Yoga
On this page

@envelop/rate-limiter

Changelog for @envelop/rate-limiter: every release with its changes and the pull requests behind them.

11.0.0

Major Changes

  • #4574 79b0e8b Thanks @egoodwinx! - ### Breaking Changes

    • Node: minimum supported version is now Node 22. Node 18 and 20 are no longer supported. Future releases will only support Node >=22.
    • GraphQL: minimum supported version is now GraphQL 16. GraphQL 14 and 15 are no longer supported.
    • Request body parsing: Yoga now limits request bodies to 25,000,000 bytes by default. Enforcing this limit streams the body through a byte counter, making POST body parsing asynchronous even for an in-memory body. As a result, yoga.fetch() can return a Promise where it previously returned a synchronous Response, even when all resolvers and plugins are synchronous.

    Migration

    • If you’re on Node 18/20, upgrade to Node 22 or later before upgrading this package.
    • If you’re on graphql 14/15, upgrade to graphql 16 or 17 first.
    • Await yoga.fetch() and response body parsing instead of relying on synchronous results. Set maxRequestBodySize: false in createYoga to disable the body-size limit and preserve synchronous parsing for in-memory bodies, but only if you enforce an appropriate request-body limit elsewhere.

  • #4623 be89d05 Thanks @ardatan! - ### Dependencies

    • Bump @graphql-tools/utils to ^13.1.1, @graphql-tools/schema to ^11.0.0, and @graphql-tools/executor to ^4.1.2.

    Incremental delivery

    Yoga maps the GraphQL HTTP Accept header through INCREMENTAL_DELIVERY_SPECS from @graphql-tools/utils onto executor incrementalSpec. multipart/mixed;incrementalSpec=v0.2 runs the v0.2 payload format and echoes that spec on Content-Type. multipart/mixed;deferSpec=20220824 or bare multipart/mixed stays on v0.1. An unsupported incremental spec yields 406.

    A later incremental spec is a graphql-tools table row plus an executor publisher. Yoga, Hive Gateway, and HTTP executors pick it up by bumping @graphql-tools/utils / @graphql-tools/executor.

    Breaking Changes

    • createGraphQLError is removed. Use new GraphQLError(message, options) from graphql. To attach Yoga’s experimental schema coordinate, use withSchemaCoordinate(error, coordinate) and read with getSchemaCoordinate from @graphql-tools/utils.
    • mapMaybePromise is removed (was exported from Yoga / @envelop/core). Use handleMaybePromise from @whatwg-node/promise-helpers.
    • Yoga no longer re-exports helpers that already live upstream:
      • getSchemaCoordinate -> @graphql-tools/utils
      • mergeSchemas -> @graphql-tools/schema
      • DisposableSymbols -> @whatwg-node/server
      • mapAsyncIterator / isPromise / fakePromise / handleMaybePromise / MaybePromise -> @whatwg-node/promise-helpers
    • @envelop/core utils no longer re-exports mapAsyncIterator or isPromise. Import from @whatwg-node/promise-helpers.
    • Use asGetArgumentValuesVariables / coerceGetVariableValuesResult from @graphql-tools/utils for GraphQL 16/17 VariableValues compatibility.

    Migration

    import { GraphQLError } from 'graphql'
import { withSchemaCoordinate } from 'graphql-yoga'
import { mergeSchemas } from '@graphql-tools/schema'
import { getSchemaCoordinate } from '@graphql-tools/utils'
import { handleMaybePromise, isPromise, type MaybePromise } from '@whatwg-node/promise-helpers'
import { DisposableSymbols } from '@whatwg-node/server'

throw withSchemaCoordinate(new GraphQLError('not found'), 'Query.user')

Patch Changes

10.2.3

Patch Changes

10.2.2

Patch Changes

10.2.1

Patch Changes

  • #4577 7bff35c Thanks @egoodwinx! - Add homepage and bugs.url to package.json files

  • Updated dependencies [7bff35c]:

    • @envelop/on-resolve@7.2.1
    • @envelop/core@5.6.1

10.2.0

Minor Changes

  • #4545 94ebe5b Thanks @egoodwinx! - Update to support graphql-js 17

    Bump package versions, fix expected typing, and update compatability with subscribe.

Patch Changes

  • Updated dependencies [94ebe5b]:
    • @envelop/on-resolve@7.2.0
    • @envelop/core@5.6.0

10.1.0

Minor Changes

  • #4530 62c2cd1 Thanks @enisdenjo! - Field config now accepts an identifier template string as a lightweight alternative to identifyFn

    Supports {args.argName} and {context.propName} dot-path interpolation, equivalent to using @rateLimit(identityArgs: [...]) via the directive but available in programmatic config.

    useRateLimiter({
  identifyFn: ctx => ctx.ip,
  configByField: [
    {
      type: 'Query',
      field: 'getProduct',
      window: '1m',
      max: 10,
      identifier: '{args.id}'
    },
    {
      type: 'Query',
      field: 'search',
      window: '1m',
      max: 30,
      identifier: '{context.ip}'
    }
  ]
})

  • #4530 62c2cd1 Thanks @enisdenjo! - identifyFn now receives field argument values as a second parameter when used via configByField

    The per-field identifyFn on ConfigByField receives the resolved argument values, making it straightforward to rate limit unauthenticated requests by argument value without a directive.

    useRateLimiter({
  identifyFn: ctx => ctx.ip,
  configByField: [
    {
      type: 'Query',
      field: 'getProduct', // getProduct(id: ID!): Product!
      window: '1m',
      max: 10,
      identifyFn: (ctx, args) => String(args.id)
    }
  ]
})

    Note: the root identifyFn also receives args as a second parameter when it acts as the fallback for a configByField entry, but args will be empty when it is invoked for directive-based rate limiting.