Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@azure/avocado
Advanced tools
Another Validator of OpenAPI spec repository Configuration And Directories.
NPM: https://www.npmjs.com/package/@azure/avocado
Avocado validates folder structure and configuration.
Avocado can be integrated into Azure pipeline to validate OpenAPI spec repository. For example, Avocado is used by Azure/azure-rest-api-specs
now that will trigger automatically by azure DevOps pipeline when a new pull request is created.
Avocado major functions are listed below:
specification
and filter readme.md
under the specification
folder.readme.md
is autorest specific file which must contain see https://aka.ms/autorest
swagger file
is valid json file, and check all referenced json
file (referenced json
file marked in json object has the key name "$ref"
).swagger file
must be referenced by readme.md
or other swagger file
.swagger file
has a circular reference and report a warning. For more detail, see CIRCULAR REFERENCEnpm install -g @azure/avocado
avocado -h
show help messageavocado
validate current directoryavocado -d <my-folder-path>
validate <my-folder-path>
directoryavocado -d <my-folder-path> --excludePaths 'common-types'
validate folder and exclude errors from 'common-types'azure/azure-rest-api-specs
and run "avocado" in folder azure/azure-rest-api-specs
.specification
. and move your service specs folder in specification
. run "avocado"Level: ERROR
To solve json parse error, you need make sure the json format is valid.
Level: ERROR
Readme file references a non-existing json file. To solve the error you need to check whether the json file is existing.
Level: ERROR
Json file must be referenced by the readme input file section or other json files. Eg, example swagger file should be referenced by main swagger json and for SDK generation main swagger should be referenced by the readme input file section. To solve the error you need to place the non-referenced file to proper place.
Level: ERROR
Each resource provider folder must have a readme file which is required by downstream SDK generation. To solve the error, you need create a readme file contains SDK generation config.
Level: ERROR
Each readme in resource provider folder should follow autorest markdown format. To solve the error, you need check the readme block quote whether contains see https://aka.ms/autorest
literally.
Level: ERROR
Swagger json file api version must consistent with its file path. Swagger can define swagger 2.0 basic-structure which contains api version. To solve the error, you need modify either your swagger file location or swagger file api version to make both of them consistent.
Level: WARNING
To solve circular reference, you should break the circular chain.
Example: a.json
-> b.json
->c.json
// a.json
{ "$ref": "b.json" }
// b.json
{ "$ref": "c.json" }
// c.json
{ "$ref": "a.json" }
graph TD
A((a.json))-->B((b.json))
B-->C((c.json))
C-->A
Level: WARNING
The default tag should contain only one API version swagger.
To solve this warning , you should copy the swaggers of old version into the current version folder.
Level: WARNING
The management plane swagger JSON file does not match its folder path. Make sure management plane swagger located in resource-manager folder
To solve this warning, you should make sure manager plane swagger located in resource-manager folder.
Level: ERROR
The default tag should contain all APIs. The API path `${0}` is not in the default tag. Please make sure the missing API swaggers are in the default tag.
To fix this error. You should add the missing API swaggers to the default tag. If the missing API swaggers are deprecated, in this case this error could be ignored.
Level: ERROR
The default tag does not contains the latest API version. Please make sure the latest api version swaggers are in the default tag.
To fix this error. You should add the latest API version swaggers to the default tag or change default tag to reference latest api version tag.
Level: ERROR
The readme file has more than one default tag.
The expectation is there is only one default tag, which leads to one SDK package. To release separate SDK packages upon different service resources of the same RP, may consider adopting Folder Structure for Service Group, which supports a readme configuration file under each sub folder.
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
FAQs
A validator of OpenAPI configurations
The npm package @azure/avocado receives a total of 27,064 weekly downloads. As such, @azure/avocado popularity was classified as popular.
We found that @azure/avocado demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.