
Security News
Crates.io Implements Trusted Publishing Support
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
@bzr/bazaar
Advanced tools
A JavaScript SDK client for building SPAs (Single Page Apps) with Bazaar.
Install with NPM:
npm i @bzr/bazaar
Import the package:
import { BazaarApp } from "@bzr/bazaar";
const bzr = new BazaarApp({
/* config... */
});
<script src="https://unpkg.com/@bzr/bazaar"></script>
Next.js builds in a Node runtime by default. If components consuming the SDK are built for the server, it will result in build errors for missing browser-only items, like localStorage
, document
, window
, and location
. To resolve these errors dynamically import relevant components:
const MyComponent = dynamic(() => import("@/app/MyComponent"), {
ssr: false,
});
bufferutil
and utf-8-validate
cause module resolution warnings when building a Next.js app that uses the SDK. The warnings don't cause build errors but are very noisy and confusing. The warnings occur because socket.io-client
is dependent on engine.io-client
, which is dependent on ws
, which has optional bufferutil
and utf-8-validate
peer dependencies. Something to do with the Next.js Webpack build triggers the warnings.
I attempted many other solutions, including adding a browser
field to the SDK package.json
file to ignore the offending packages and modifying rollup.config.js
(ignoring the packages with the Rollup commonjs
plugin, the replace
plugin, and creating shims with the plugin-alias
plugin.)
The warnings could resolved at the level of the app consuming the SDK with the following:
// next.config.js
const nextConfig = {
webpack: (config) => {
config.resolve.alias = {
...config.resolve.alias,
bufferutil: false,
"utf-8-validate": false,
};
return config;
},
};
FAQs
The Bazaar SDK. Conveniently use Bazaar with your app in the browser.
The npm package @bzr/bazaar receives a total of 2 weekly downloads. As such, @bzr/bazaar popularity was classified as not popular.
We found that @bzr/bazaar demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
Research
/Security News
Undocumented protestware found in 28 npm packages disrupts UI for Russian-language users visiting Russian and Belarusian domains.
Research
/Security News
North Korean threat actors deploy 67 malicious npm packages using the newly discovered XORIndex malware loader.