
Security News
Critical Security Vulnerability in React Server Components
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.
@department-of-veterans-affairs/generator-vets-website
Advanced tools
Generate a React app for vets-website
Yeoman generator for applications on VA.gov
The generator is already installed as a devDependency of vets-website.
If you're working on this generator itself, you'll need to link it locally to test your changes.
From the root of this repo (generator-vets-website):
nvm use # from .nvmrc
npm install
npm link # Creates a global symlink to this local package
From the root of vets-website:
npm link @department-of-veterans-affairs/generator-vets-website
This tells vets-website to use your local development version instead of the published npm version.
# From vets-website root:
yarn new:app
Any changes to the generator will be automatically included due to the npm link.
# From generator-vets-website root:
npm test
Note that these tests only cover non-interactive mode
You should also manually test yarn new:app in vets-website.
# From vets-website root:
npm unlink --no-save @department-of-veterans-affairs/generator-vets-website
# From generator-vets-website root:
npm unlink
The generator supports two modes of operation:
# From vets-website directory
yarn run new:app
The generator will guide you through all required information with helpful prompts and validation.
To preview what files would be generated without actually creating them:
yo @department-of-veterans-affairs/vets-website \
--dry-run-interactive \
--appName="My App" \
--folderName="my-app" \
--entryName="my-app" \
--rootUrl="/my-app" \
--isForm=true
This mode:
Provide all arguments upfront to skip prompts entirely. Note: CLI mode requires explicit values for most fields since it cannot rely on interactive prompts or defaults:
# From vets-website directory
yo @department-of-veterans-affairs/vets-website \
--force \
--appName="My App" \
--folderName="my-app" \
--entryName="my-app" \
--rootUrl="/my-app" \
--isForm=true \
--slackGroup="@my-group" \
--contentLoc="../vagov-content" \
--formNumber="21P-530" \
--trackingPrefix="burials-530-" \
--respondentBurden="30" \
--ombNumber="2900-0797" \
--expirationDate="12/31/2026" \
--benefitDescription="burial benefits" \
--usesVetsJsonSchema=false \
--usesMinimalHeader=true \
--addToMyVaSip=true \
--templateType="WITH_1_PAGE"
Use --force option to automatically overwrite existing files without prompting.
To preview what files would be generated without creating them, using predefined arguments. This mode requires all necessary CLI arguments since it cannot prompt for missing values:
yo @department-of-veterans-affairs/vets-website \
--dry-run-non-interactive \
--appName="My App" \
--folderName="my-app" \
--entryName="my-app" \
--rootUrl="/my-app" \
--isForm=true \
--slackGroup="@my-group" \
--contentLoc="../vagov-content" \
--formNumber="21P-530" \
--trackingPrefix="burials-530-" \
--respondentBurden="30" \
--ombNumber="2900-0797" \
--expirationDate="12/31/2026" \
--benefitDescription="burial benefits" \
--usesVetsJsonSchema=false \
--usesMinimalHeader=true \
--addToMyVaSip=true \
--templateType="WITH_1_PAGE"
This mode:
--force option to automatically overwrite existing files without prompting.These resources are also provided by the generator at startup.
For specifics on writing a generator, refer to the official Yeoman documentation.
When you're ready to publish a new version of the generator to npm:
Ensure you're logged in to npm:
npm login
You'll need to be added as a maintainer of the @department-of-veterans-affairs/generator-vets-website package.
Update the version number:
npm version patch # for bug fixes (3.14.1 → 3.14.2)
npm version minor # for new features (3.14.1 → 3.15.0)
npm version major # for breaking changes (3.14.1 → 4.0.0)
This will update package.json and create a git tag.
Run pre-publish checks:
npm run prepublishOnly
This runs npm run prepublishOnly to check for security vulnerabilities.
Publish to npm:
npm publish
If you need to add a new prompt to the generator, follow these steps:
Add your new field to the field definitions in lib/prompts.js:
const fieldDefinitions = {
// ... existing fields
myNewField: {
type: 'input',
message: 'What is your new field value?',
validate: (input) => {
if (!input || input.trim() === '') {
return 'This field is required.';
}
return true;
},
filter: (input) => input.trim(),
},
};
Include your field in the appropriate field group(s):
const fieldGroups = {
core: ['appName', 'folderName', 'entryName', 'rootUrl', 'isForm', 'myNewField'],
form: ['formNumber', 'ombNumber', 'expirationDate', 'myNewField'],
// ... other groups
};
If the field should be available as a CLI argument, add validation in lib/cli-validation.js:
function validateMyNewField(value) {
if (!value) {
return 'myNewField is required';
}
// Add specific validation logic
return null; // Return null if valid, error string if invalid
}
Use the new field in your templates with EJS syntax:
<!-- In any .ejs template file -->
<div>My new field value: <%= myNewField %></div>
If you want the field to be available as a command-line argument, add it to the options in generators/app/index.js:
// This is typically handled automatically by the field definitions,
// but you may need to add custom logic for complex fields
This generator currently requires Node.js 14.15.0 to maintain compatibility with consumer environments that may not have upgraded to newer Node.js versions yet. The generator uses:
yeoman-generator@^5.6.1 (CommonJS, Node 12+ compatible)Why we can't migrate to Node 22 immediately:
Consumer Compatibility: When users run yo @department-of-veterans-affairs/vets-website, they execute our generator directly in their Node.js environment. If we upgrade to Node 22, all consumers must also upgrade.
Yeoman Generator Dependencies:
yeoman-generator@7.x+ requires Node 18.17+ and is ESM-onlyyeoman-environment@4.x+ also requires Node 18+ and is ESM-onlyBreaking Changes: The migration would require:
require() → import)FAQs
Generate a React app for vets-website
We found that @department-of-veterans-affairs/generator-vets-website demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 19 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated “elf-*” npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.

Security News
TypeScript 6.0 will be the last JavaScript-based major release, as the project shifts to the TypeScript 7 native toolchain with major build speedups.