated | 4 |
+
+## Dependency Changes
+
+| Dependency | From | To |
+|------------|------|-----|
+| accepts | ^1.3.7 | ^1.3.8 |
+| content-type | ^1.0.4 | ^1.0.5 |
+| http-errors | 1.8.0 | ^2.0.1 |
+| raw-body | ^2.4.1 | ^3.0.2 |
+
+---
+
+Source: https://github.com/depup/npm | Original: https://www.npmjs.com/package/express-graphql
+
+License inherited from the original package.

package/changes.json

@@ -0,0 +1,22 @@
+{
+  "bumped": {
+    "accepts": {
+      "from": "^1.3.7",
+      "to": "^1.3.8"
+    },
+    "content-type": {
+      "from": "^1.0.4",
+      "to": "^1.0.5"
+    },
+    "http-errors": {
+      "from": "1.8.0",
+      "to": "^2.0.1"
+    },
+    "raw-body": {
+      "from": "^2.4.1",
+      "to": "^3.0.2"
+    }
+  },
+  "timestamp": "2026-03-19T03:01:44.867Z",
+  "totalUpdated": 4
+}

package/index.d.ts

@@ -0,0 +1,146 @@
+/// <reference types="node" />
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { ASTVisitor, DocumentNode, ValidationRule, ValidationContext, ExecutionArgs, ExecutionResult, FormattedExecutionResult, GraphQLSchema, GraphQLFieldResolver, GraphQLTypeResolver, GraphQLFormattedError } from 'graphql';
+import { Source, GraphQLError } from 'graphql';
+import type { GraphiQLOptions } from './renderGraphiQL';
+declare type Request = IncomingMessage & {
+    url: string;
+};
+declare type Response = ServerResponse & {
+    json?: (data: unknown) => void;
+};
+declare type MaybePromise<T> = Promise<T> | T;
+/**
+ * Used to configure the graphqlHTTP middleware by providing a schema
+ * and other configuration options.
+ *
+ * Options can be provided as an Object, a Promise for an Object, or a Function
+ * that returns an Object or a Promise for an Object.
+ */
+export declare type Options = ((request: Request, response: Response, params?: GraphQLParams) => MaybePromise<OptionsData>) | MaybePromise<OptionsData>;
+export interface OptionsData {
+    /**
+     * A GraphQL schema from graphql-js.
+     */
+    schema: GraphQLSchema;
+    /**
+     * A value to pass as the context to this middleware.
+     */
+    context?: unknown;
+    /**
+     * An object to pass as the rootValue to the graphql() function.
+     */
+    rootValue?: unknown;
+    /**
+     * A boolean to configure whether the output should be pretty-printed.
+     */
+    pretty?: boolean;
+    /**
+     * An optional array of validation rules that will be applied on the document
+     * in additional to those defined by the GraphQL spec.
+     */
+    validationRules?: ReadonlyArray<(ctx: ValidationContext) => ASTVisitor>;
+    /**
+     * An optional function which will be used to validate instead of default `validate`
+     * from `graphql-js`.
+     */
+    customValidateFn?: (schema: GraphQLSchema, documentAST: DocumentNode, rules: ReadonlyArray<ValidationRule>) => ReadonlyArray<GraphQLError>;
+    /**
+     * An optional function which will be used to execute instead of default `execute`
+     * from `graphql-js`.
+     */
+    customExecuteFn?: (args: ExecutionArgs) => MaybePromise<ExecutionResult>;
+    /**
+     * An optional function which will be used to format any errors produced by
+     * fulfilling a GraphQL operation. If no function is provided, GraphQL's
+     * default spec-compliant `formatError` function will be used.
+     */
+    customFormatErrorFn?: (error: GraphQLError) => GraphQLFormattedError;
+    /**
+     * An optional function which will be used to create a document instead of
+     * the default `parse` from `graphql-js`.
+     */
+    customParseFn?: (source: Source) => DocumentNode;
+    /**
+     * `formatError` is deprecated and replaced by `customFormatErrorFn`. It will
+     *  be removed in version 1.0.0.
+     */
+    formatError?: (error: GraphQLError) => GraphQLFormattedError;
+    /**
+     * An optional function for adding additional metadata to the GraphQL response
+     * as a key-value object. The result will be added to "extensions" field in
+     * the resulting JSON. This is often a useful place to add development time
+     * info such as the runtime of a query or the amount of resources consumed.
+     *
+     * Information about the request is provided to be used.
+     *
+     * This function may be async.
+     */
+    extensions?: (info: RequestInfo) => MaybePromise<undefined | {
+        [key: string]: unknown;
+    }>;
+    /**
+     * A boolean to optionally enable GraphiQL mode.
+     * Alternatively, instead of `true` you can pass in an options object.
+     */
+    graphiql?: boolean | GraphiQLOptions;
+    /**
+     * A resolver function to use when one is not provided by the schema.
+     * If not provided, the default field resolver is used (which looks for a
+     * value or method on the source value with the field's name).
+     */
+    fieldResolver?: GraphQLFieldResolver<unknown, unknown>;
+    /**
+     * A type resolver function to use when none is provided by the schema.
+     * If not provided, the default type resolver is used (which looks for a
+     * `__typename` field or alternatively calls the `isTypeOf` method).
+     */
+    typeResolver?: GraphQLTypeResolver<unknown, unknown>;
+}
+/**
+ * All information about a GraphQL request.
+ */
+export interface RequestInfo {
+    /**
+     * The parsed GraphQL document.
+     */
+    document: DocumentNode;
+    /**
+     * The variable values used at runtime.
+     */
+    variables: {
+        readonly [name: string]: unknown;
+    } | null;
+    /**
+     * The (optional) operation name requested.
+     */
+    operationName: string | null;
+    /**
+     * The result of executing the operation.
+     */
+    result: FormattedExecutionResult;
+    /**
+     * A value to pass as the context to the graphql() function.
+     */
+    context?: unknown;
+}
+declare type Middleware = (request: Request, response: Response) => Promise<void>;
+/**
+ * Middleware for express; takes an options object or function as input to
+ * configure behavior, and returns an express middleware.
+ */
+export declare function graphqlHTTP(options: Options): Middleware;
+export interface GraphQLParams {
+    query: string | null;
+    variables: {
+        readonly [name: string]: unknown;
+    } | null;
+    operationName: string | null;
+    raw: boolean;
+}
+/**
+ * Provided a "Request" provided by express or connect (typically a node style
+ * HTTPClientRequest), Promise the GraphQL request parameters.
+ */
+export declare function getGraphQLParams(request: Request): Promise<GraphQLParams>;
+export {};

package/index.js

@@ -0,0 +1,285 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getGraphQLParams = exports.graphqlHTTP = void 0;
+const accepts_1 = __importDefault(require("accepts"));
+const http_errors_1 = __importDefault(require("http-errors"));
+const graphql_1 = require("graphql");
+const parseBody_1 = require("./parseBody");
+const renderGraphiQL_1 = require("./renderGraphiQL");
+/**
+ * Middleware for express; takes an options object or function as input to
+ * configure behavior, and returns an express middleware.
+ */
+function graphqlHTTP(options) {
+    devAssert(options != null, 'GraphQL middleware requires options.');
+    return async function graphqlMiddleware(request, response) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+        // Higher scoped variables are referred to at various stages in the asynchronous state machine below.
+        let params;
+        let showGraphiQL = false;
+        let graphiqlOptions;
+        let formatErrorFn = graphql_1.formatError;
+        let pretty = false;
+        let result;
+        try {
+            // Parse the Request to get GraphQL request parameters.
+            try {
+                params = await getGraphQLParams(request);
+            }
+            catch (error) {
+                // When we failed to parse the GraphQL parameters, we still need to get
+                // the options object, so make an options call to resolve just that.
+                const optionsData = await resolveOptions();
+                pretty = (_a = optionsData.pretty) !== null && _a !== void 0 ? _a : false;
+                formatErrorFn = (_c = (_b = optionsData.customFormatErrorFn) !== null && _b !== void 0 ? _b : optionsData.formatError) !== null && _c !== void 0 ? _c : formatErrorFn;
+                throw error;
+            }
+            // Then, resolve the Options to get OptionsData.
+            const optionsData = await resolveOptions(params);
+            // Collect information from the options data object.
+            const schema = optionsData.schema;
+            const rootValue = optionsData.rootValue;
+            const validationRules = (_d = optionsData.validationRules) !== null && _d !== void 0 ? _d : [];
+            const fieldResolver = optionsData.fieldResolver;
+            const typeResolver = optionsData.typeResolver;
+            const graphiql = (_e = optionsData.graphiql) !== null && _e !== void 0 ? _e : false;
+            const extensionsFn = optionsData.extensions;
+            const context = (_f = optionsData.context) !== null && _f !== void 0 ? _f : request;
+            const parseFn = (_g = optionsData.customParseFn) !== null && _g !== void 0 ? _g : graphql_1.parse;
+            const executeFn = (_h = optionsData.customExecuteFn) !== null && _h !== void 0 ? _h : graphql_1.execute;
+            const validateFn = (_j = optionsData.customValidateFn) !== null && _j !== void 0 ? _j : graphql_1.validate;
+            pretty = (_k = optionsData.pretty) !== null && _k !== void 0 ? _k : false;
+            formatErrorFn = (_m = (_l = optionsData.customFormatErrorFn) !== null && _l !== void 0 ? _l : optionsData.formatError) !== null && _m !== void 0 ? _m : formatErrorFn;
+            // Assert that schema is required.
+            devAssert(schema != null, 'GraphQL middleware options must contain a schema.');
+            // GraphQL HTTP only supports GET and POST methods.
+            if (request.method !== 'GET' && request.method !== 'POST') {
+                throw http_errors_1.default(405, 'GraphQL only supports GET and POST requests.', {
+                    headers: { Allow: 'GET, POST' },
+                });
+            }
+            // Get GraphQL params from the request and POST body data.
+            const { query, variables, operationName } = params;
+            showGraphiQL = canDisplayGraphiQL(request, params) && graphiql !== false;
+            if (typeof graphiql !== 'boolean') {
+                graphiqlOptions = graphiql;
+            }
+            // If there is no query, but GraphiQL will be displayed, do not produce
+            // a result, otherwise return a 400: Bad Request.
+            if (query == null) {
+                if (showGraphiQL) {
+                    return respondWithGraphiQL(response, graphiqlOptions);
+                }
+                throw http_errors_1.default(400, 'Must provide query string.');
+            }
+            // Validate Schema
+            const schemaValidationErrors = graphql_1.validateSchema(schema);
+            if (schemaValidationErrors.length > 0) {
+                // Return 500: Internal Server Error if invalid schema.
+                throw http_errors_1.default(500, 'GraphQL schema validation error.', {
+                    graphqlErrors: schemaValidationErrors,
+                });
+            }
+            // Parse source to AST, reporting any syntax error.
+            let documentAST;
+            try {
+                documentAST = parseFn(new graphql_1.Source(query, 'GraphQL request'));
+            }
+            catch (syntaxError) {
+                // Return 400: Bad Request if any syntax errors errors exist.
+                throw http_errors_1.default(400, 'GraphQL syntax error.', {
+                    graphqlErrors: [syntaxError],
+                });
+            }
+            // Validate AST, reporting any errors.
+            const validationErrors = validateFn(schema, documentAST, [
+                ...graphql_1.specifiedRules,
+                ...validationRules,
+            ]);
+            if (validationErrors.length > 0) {
+                // Return 400: Bad Request if any validation errors exist.
+                throw http_errors_1.default(400, 'GraphQL validation error.', {
+                    graphqlErrors: validationErrors,
+                });
+            }
+            // Only query operations are allowed on GET requests.
+            if (request.method === 'GET') {
+                // Determine if this GET request will perform a non-query.
+                const operationAST = graphql_1.getOperationAST(documentAST, operationName);
+                if (operationAST && operationAST.operation !== 'query') {
+                    // If GraphiQL can be shown, do not perform this query, but
+                    // provide it to GraphiQL so that the requester may perform it
+                    // themselves if desired.
+                    if (showGraphiQL) {
+                        return respondWithGraphiQL(response, graphiqlOptions, params);
+                    }
+                    // Otherwise, report a 405: Method Not Allowed error.
+                    throw http_errors_1.default(405, `Can only perform a ${operationAST.operation} operation from a POST request.`, { headers: { Allow: 'POST' } });
+                }
+            }
+            // Perform the execution, reporting any errors creating the context.
+            try {
+                result = await executeFn({
+                    schema,
+                    document: documentAST,
+                    rootValue,
+                    contextValue: context,
+                    variableValues: variables,
+                    operationName,
+                    fieldResolver,
+                    typeResolver,
+                });
+            }
+            catch (contextError) {
+                // Return 400: Bad Request if any execution context errors exist.
+                throw http_errors_1.default(400, 'GraphQL execution context error.', {
+                    graphqlErrors: [contextError],
+                });
+            }
+            // Collect and apply any metadata extensions if a function was provided.
+            // https://graphql.github.io/graphql-spec/#sec-Response-Format
+            if (extensionsFn) {
+                const extensions = await extensionsFn({
+                    document: documentAST,
+                    variables,
+                    operationName,
+                    result,
+                    context,
+                });
+                if (extensions != null) {
+                    result = { ...result, extensions };
+                }
+            }
+        }
+        catch (rawError) {
+            // If an error was caught, report the httpError status, or 500.
+            const error = http_errors_1.default(500, 
+            /* istanbul ignore next: Thrown by underlying library. */
+            rawError instanceof Error ? rawError : String(rawError));
+            response.statusCode = error.status;
+            const { headers } = error;
+            if (headers != null) {
+                for (const [key, value] of Object.entries(headers)) {
+                    response.setHeader(key, String(value));
+                }
+            }
+            if (error.graphqlErrors == null) {
+                const graphqlError = new graphql_1.GraphQLError(error.message, undefined, undefined, undefined, undefined, error);
+                result = { data: undefined, errors: [graphqlError] };
+            }
+            else {
+                result = { data: undefined, errors: error.graphqlErrors };
+            }
+        }
+        // If no data was included in the result, that indicates a runtime query
+        // error, indicate as such with a generic status code.
+        // Note: Information about the error itself will still be contained in
+        // the resulting JSON payload.
+        // https://graphql.github.io/graphql-spec/#sec-Data
+        if (response.statusCode === 200 && result.data == null) {
+            response.statusCode = 500;
+        }
+        // Format any encountered errors.
+        const formattedResult = {
+            ...result,
+            errors: (_o = result.errors) === null || _o === void 0 ? void 0 : _o.map(formatErrorFn),
+        };
+        // If allowed to show GraphiQL, present it instead of JSON.
+        if (showGraphiQL) {
+            return respondWithGraphiQL(response, graphiqlOptions, params, formattedResult);
+        }
+        // If "pretty" JSON isn't requested, and the server provides a
+        // response.json method (express), use that directly.
+        // Otherwise use the simplified sendResponse method.
+        if (!pretty && typeof response.json === 'function') {
+            response.json(formattedResult);
+        }
+        else {
+            const payload = JSON.stringify(formattedResult, null, pretty ? 2 : 0);
+            sendResponse(response, 'application/json', payload);
+        }
+        async function resolveOptions(requestParams) {
+            const optionsResult = await Promise.resolve(typeof options === 'function'
+                ? options(request, response, requestParams)
+                : options);
+            devAssert(optionsResult != null && typeof optionsResult === 'object', 'GraphQL middleware option function must return an options object or a promise which will be resolved to an options object.');
+            if (optionsResult.formatError) {
+                // eslint-disable-next-line no-console
+                console.warn('`formatError` is deprecated and replaced by `customFormatErrorFn`. It will be removed in version 1.0.0.');
+            }
+            return optionsResult;
+        }
+    };
+}
+exports.graphqlHTTP = graphqlHTTP;
+function respondWithGraphiQL(response, options, params, result) {
+    const data = {
+        query: params === null || params === void 0 ? void 0 : params.query,
+        variables: params === null || params === void 0 ? void 0 : params.variables,
+        operationName: params === null || params === void 0 ? void 0 : params.operationName,
+        result,
+    };
+    const payload = renderGraphiQL_1.renderGraphiQL(data, options);
+    return sendResponse(response, 'text/html', payload);
+}
+/**
+ * Provided a "Request" provided by express or connect (typically a node style
+ * HTTPClientRequest), Promise the GraphQL request parameters.
+ */
+async function getGraphQLParams(request) {
+    var _a, _b, _c;
+    const urlData = new URLSearchParams(request.url.split('?')[1]);
+    const bodyData = await parseBody_1.parseBody(request);
+    // GraphQL Query string.
+    let query = (_a = urlData.get('query')) !== null && _a !== void 0 ? _a : bodyData.query;
+    if (typeof query !== 'string') {
+        query = null;
+    }
+    // Parse the variables if needed.
+    let variables = ((_b = urlData.get('variables')) !== null && _b !== void 0 ? _b : bodyData.variables);
+    if (typeof variables === 'string') {
+        try {
+            variables = JSON.parse(variables);
+        }
+        catch (_d) {
+            throw http_errors_1.default(400, 'Variables are invalid JSON.');
+        }
+    }
+    else if (typeof variables !== 'object') {
+        variables = null;
+    }
+    // Name of GraphQL operation to execute.
+    let operationName = (_c = urlData.get('operationName')) !== null && _c !== void 0 ? _c : bodyData.operationName;
+    if (typeof operationName !== 'string') {
+        operationName = null;
+    }
+    const raw = urlData.get('raw') != null || bodyData.raw !== undefined;
+    return { query, variables, operationName, raw };
+}
+exports.getGraphQLParams = getGraphQLParams;
+/**
+ * Helper function to determine if GraphiQL can be displayed.
+ */
+function canDisplayGraphiQL(request, params) {
+    // If `raw` false, GraphiQL mode is not enabled.
+    // Allowed to show GraphiQL if not requested as raw and this request prefers HTML over JSON.
+    return !params.raw && accepts_1.default(request).types(['json', 'html']) === 'html';
+}
+/**
+ * Helper function for sending a response using only the core Node server APIs.
+ */
+function sendResponse(response, type, data) {
+    const chunk = Buffer.from(data, 'utf8');
+    response.setHeader('Content-Type', type + '; charset=utf-8');
+    response.setHeader('Content-Length', String(chunk.length));
+    response.end(chunk);
+}
+function devAssert(condition, message) {
+    const booleanCondition = Boolean(condition);
+    if (!booleanCondition) {
+        throw new Error(message);
+    }
+}

package/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "@depup/express-graphql",
+  "version": "0.12.0-depup.0",
+  "description": "Production ready GraphQL HTTP middleware. (with updated dependencies)",
+  "license": "MIT",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "typesVersions": {
+    "<3.8": {
+      "*": [
+        "ts3.4/*"
+      ]
+    }
+  },
+  "sideEffects": false,
+  "homepage": "https://github.com/graphql/express-graphql",
+  "bugs": {
+    "url": "https://github.com/graphql/express-graphql/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/graphql/express-graphql.git"
+  },
+  "keywords": [
+    "express-graphql",
+    "depup",
+    "updated-dependencies",
+    "security",
+    "latest",
+    "patched",
+    "express",
+    "restify",
+    "connect",
+    "http",
+    "graphql",
+    "middleware",
+    "api"
+  ],
+  "engines": {
+    "node": ">= 10.x"
+  },
+  "dependencies": {
+    "accepts": "^1.3.8",
+    "content-type": "^1.0.5",
+    "http-errors": "^2.0.1",
+    "raw-body": "^3.0.2"
+  },
+  "peerDependencies": {
+    "graphql": "^14.7.0 || ^15.3.0"
+  },
+  "depup": {
+    "changes": {
+      "accepts": {
+        "from": "^1.3.7",
+        "to": "^1.3.8"
+      },
+      "content-type": {
+        "from": "^1.0.4",
+        "to": "^1.0.5"
+      },
+      "http-errors": {
+        "from": "1.8.0",
+        "to": "^2.0.1"
+      },
+      "raw-body": {
+        "from": "^2.4.1",
+        "to": "^3.0.2"
+      }
+    },
+    "depsUpdated": 4,
+    "originalPackage": "express-graphql",
+    "originalVersion": "0.12.0",
+    "processedAt": "2026-03-19T03:01:46.507Z",
+    "smokeTest": "passed"
+  }
+}

package/parseBody.d.ts

@@ -0,0 +1,13 @@
+/// <reference types="node" />
+import type { IncomingMessage } from 'http';
+declare type Request = IncomingMessage & {
+    body?: unknown;
+};
+/**
+ * Provided a "Request" provided by express or connect (typically a node style
+ * HTTPClientRequest), Promise the body data contained.
+ */
+export declare function parseBody(req: Request): Promise<{
+    [param: string]: unknown;
+}>;
+export {};