Product
Announcing Precomputed Reachability Analysis in Socket
Socket’s precomputed reachability slashes false positives by flagging up to 80% of vulnerabilities as irrelevant, with no setup and instant results.
By Martin Torp - Jul 30, 2025
You're Invited:Meet the Socket Team at BlackHat and DEF CON in Las Vegas, Aug 4-6.RSVP →
github.com/model-collapse/vugu
- Version published
- Created
Vugu
Vugu is an experimental library for web UIs written in Go and targeting webassembly. Guide and docs at https://www.vugu.org. Godoc at https://godoc.org/github.com/vugu/vugu.
If you've ever wanted to write a UI not in JS but pure Go... and run it in your browser, right now... That (experimental;) future is here!
Introducing Vugu (pronounced /ˈvuː.ɡuː/), a VueJS-inspired library in Go targeting wasm.
No node. No JS. No npm. No node_modules folder competing with your music library for disk space.
Updates ♨
- 2019-09-08 Implemented ModTracker to keep track of changes to components and their data (this is also the beginning of Vuex-like functionality but without wrappers or events). Worked out the lifecycle of components in much more detail and work in progress on nested components implementation (component-refactor branch currently broken, but finally the core nested component functionality is going in - hopefully will finish next week).
- 2019-09-07 Updated everything for Go 1.13, including both master and component-refactor branches, Vugu's js wrapper package, site documentation.
- 2019-09-01 On component-refactor branch: Form element values and other related data now available on DOMEvent,
.prop=syntax implemented, various cleanup, imports are deduplicated automatically now, started on nested component implementation and all of that craziness. - 2019-08-25 CSS now supported on component-refactor branch, including in full-HTML mode, working sample that pulls in Bootstrap CSS. Vugu's js wrapper package copied to master and made available.
- 2019-08-18 Full HTML (root component can start with
<html>tag) now supported on component-refactor branch, updated CSS and JS support figured out and implementation in-progress - 2019-08-12 Refactored DOM event listener code in-progress, event registration/deregistration works(-ish), filling out the remaining functionality to provide event summary, calls like preventDefault(), etc.
- 2019-08-04 Some basic stuff in there on the DOM syncing rewrite and the new instruction workflow from VGNode -> binary encoded to raw bytes in Go -> read with DataView in JS -> DOM tree manipulation. With the pattern in place the rest should get easier.
- 2019-07-28 Making some hard choices on how to do DOM syncing in a performant and reliable way. https://github.com/vugu/vugu/wiki/DOM-Syncing-Instructions
- 2019-07-20 Some design info on how "data binding" (hashing actually) will work in Vugu: https://github.com/vugu/vugu/wiki/Data-Hashing-vs-Binding
- 2019-07-16 Vugu has a logo! https://www.instagram.com/p/Bz3zmtYAYcM/ Good things are in the works, the plan is to get a bunch of much-awaited updates pushed to master before the end of the month.
- 2019-05-19 Refactor still in progress - this is the cleaned-up architecture concept: https://github.com/vugu/vugu/wiki/Architecture-Overview
- 2019-04-07 The Vugu Playground is up at: https://play.vugu.org/
- 2019-04-05 Thanks to @erinpentecost, vugufmt is now available and provides gofmt-like functionality on your .vugu files. ("go get github.com/vugu/vugu/cmd/vugufmt && go install github.com/vugu/vugu/cmd/vugufmt")
- 2019-04-05 The component playground should be available soon; followed by some internal work to properly handle nested components in a type-safe way; then probably a router...
Join the conversation: Gophers on Slack, channel #vugu
Highlights
- Runs in-browser using WebAssembly
- Single-file components
- Vue-like markup syntax
- Write idiomatic Go code
- Rapid prototyping
- ~3 minute setup
- Standard Go build tools
Start
Get started: http://www.vugu.org/doc/start
Still a work in progress, but a lot of things are already functional. Some work really well.
Abbreviated Roadmap
- Single-file components (looks similar to .vue); .vugu -> .go code generation.
- Includes CSS in components.
- Basic flow control with vg-if, vg-for and output with vg-html.
- Dynamic attributes with
<tag :prop='expr'>. - Nested components with dynamic properties
<my-custom-component :prop='expr'>. - Efficiently syncs to browser DOM.
- Static HTML output (great for tests).
- DOM Events, click, etc.
- Basic data hashing to avoid unnecessary computation where possible.
- Basic dev and prod server tooling, easy to get started
- Rewrite everything so it is not so terrible internally and stablize existing features to avoid breaking things moving forward as much as possible (big task, but well in-progress!)
- URL Router
- Server-side rendering (HTML generation works, needs URL Router to make it usable)
- Performance optimizations
- Go-only component events
- And much more...
Notes
It's built more like a library than a framework. While Vugu does do code generation for your .vugu component files, (and will even output a default main_wasm.go for a new project and build your program automatically upon page refresh), fundamentally you are still in control. Overall program flow, application wiring and initialization, the render loop that keeps the page in sync with your components - you have control over all of that. Frameworks call your code. Vugu is a library, your code calls it (even if Vugu generates a bit of that for you in the beginning to make things easier). One of the primary goals for Vugu, when it comes to developers first encountering it, was to make it very fast and easy to get started, but without imposing unnecessary limitations on how a project is structured. Go build tooling (and now the module system) is awesome. The idea is to leverage that to the furthest extent possible, rather than reprogramming the wheel.
So you won't find a vugu command line tool that runs a development server, instead
you'll find in the docs an appropriate snippet of code you can paste in a file and go run yourself. For the code
generation while there is an http.Handler that can do this upon page refresh, you also can (and should!) run vugugen
via go generate. There are many small decisions in Vugu which follow this philosophy: wherever reasonably possible,
just use the existing mechanism instead of inventing anew. And keep doing that until there's proof that something
else is really needed. So far it's been working well. And it allows Vugu to focus on the specific things it
brings to the table.
FAQs
Unknown package
Package last updated on 04 Feb 2020
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Product
Socket Now Protects the Chrome Extension Ecosystem
Socket is launching experimental protection for Chrome extensions, scanning for malware and risky permissions to prevent silent supply chain attacks.
By Mix Irving, Alexandros Kapravelos, Eli Insua - Jul 30, 2025
Product
Introducing Socket MCP for Claude Desktop
Add secure dependency scanning to Claude Desktop with Socket MCP, a one-click extension that keeps your coding conversations safe from malicious packages.
By Alexandros Kapravelos - Jul 29, 2025