Security News
Supply Chain Attack Detected in Solana's web3.js Library
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
@concord-consortium/diagram-view
Advanced tools
cd
into itnpm install
to pull dependenciesnpm start
to run webpack-dev-server
in development mode with hot module replacementAdditional steps are required to run using HTTPS.
brew install mkcert
(install using Scoop or Chocolatey on Windows)mkcert -install
.localhost-ssl
certificate directory in your home directory (create if needed, typically C:\Users\UserName
on Windows) and cd into that directorymkcert -cert-file localhost.pem -key-file localhost.key localhost 127.0.0.1 ::1
npm run start:secure
to run webpack-dev-server
in development mode with hot module replacementAlternately, you can run secure without certificates in Chrome:
chrome://flags/#allow-insecure-localhost
in Chrome URL barnpm run start:secure:no-certs
to run webpack-dev-server
in development mode with hot module replacementIf you want to build a local version run npm run build
, it will create the files in the dist
folder.
You do not need to build to deploy the code, that is automatic. See more info in the Deployment section below.
TypeScript React
in the status bar and select 'Use Workspace Version' in the popup menu.Run npm test
to run jest tests.
Run npm run test:full
to run jest and Cypress tests.
Inside of your package.json
file:
--browser browser-name
: define browser for running tests--group group-name
: assign a group name for tests running--spec
: define the spec files to run--headed
: show cypress test runner GUI while running test (will exit by default when done)--no-exit
: keep cypress test runner GUI open when done running--record
: decide whether or not tests will have video recordings--key
: specify your secret record key--reporter
: specify a mocha reportercypress run --browser chrome
will run cypress in a chrome browsercypress run --headed --no-exit
will open cypress test runner when tests begin to run, and it will remain open when tests are finished running.cypress run --spec 'cypress/integration/examples/smoke-test.js'
will point to a smoke-test file rather than running all of the test files for a project.The diagram-view is used in CLUE in the diagram tile, and possibly other projects as well. As you're making changes to this library, it can be helpful to test those changes within client projects without deploying. This can be done with yalc.
yalc provides an alternative to npm link
. It acts as a very simple local repository for locally developed packages that can be shared across a local environment. It provides a better workflow than npm | yarn link
for package authors. There are scripts in package.json to make this easier.
To publish an in-development version of the diagram-view library, run:
npm run yalc:publish
To consume an in-development version of the diagram-view library, in the root directory of the client project:
npx yalc add @concord-consortium/diagram-view
To update all clients that are using the in-development version of diagram-view, in the diagram-view project:
npm run yalc:publish
yalc
modifies the package.json
of the client project with a link to the local yalc
repository. This is a good thing! as it makes it obvious when you're using an in-development version of a library and serves as a reminder to install a fully published version before pushing to GitHub, etc. It also means that running npm install
in the client project will not break the setup.
Production releases to S3 are based on the contents of the /dist folder and are built automatically by GitHub Actions for each branch and tag pushed to GitHub.
Branches are deployed to https://models-resources.concord.org/quantity-playground/branch/{name}. If the branch name starts or ends with a number this number is stripped off.
Tags are deployed to http://models-resources.concord.org/quantity-playground/version/{name}.
To deploy a production release:
git log --pretty=oneline --reverse <last release tag>...HEAD | grep '#' | grep -v Merge
and add contents (after edits if needed to CHANGELOG.md)npm run build
dist
release-<version>
branch and commit changes, push to GitHub, create PR and mergev[x].[y].[z]
, include at least the version in the tag message. On the command line this can be done with a command like git tag -a v1.2.3 -m "1.2.3 some info about this version"
git push origin v1.2.3
.v1.2.3
. (Note this won't work until the PR has been merged to master)Run Workflow
button.package.json
and package-lock.json
npm version --no-git-tag-version [patch|minor|major]
npm run lint && npm run test && npm run tsc
npm run publish:test
npm run publish:npm
The updates should show up on NPM at https://www.npmjs.com/package/@concord-consortium/diagram-view .
Quantity Playground is Copyright 2024 (c) by the Concord Consortium and is distributed under the MIT license.
See license.md for the complete license text.
FAQs
Concord Consortium quantity playground
We found that @concord-consortium/diagram-view demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.