Security News
PyPI’s New Archival Feature Closes a Major Security Gap
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
By Sarah Gooding - Jan 30, 2025
New Case Study:See how Anthropic automated 95% of dependency reviews with Socket.Learn More →
@coldwired/router
Advanced tools
@coldwired/router 
Why?
At work we have a six-year-old reasonably big rails app. It powers quite a successful service while being run by a small team. It's an old school, server rendered rails app. The team is not interested at all in migrating to a JavaScript framework. But we do have some pieces of the app that requires dynamic components. Recently we introduced hotwired/turbo into our code base and it is quite a success. The team likes the minimal JavaScript API surface a lot. But turbo has problems. Those problems are very similar to the ones solved by @remix-run/router. The main one is coordinating multiple submitting forms on one page without full reloads.
How?
This project is an almost "drop in" replacement of turbo-drive with remix based router. It does several things:
- intercepts
clickandsubmitevents to navigate with client router - use morphdom to render pages
- bypass in browser routing if
data-turbo="false"is set on links and forms - provide a directive to register fetchers (
data-turbo-fetcher) - provide a directive to submit forms on changes (
data-turbo-submit-on-change) - provide a directive to revalidate pages (
data-turbo-revalidate) - in fetcher responses, accepts turbo-stream format and bypass revalidation in those cases
- if
data-turbo-methodis used on<a>it will submit the link instead of navigating - if
data-turbo-disabledis used on<input>,<select>or<button>it will atomatically disable them during submission - if
data-turbo-confirmis used on<a>or<form>it will ask for confirmation before submitting/navigating - preserve
classattribute changes between renders unlessdata-turbo-forcedirective is used - preserve
aria-and related attributes changes between renders unlessdata-turbo-forcedirective is used - preserve
valueon touched<input>and<select>between renders unlessdata-turbo-forcedirective is used - extends turbo-stream with ability to delay actions
- extends turbo-stream with ability to pin actions between renders
Demo
Usage
In order to use this router you need to generate (or write) a JSON array of all the routes exposed by your server. You must add method to route handles in order for router to register loaders and actions. No nested routing for now – we might explore the possibility later but it will require a much more involved server. All the requests to your server will have a header x-requested-with: coldwire. In order for redirects to work properly you must respond with a 204 and a x-coldwire-redirect: <url> header instead of the usual 30* and a location: <url> header.
import { Application, type RouteObject } from '@coldwired/router';
const routes: RouteObject[] = [
{
path: '/',
id: 'root',
handle: { method: 'get' }
},
{
path: '/login',
id: 'login',
handle: { method: ['get', 'post'] }
}
];
const application = await Application.start({ routes });
<html>
<body data-turbo>
<form>
(...)
</form>
<div data-turbo="false">
<form>
(...)
</form>
</div>
<ul>
<li id="item_1">
<form data-turbo-fetcher>
(...)
</form>
</li>
<li id="item_2">
<form data-turbo-fetcher>
(...)
</form>
</li>
</ul>
</body>
</html>
FAQs
A router based on @remix-run/router and @coldwired/actions
The npm package @coldwired/router receives a total of 9 weekly downloads. As such, @coldwired/router popularity was classified as not popular.
We found that @coldwired/router demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Package last updated on 26 Oct 2023
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Research
Security News
North Korean APT Lazarus Targets Developers with Malicious npm Package
Malicious npm package postcss-optimizer delivers BeaverTail malware, targeting developer systems; similarities to past campaigns suggest a North Korean connection.
By Kirill Boychenko, Peter van der Zee - Jan 29, 2025
Security News
CISA Brings KEV Data to GitHub
CISA's KEV data is now on GitHub, offering easier access, API integration, commit history tracking, and automated updates for security teams and researchers.
By Sarah Gooding - Jan 29, 2025