Registry / security / graphql-depth-limit-ts

graphql-depth-limit-ts

library1.1.1jsnpmunverified

A fork of graphql-depth-limit rebuilt for ESM and CJS with TypeScript declarations. Provides a dead-simple validation rule to limit the total depth of GraphQL queries, protecting against cyclical or deeply nested queries that could cause denial-of-service. Current stable version 1.1.1. Unlike cost-based libraries (graphql-query-complexity, graphql-validation-complexity), this library focuses solely on depth because complexity often increases exponentially with depth (e.g., SQL JOINs). Ships both ESM and CJS bundles with type definitions.

security

npm install graphql-depth-limit-ts

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · GRAPHQL-DEPTH-LIMI

graphql-depth-limit-ts

securityjavascriptv1.1.1

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

depthLimit

✓ import depthLimit from 'graphql-depth-limit-ts'

✗ const depthLimit = require('graphql-depth-limit-ts');

Default export; CJS users should use require('graphql-depth-limit-ts').default if their bundler or Node version doesn't handle ESM interop automatically.

DepthLimitOptions

✓ import type { DepthLimitOptions } from 'graphql-depth-limit-ts'

Type only import for TS users; not available at runtime.

default

✓ import depthLimit from 'graphql-depth-limit-ts'

✗ import { depthLimit } from 'graphql-depth-limit-ts'

Common mistake: trying named import instead of default import. The library has no named export 'depthLimit'.

Basic setup with Express and express-graphql, limiting query depth to 10.

import depthLimit from 'graphql-depth-limit-ts'; import express from 'express'; import { graphqlHTTP } from 'express-graphql'; import schema from './schema'; const app = express(); app.use('/graphql', graphqlHTTP(() => ({ schema, validationRules: [depthLimit(10)] }))); app.listen(4000); console.log('Running a GraphQL API server at http://localhost:4000/graphql');

Debug

Known issues

gotchaThe library validates only total depth, not query cost or field complexity. A shallow query with expensive resolvers can still cause performance issues.

fix

Combine with cost analysis libraries (e.g., graphql-query-complexity) for full protection.

affects: >=0.0.0

deprecatedThe original graphql-depth-limit package is unmaintained; this fork includes modern bundling.

fix

Use graphql-depth-limit-ts instead, which supports ESM, CJS, and TypeScript types.

affects: *

gotchaFragments do not increase depth beyond the first level, but this can lead to underestimated depth if fragments contain deeply nested selections.

fix

Review fragment expansions; consider depth limiting on resolver level as a complement.

affects: >=0.0.0

gotchaThe limit applies per operation (query/mutation/subscription), not globally across batch requests.

fix

Apply depthLimit() individually for each operation if using batched queries.

affects: >=0.0.0

Errors

Common errors & fixes

Cannot find module 'graphql-depth-limit-ts'

Package not installed or used incorrect import path (e.g., old name 'graphql-depth-limit').

fix

Run 'npm install graphql-depth-limit-ts' and import the correct package name.

depthLimit is not a function

Used named import { depthLimit } instead of default import, or CJS require without .default.

fix

Use 'import depthLimit from ...' (ESM) or 'const depthLimit = require(...).default' (CJS).

Unknown directive @...

Confusion with other validation libraries; this library does not support directives.

fix

Use depthLimit() as a validation rule only; do not add schema directives.

Upgrade

Version history

1.1.1latest on npm

Audit

Dependencies

graphqlrequiredpeer dependency; provides GraphQL types and validation infrastructure

Agent activity

19 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/sonofmagic/graphql-depth-limit-ts ↗

packagegraphql-depth-limit-ts ↗

homepagehttps://github.com/sonofmagic/graphql-depth-limit-ts#readme ↗