
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
@lerna/init
Advanced tools
Create a new Lerna repo or upgrade an existing repo to the current version of Lerna
lerna init
Create a new Lerna repo or upgrade an existing repo to the current version of Lerna
Install lerna for access to the lerna
CLI.
$ lerna init
Create a new Lerna repo or upgrade an existing repo to the current version of Lerna.
Lerna assumes the repo has already been initialized with
git init
.
When run, this command will:
lerna
as a devDependency
in package.json
if it doesn't already exist.lerna.json
config file to store the version
number..gitignore
file if one doesn't already exist.Example output on a new git repo:
$ lerna init
lerna info version v2.0.0
lerna info Updating package.json
lerna info Creating lerna.json
lerna success Initialized Lerna files
--independent
$ lerna init --independent
This flag tells Lerna to use independent versioning mode.
--exact
$ lerna init --exact
By default, lerna init
will use a caret range when adding or updating
the local version of lerna
, just like npm install --save-dev lerna
.
To retain the lerna
1.x behavior of "exact" comparison, pass this flag.
It will configure lerna.json
to enforce exact match for all subsequent executions.
{
"command": {
"init": {
"exact": true
}
},
"version": "0.0.0"
}
FAQs
Create a new Lerna repo or upgrade an existing repo to the current version of Lerna
The npm package @lerna/init receives a total of 362,847 weekly downloads. As such, @lerna/init popularity was classified as popular.
We found that @lerna/init demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.