
Security News
Rust RFC Proposes a Security Tab on crates.io for RustSec Advisories
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.
@embroider/addon-dev
Advanced tools
Utilities for working on v2 addons.
For a guide on porting a V1 addon to V2, see https://github.com/embroider-build/embroider/blob/main/docs/porting-addons-to-v2.md
@embroider/addon-dev/rollup exports utilities for building addons with rollup. To use them:
Add the following devDependencies to your addon:
Copy the ./sample-rollup.config.js in this repo to your own rollup.config.js.
Copy the ./sample-babel.config.json in this repo to your own babel.config.json.
The addon-dev command helps with common tasks in v2 addons.
devDependencies from an embedded test application out into
your addon's actual package.json(You can avoid the need for both of these if you keep your addon and its test app as separate packages in a monorepo instead.)
See the top-level CONTRIBUTING.md in this monorepo.
This project is licensed under the MIT License.
FAQs
Utilities for addon authors
The npm package @embroider/addon-dev receives a total of 19,657 weekly downloads. As such, @embroider/addon-dev popularity was classified as popular.
We found that @embroider/addon-dev demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.

Security News
/Research
Socket found a Rust typosquat (finch-rust) that loads sha-rust to steal credentials, using impersonation and an unpinned dependency to auto-deliver updates.

Research
/Security Fundamentals
A pair of typosquatted Go packages posing as Google’s UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.