GraphiQL & GraphQL LSP Ecosystem

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

For example, all subpackages are currently in pre-release state (alpha). our usual flow is to re-release end-user packages and dependents as pre-releases for ~week, and if no further bug reports, we go live. automated tests give assurance, but we still spend lots of time testing pre-releases, and even more time manually testing pre-releases before graduating to stable again. for example, some packages in alpha now will be in beta within a few weeks, others will be stable. independent versioning is what we call this

Repository on GitHub, which uses git. git is distributed.

semver with prerelease alpha, beta, rc

tags for each release of every subpackage

• https://github.com/graphql/graphiql/blob/master/packages/graphiql/CHANGELOG.md
• https://github.com/graphql/graphiql/blob/master/packages/codemirror-graphql/CHANGELOG.md
• https://github.com/graphql/graphiql/blob/master/packages/graphiql/CHANGELOG.md ... etc for each package

also, see: github releases!

dependabot is configured to only issue immediate security PRs, and uses a conventional commits standard that ensures it is automatically logged as a security fix in our changelog and contains a link to the CVE

https://github.com/graphql/graphiql/issues

https://github.com/graphql/graphiql/issues

https://github.com/graphql/graphiql/issues also our discord has unlimited history (for support)

haven't had this issue yet. have fixed dependency CVEs but have not had any direct vulns yet :crosses fingers:

typescript project references, babel and webpack!

you betcha

yarn test = jest

yarn test

switched from jenkins to github actions and its flyin'! netlify deploy previews are a bit slow but very very important, esp with a lack of 100% coverage, but even if we did. this is why manual regression tests are and will always be a part of every stable release.

eslint, prettier

CI builds rejected for eslint or formatting failures

I have designed multiple systems audited by US federal govt, passed multiple third party HIPAA audits with flying colors, etc.

• npm dependency errors that are user facing
• common browser security explots

no plans to implement any cryptography beside our lets encrypt SSL certificates on netlify. that is up to the user implementation.

users are not required to use https for their own service development purposes

both github and dependabot help us with this. dependabot opens PRs to fix CVEs on day 0 as public PRs, and i usually merge them within a few hours. i would never publish with known vulnerabilities

for a moment we leaked our codecov token and thats it we disabled CI publishing for this reason. publish events are only issued from my local Linux laptop using MFA over npm auth v2

eslint! for javascript and typescript. and prettier. dependabot scans us but is not floss. we link to snyk's report that they automatically generate for us from a badge on our root readme. no tools like sonarqube yet.

does cypress count? or do you mean dynamic security analysis like OWASP?