Fix security vulnerabilities

[ChristophWalter]

This webpack loader depends on persistgraphql which is deprecated and has seen no update since 2018. As this also results in transitive dependencies with security vulnerabilities (e.g. yargs-parser) we should search for an alternative approach.

I am not quite sure why persistgraphql is used, as we only need to hash the output of graphql-tag/loader. To generate the hash from the query AST we could use the print method from graphql.

[cipater]

For what it's worth, I have fork at https://github.com/cipater/graphql-persisted-document-loader that ditches persistgraphql and uses graphql and apollo-graphql instead to generate a documentID that is consistent with the hash generated by apollo client:extract.

I believe it also fixes #5

[kbariotis]

Thanks for that @cipater. I have a question, what exactly does that piece from persistgraphql? Why is needed?

thanks

[cipater]

@kbariotis It adds the __typename field to your queries:

https://github.com/leoasis/graphql-persisted-document-loader/blob/master/README.md

[leoasis]

Fixed by #23