
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@jupyter/builder
Advanced tools
Build tools for JupyterLab (and remixes)
[!NOTE] This started by the extraction of the builder tools included in the core JupyterLab during a GSoC project. See below for more information.
Execute the following command in a terminal:
pip install jupyter_builder
build : Builds the Jupyter extension JavaScript assets to be consumed by the Jupyter app.
jupyter-builder build <path to extension folder>
develop : Install the Jupyter extension JavaScript assets in dev mode for consumption in the Jupyter app. It similar to editable install mode of pip
jupyter-builder develop --overwrite <path to extension folder>
watch : Automatically rebuild the development JavaScript assets when one file is changed to ease development.
jupyter-builder watch <path to extension folder>
jlpmExecute the following command in a terminal:
pip uninstall jupyter_builder
Written by @cronan03 - GSoC Contributor 2024
The goals of this project are:
develop, build and watch mentioned above.Pytest to ensure the processes run efficiently on any OS.jlpm and jupyterlab.semver to the package.@jupyterlab/builder within this package and make it generic.
For now the code lives there: https://github.com/jupyterlab/jupyterlab/tree/main/builderdevelop feature which is responsible for installing the Jupyter extension JS assets in dev mode.BaseExtensionApp present heresubprocess.check_call. Optional parameters allow for customization of the build process, including logging, development mode, and source map generation.build feature which is responsible for creating the Javascript assets which will be consumed by the Jupyter App.static/style.js in <extension_folder>/myextension/labextension.Pytest to check for the existence of files mentioned above on running the build command.watch feature on running will rebuild the JS assets on being triggered. This happens on changing contents in <extension_folder>/src/index.tsindex.ts triggering watch. This replaces old JS assets with new ones having different hash values in the file names. We create 2 vectors of filenames before and after triggering watch which will tell us if it actually worked.jlpm to this package.watch feature was tricky as I had to carefully adjust sleep times to make sure the function was running before a change in <extension_folder>/src/index.ts was made. Otherwise the change happened before watch ran and never triggered it.FAQs
Jupyter build tools.
We found that @jupyter/builder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.