{"id":47855,"library":"graphql-depth-limit-ts","title":"GraphQL Depth Limit TS","description":"A fork of graphql-depth-limit rebuilt for ESM and CJS with TypeScript declarations. Provides a dead-simple validation rule to limit the total depth of GraphQL queries, protecting against cyclical or deeply nested queries that could cause denial-of-service. Current stable version 1.1.1. Unlike cost-based libraries (graphql-query-complexity, graphql-validation-complexity), this library focuses solely on depth because complexity often increases exponentially with depth (e.g., SQL JOINs). Ships both ESM and CJS bundles with type definitions.","status":"active","version":"1.1.1","language":"javascript","source_language":"en","source_url":"https://github.com/sonofmagic/graphql-depth-limit-ts","tags":["javascript","graphql","complexity","esm","cjs","typescript","dts","query","depth"],"install":[{"cmd":"npm install graphql-depth-limit-ts","lang":"bash","label":"npm"},{"cmd":"yarn add graphql-depth-limit-ts","lang":"bash","label":"yarn"},{"cmd":"pnpm add graphql-depth-limit-ts","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"peer dependency; provides GraphQL types and validation infrastructure","package":"graphql","optional":false}],"imports":[{"note":"Default export; CJS users should use require('graphql-depth-limit-ts').default if their bundler or Node version doesn't handle ESM interop automatically.","wrong":"const depthLimit = require('graphql-depth-limit-ts');","symbol":"depthLimit","correct":"import depthLimit from 'graphql-depth-limit-ts'"},{"note":"Type only import for TS users; not available at runtime.","type":true,"symbol":"DepthLimitOptions","correct":"import type { DepthLimitOptions } from 'graphql-depth-limit-ts'"},{"note":"Common mistake: trying named import instead of default import. The library has no named export 'depthLimit'.","wrong":"import { depthLimit } from 'graphql-depth-limit-ts'","symbol":"default","correct":"import depthLimit from 'graphql-depth-limit-ts'"}],"quickstart":{"code":"import depthLimit from 'graphql-depth-limit-ts';\nimport express from 'express';\nimport { graphqlHTTP } from 'express-graphql';\nimport schema from './schema';\n\nconst app = express();\napp.use('/graphql', graphqlHTTP(() => ({\n  schema,\n  validationRules: [depthLimit(10)]\n})));\napp.listen(4000);\nconsole.log('Running a GraphQL API server at http://localhost:4000/graphql');","lang":"typescript","description":"Basic setup with Express and express-graphql, limiting query depth to 10."},"warnings":[{"fix":"Combine with cost analysis libraries (e.g., graphql-query-complexity) for full protection.","message":"The library validates only total depth, not query cost or field complexity. A shallow query with expensive resolvers can still cause performance issues.","severity":"gotcha","affected_versions":">=0.0.0"},{"fix":"Use graphql-depth-limit-ts instead, which supports ESM, CJS, and TypeScript types.","message":"The original graphql-depth-limit package is unmaintained; this fork includes modern bundling.","severity":"deprecated","affected_versions":"*"},{"fix":"Review fragment expansions; consider depth limiting on resolver level as a complement.","message":"Fragments do not increase depth beyond the first level, but this can lead to underestimated depth if fragments contain deeply nested selections.","severity":"gotcha","affected_versions":">=0.0.0"},{"fix":"Apply depthLimit() individually for each operation if using batched queries.","message":"The limit applies per operation (query/mutation/subscription), not globally across batch requests.","severity":"gotcha","affected_versions":">=0.0.0"}],"env_vars":null,"search_vec":"'1.1.1':52 'base':56 'bundl':87 'caus':44 'cjs':16,86,95 'complex':61,65,73,93 'cost':55 'cost-bas':54 'could':43 'current':49 'cyclic':37 'dead':23 'dead-simpl':22 'declar':19 'deepli':39 'definit':90 'denial':46 'denial-of-servic':45 'depth':2,10,31,71,78,99 'dts':97 'e.g':79 'esm':14,84,94 'exponenti':76 'focus':68 'fork':6 'graphql':1,9,33,59,63,92 'graphql-depth-limit':8 'graphql-query-complex':58 'graphql-validation-complex':62 'increas':75 'javascript':91 'join':81 'librari':57,67 'limit':3,11,28 'nest':40 'often':74 'protect':35 'provid':20 'queri':34,41,60,98 'rebuilt':12 'rule':26 'servic':48 'ship':82 'simpl':24 'sole':69 'sql':80 'stabl':50 'total':30 'ts':4 'type':89 'typescript':18,96 'unlik':53 'valid':25,64 'version':51","created_at":"2026-06-07T16:53:40.782667+00:00","updated_at":"2026-06-07T16:53:40.782667+00:00","problems":[{"fix":"Run 'npm install graphql-depth-limit-ts' and import the correct package name.","cause":"Package not installed or used incorrect import path (e.g., old name 'graphql-depth-limit').","error":"Cannot find module 'graphql-depth-limit-ts'"},{"fix":"Use 'import depthLimit from ...' (ESM) or 'const depthLimit = require(...).default' (CJS).","cause":"Used named import { depthLimit } instead of default import, or CJS require without .default.","error":"depthLimit is not a function"},{"fix":"Use depthLimit() as a validation rule only; do not add schema directives.","cause":"Confusion with other validation libraries; this library does not support directives.","error":"Unknown directive @..."}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/sonofmagic/graphql-depth-limit-ts#readme","github":"https://github.com/sonofmagic/graphql-depth-limit-ts","docs":null,"changelog":null,"pypi":null,"npm":"graphql-depth-limit-ts","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-07","next_check":"2026-09-05","install_tag":null}}