
Security News
The Next Open Source Security Race: Triage at Machine Speed
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
@guardian/bridget
Advanced tools
This repo contains the thrift definitions defining the API between native layers (iOS, Android) and [Webview](https://github.com/guardian/dotcom-rendering).
This repo contains the thrift definitions defining the API between native layers (iOS, Android) and Webview.
The repo is also responsible for generating and publishing packages to be used by iOS, Android and the Webview.
native.thrift are the functions to be implemented by iOS and Android. The webview will be able to call these functions with the specified arguments.
The Swift and TypeScript packages are generated and published using this GitHub action.
For Android, Java interfaces for Bridget services are generated at build time in the Bridget module.
native.thrift if it needs to be implemented in Swift & Kotlinnpx changeset to create a changeset file describing your changes and the version bump typeBridget is released by the release.yml GitHub Action. The repository uses:
npm trusted publishing: No NPM_TOKEN needed. Publishing to npm is authenticated via GitHub's OIDC token. See npm's trusted publishing docs for more information.
GitHub App authentication: The workflow uses a GitHub App to publish Swift and Android packages. This requires:
APP_ID (repository variable)GH_APP_PRIVATE_KEY (repository secret)The GitHub App needs read/write permissions for the guardian/bridget-swift and guardian/bridget-android repositories.
You can use prereleases to test a new version of the models across web, Android and iOS without making a full release.
To do this, create a new prerelease in the GitHub releases UI (or click here). The tag is used as the version. For example, once the prerelease workflow has finished running for a prerelease created with tag v0.0.0-2024-02-16:
npm: npm install @guardian/bridget@v0.0.0-2024-02-16swift package: https://github.com/guardian/bridget-swift/tree/v0.0.0-2024-02-16android package: https://github.com/guardian/bridget-android/tree/v0.0.0-2024-02-16Note: The prerelease workflow is part of the same release.yml workflow file and also uses npm trusted publishing.
This is likely caused by an issue with the GitHub App credentials. To fix this:
GH_APP_PRIVATE_KEY repository secret is valid and hasn't expiredAPP_ID repository variable is correctNote: updating secrets and variables requires admin permissions on the repository.
Versions are managed by Changesets. When you make changes that require a version bump:
npx changeset in your local repository.changeset/) with your pull requestWhen your PR is merged to main, the Changesets GitHub Action will:
For more information, see the Changesets documentation.
The name Bridget was chosen out of a list of a dozen suggestions, containing mostly bridge related puns.
FAQs
This repo contains the thrift definitions defining the API between native layers (iOS, Android) and [Webview](https://github.com/guardian/dotcom-rendering).
The npm package @guardian/bridget receives a total of 395 weekly downloads. As such, @guardian/bridget popularity was classified as not popular.
We found that @guardian/bridget demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.