
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
@appshell/config
Advanced tools
Utility for producing a global appshell manifest for module federation micro-frontends
Utitliy to generate appshell configuration for building micro-frontends with Appshell and Webpack Module federation.
Working examples can be found here.
Note: This package is no longer published, and it's recommended to use the @appshell/cli instead.
To begin, you'll need to install @appshell/config:
npm install @appshell/config --save-dev
or
yarn add -D @appshell/config
or
pnpm add -D @appshell/config
generateManifestThe generateManifest function is given a configs dir to process and produces a merged appshell manifest.
import { generateManifest } from '@appshell/config';
const manifest = generateManifest<MyMetadata>(process.env.CONFIGS_DIR);
Where does the content of CONFIGS_DIR come from?
Each micro-frontend configured to use @appshell/manifest-webpack-plugin emits it's configuration to the configs directory at build time, which is subsequently processed with this utility to reflect the current runtime environment.
Sample content from CONFIGS_DIR:
{
"remotes": {
"CraModule/App": {
"url": "${CRA_MFE_URL}",
"metadata": {
"route": "/cra",
"displayName": "Example App",
"displayGroup": "${CRA_MFE_DISPLAY_GROUP}",
"order": 10,
"icon": "ViewList"
},
"id": "3eb81a0c"
}
},
"module": {
"exposes": {
"./App": "./src/App"
},
"filename": "remoteEntry.js",
"name": "CraModule",
"shared": {
"react": {
"singleton": true,
"requiredVersion": "^18.2.0"
},
"react-dom": {
"singleton": true,
"requiredVersion": "^18.2.0"
}
}
},
"environment": {
"RUNTIME_ARG_1": "${RUNTIME_ARG_1}",
"RUNTIME_ARG_2": "${RUNTIME_ARG_2}"
}
}
How does my runtime environment get reflected in the global appshell manifest?
Note the variable expansion syntax
${CRA_MFE_URL}. WhengenerateManifestis called the actual runtime environment values are injected and an appshell manifest is emitted.
Note the
environmentsection defines runtime environment variables that are injected into the global namesapcewindow.__appshell_env__[module_name]when an Appshell component is loaded. See the examples for a use case.
Sample appshell manifest produced by the generateManifest function:
{
"remotes": {
"CraModule/App": {
"id": "3eb81a0c",
"url": "http://localhost:3001/remoteEntry.js",
"scope": "CraModule",
"module": "./App",
"metadata": {
"route": "/cra",
"displayName": "Example App",
"displayGroup": "main",
"order": 10,
"icon": "ViewList"
}
},
"VanillaModule/Vanilla": {
"id": "8232ce86",
"url": "http://localhost:3002/remoteEntry.js",
"scope": "VanillaModule",
"module": "./Vanilla",
"metadata": {
"route": "/vanilla",
"displayName": "Example React App",
"displayGroup": "main",
"order": 10,
"icon": "ViewList"
}
}
},
"modules": {
"Appshell": {
"name": "Appshell",
"shared": {
"react": {
"singleton": true,
"requiredVersion": "^18.2.0"
},
"react-dom": {
"singleton": true,
"requiredVersion": "^18.2.0"
}
}
},
"CraModule": {
"exposes": {
"./App": "./src/App"
},
"filename": "remoteEntry.js",
"name": "CraModule",
"shared": {
"react": {
"singleton": true,
"requiredVersion": "^18.2.0"
},
"react-dom": {
"singleton": true,
"requiredVersion": "^18.2.0"
}
}
},
"VanillaModule": {
"exposes": {
"./Vanilla": "./src/App"
},
"filename": "remoteEntry.js",
"name": "VanillaModule",
"shared": {
"react": {
"singleton": true,
"requiredVersion": "^18.2.0"
},
"react-dom": {
"singleton": true,
"requiredVersion": "^18.2.0"
}
}
}
},
"environment": {
"CraModule": {
"RUNTIME_ARG_1": "Foo",
"RUNTIME_ARG_2": "Biz"
},
"VanillaModule": {
"RUNTIME_ARG_1": "Bar"
}
}
}
This appshell manifest is registered with APPSHELL_REGISTRY consumed by the appshell host.
What if I want to generate the manifest by a startup script instead?
This functionality is exposed by the @appshell/cli package. You can simply call
appshell generate manifest --template /path/to/appshell.template.jsonto produce the runtime manifest on startup.
FAQs
Utility for producing a global appshell manifest for module federation micro-frontends
We found that @appshell/config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.