@getforma/core - npm Package Compare versions

Comparing version 1.0.3 to 1.0.4

package.json

 {
   "name": "@getforma/core",
   "author": "Forma <[e-mail]>",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Real DOM reactive library — fine-grained signals, islands architecture, SSR hydration. No virtual DOM, no diffing. ~15KB gzipped.",
@@ -141,8 +141,27 @@ "type": "module",
     "no-vdom",
+    "no-virtual-dom",
     "tc39-signals",
-    "preact-signals",
+    "alien-signals",
     "lightweight",
     "typescript",
+    "jsx",
     "hyperscript",
-    "state-management"
+    "state-management",
+    "islands",
+    "islands-architecture",
+    "hydration",
+    "ssr",
+    "server-side-rendering",
+    "csp",
+    "csp-safe",
+    "content-security-policy",
+    "declarative",
+    "data-attributes",
+    "alpine-alternative",
+    "solidjs-alternative",
+    "rust-ssr",
+    "web-components",
+    "progressive-enhancement",
+    "zero-build",
+    "cdn"
   ],
@@ -149,0 +168,0 @@ "license": "MIT",

README.md

@@ -815,15 +815,25 @@ # FormaJS
 
-## Ecosystem
+## Part of the Forma Stack
 
-FormaJS is the reactive frontend layer of a full-stack Rust + TypeScript framework.
+### Frontend (TypeScript)
 
-| Package | Language | Description |
-|---|---|---|
-| [@getforma/core](https://www.npmjs.com/package/@getforma/core) | TypeScript | This library — reactive DOM, signals, islands, SSR hydration |
-| [@getforma/compiler](https://github.com/getforma-dev/forma-tools) | TypeScript | TypeScript-to-FMIR compiler, Vite plugin, esbuild SSR plugin |
-| [@getforma/build](https://github.com/getforma-dev/forma-tools) | TypeScript | esbuild pipeline with content hashing, compression, manifest |
-| [@getforma/create-app](https://github.com/getforma-dev/create-forma-app) | TypeScript | `npx @getforma/create-app` — scaffold a new Forma project |
-| [forma-ir](https://crates.io/crates/forma-ir) | Rust | FMIR binary format: parser, walker, WASM exports |
-| [forma-server](https://crates.io/crates/forma-server) | Rust | Axum middleware for SSR, asset serving, CSP |
+| Package | Description |
+|---|---|
+| [@getforma/core](https://www.npmjs.com/package/@getforma/core) | **This library** — reactive DOM, signals, islands, SSR hydration |
+| [@getforma/compiler](https://www.npmjs.com/package/@getforma/compiler) | Vite plugin — h() optimization, server function transforms, FMIR emission |
+| [@getforma/build](https://www.npmjs.com/package/@getforma/build) | Production pipeline — esbuild bundling, content hashing, compression, manifest |
 
+### Backend (Rust)
+
+| Package | Description |
+|---|---|
+| [forma-ir](https://crates.io/crates/forma-ir) | FMIR binary format — parser, walker, WASM exports |
+| [forma-server](https://crates.io/crates/forma-server) | Axum middleware — SSR page rendering, asset serving, CSP headers |
+
+### Full Framework
+
+| Package | Description |
+|---|---|
+| [@getforma/create-app](https://github.com/getforma-dev/create-forma-app) | `npx @getforma/create-app` — scaffolds a Rust server + TypeScript frontend project |
+
 ---
@@ -830,0 +840,0 @@

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

3907919

0.01%

Number of lines in readme file

843

1.2%

No dependency changes