
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
@condenast/bundlesize
Advanced tools
Keep your bundle size in check
npm install bundlesize --save-dev
Add it to your scripts in package.json
"scripts": {
"test": "bundlesize"
}
Or you can use npx
with NPM 5.2+.
npx bundlesize
package.json
.By default the gzipped size is tested. You can use the compression
option to change this. (gzip
, brotli
, or none
).
{
"name": "your cool library",
"version": "1.1.2",
"bundlesize": [
{
"path": "./dist.js",
"maxSize": "3 kB"
}
]
}
bundlesize
also supports glob patterns
Example:
"bundlesize": [
{
"path": "./dist/vendor-*.js",
"maxSize": "3 kB"
},
{
"path": "./dist/chunk-*.js",
"maxSize": "3 kB"
}
]
This makes it great for using with applications that are bundled with another tool. It will match multiple files if necessary and create a new row for each file.
Currently works for Travis CI, CircleCI, Wercker, and Drone.
bundlesize
for status access, copy the token provided.BUNDLESIZE_GITHUB_TOKEN
as environment parameter in your CIs project settings.(Ask me for help if you're stuck)
example usage:
bundlesize -f "dist/*.js" -s 20kB
For more granular configuration, we recommend configuring it in the package.json
(documented above).
:star: this repo
This project exists thanks to all the people who contribute. [Contribute].
MIT © siddharthkp
FAQs
Keep your library size in check
The npm package @condenast/bundlesize receives a total of 18 weekly downloads. As such, @condenast/bundlesize popularity was classified as not popular.
We found that @condenast/bundlesize demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 233 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.