@getforma/core - npm Package Compare versions

Comparing version 0.8.1 to 0.8.2

package.json

 {
   "name": "@getforma/core",
   "author": "Forma <[e-mail]>",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Real DOM reactive library — fine-grained signals, islands architecture, SSR hydration. No virtual DOM, no diffing. ~15KB gzipped.",
@@ -6,0 +6,0 @@ "type": "module",

README.md

@@ -165,11 +165,36 @@ # FormaJS
 
-Both long and short filenames are provided. They are identical files — use whichever you prefer:
+### Script tag (IIFE — auto-initializes)
 
-| Build | URL |
-|-------|-----|
-| **Standard** (recommended) | `unpkg.com/@getforma/core/dist/formajs-runtime.global.js` |
-| Standard (short alias) | `unpkg.com/@getforma/core/dist/forma-runtime.js` |
-| **CSP-safe** (no `new Function`) | `unpkg.com/@getforma/core/dist/formajs-runtime-hardened.global.js` |
-| CSP-safe (short alias) | `unpkg.com/@getforma/core/dist/forma-runtime-csp.js` |
+```html
+<!-- unpkg -->
+<script src="https://unpkg.com/@getforma/core@0.8.1/dist/formajs-runtime.global.js"></script>
 
+<!-- jsDelivr (faster globally) -->
+<script src="https://cdn.jsdelivr.net/npm/@getforma/core@0.8.1/dist/formajs-runtime.global.js"></script>
+```
+
+### ESM import (no bundler, modern browsers)
+
+```html
+<script type="module">
+  import { createSignal, h, mount } from 'https://cdn.jsdelivr.net/npm/@getforma/core@0.8.1/dist/index.js';
+
+  const [count, setCount] = createSignal(0);
+  mount(() => h('button', { onClick: () => setCount(count() + 1) }, () => `${count()}`), '#app');
+</script>
+```
+
+### All CDN builds
+
+| Build | Filename |
+|-------|----------|
+| **Standard** (recommended) | `formajs-runtime.global.js` |
+| **CSP-safe** (no `new Function`) | `formajs-runtime-hardened.global.js` |
+| Standard (short alias) | `forma-runtime.js` |
+| CSP-safe (short alias) | `forma-runtime-csp.js` |
+
+Available from both `unpkg.com/@getforma/core@VERSION/dist/` and `cdn.jsdelivr.net/npm/@getforma/core@VERSION/dist/`.
+
+For production, always pin the version (e.g., `@0.8.1`). Unversioned URLs resolve to latest.
+
 > The CSP build uses a hand-written expression parser and never calls `new Function`.
@@ -176,0 +201,0 @@ > It supports most common patterns. See [examples/csp](./examples/csp) for a working demo.

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

3597655

0.95%

Number of lines in readme file

585

4.46%

No dependency changes