
Research
/Security News
DuckDB npm Account Compromised in Continuing Supply Chain Attack
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
@artsy/reaction
Advanced tools
::::::::: :::::::::: ::: :::::::: ::::::::::: ::::::::::: :::::::: :::: :::
:+: :+: :+: :+: :+: :+: :+: :+: :+: :+: :+: :+:+: :+:
+:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ :+:+:+ +:+
+#++:++#: +#++:++# +#++:++#++: +#+ +#+ +#+ +#+ +:+ +#+ +:+ +#+
+#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+#+#
#+# #+# #+# #+# #+# #+# #+# #+# #+# #+# #+# #+# #+#+#
### ### ########## ### ### ######## ### ########### ######## ### ####
$ git clone https://github.com/artsy/reaction.git
$ cd reaction
$ npm install -g yarn
$ yarn install
$ brew install watchman (If you don't already have Homebrew, go here for installation instructions: https://brew.sh/)
$ cp .env.oss .env
Run the tests:
$ yarn test
Run the tests continuously (or use vscode-jest
):
$ yarn test -- --watch
In vscode, run the TypeScript: Run type-checker
task and open the PROBLEMS
view to see continuous type-checker
results.
When using new changes in metaphysics’ schema, be sure to update the local schema copy:
$ yarn sync-schema
.vscode/extensions.json
and additional docs at docs/vscode.md.Before you start, you should ensure Force is on the right branch and up-to-date.
Use yarn to kick off the force development process.
yarn integrate force
This command will build and compile reaction, publish it locally so it can be used in other places, link it into force for you, and then start reaction and force in watch mode.
This assumes force is a sibling directory of reaction. If it's not you can use the following setup instead.
PROJECT_PATH=path/to/force yarn integrate
If you need to attach force to a debugger, use the ENABLE_DEBUGGER
command as follows
ENABLE_DEBUGGER=true yarn integrate force
To link your local reaction with your local force, run:
$ yarn link && yarn watch
(wait until you see a message that X files have been successfully compiled before moving on)
$ cd ../force && yarn link @artsy/reaction && yarn start
To unlink your local reaction from your local force, run (in Force):
$ yarn unlink @artsy/reaction
$ yarn add @artsy/reaction
$ yarn start
Reaction uses auto-release to automatically release on every PR. Every PR should have a label that matches one of the following
Peril will automatically add "Version: Patch", if you don't set one on creating your PR. No release will happen on a Trivial
update.
If you're making a change but you don't want to immediate trigger a release (i.e. when 2 PRs need to go out together), specify the correct
version and add the Skip Release
label. That'll ensure when the next release happens the version is still bumped appropriately.
Canaries are automatically published to NPM when creating a PR based off of a repo branch (i.e. not a fork). If you need to publish a canary of a fork you'll have to do a few manual steps:
package.json
, set version to a canary version, e.g. 2.0.0-canary-<PR#>
, 3.1.5-canary-<PR#>
, ...npm publish --tag canary
to publish the package under the canary tagyarn add @artsy/reaction@canary
to install canary packagenpm dist-tag ls
can be helpful to see what tagged packages are availableThis project is the work of engineers at Artsy, the world's leading and largest online art marketplace and platform for discovering art. One of our core Engineering Principles is being Open Source by Default which means we strive to share as many details of our work as possible.
You can learn more about this work from our blog and by following @ArtsyOpenSource or explore our public data by checking out our API. If you're interested in a career at Artsy, read through our job postings!
FAQs
Force’s React Components
We found that @artsy/reaction demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.