
Security News
minimatch Patches 3 High-Severity ReDoS Vulnerabilities
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.
[ WEBSITE | ISSUES | FORUM | CHANGELOG ]
Lezer ("reader" in Dutch, pronounced pretty much as laser) is an incremental GLR parser intended for use in an editor or similar system, which needs to keep a representation of the program current during changes and in the face of syntax errors.
It prioritizes speed and compactness (both of parser table files and of syntax tree) over having a highly usable parse tree—trees nodes are just blobs with a start, end, tag, and set of child nodes, with no further labeling of child nodes or extra metadata.
This package contains the run-time LR parser library. It consumes parsers generated by @lezer/generator.
The parser programming interface is documented on the website.
The code is licensed under an MIT license.
This project was hugely inspired by tree-sitter.
Nearley is a fast, feature-rich parser toolkit for JavaScript. It allows you to define grammars in a flexible way and can handle complex parsing tasks. Compared to @lezer/lr, Nearley is more feature-rich but may be less performant for certain tasks.
PEG.js is a simple parser generator for JavaScript based on parsing expression grammars (PEGs). It is easy to use and integrates well with JavaScript projects. Compared to @lezer/lr, PEG.js is simpler but may not offer the same level of performance and flexibility.
ANTLR (Another Tool for Language Recognition) is a powerful parser generator for reading, processing, executing, or translating structured text or binary files. It is widely used and supports multiple languages. Compared to @lezer/lr, ANTLR4 is more powerful and versatile but has a steeper learning curve.
FAQs
Incremental parser
The npm package @lezer/lr receives a total of 4,392,304 weekly downloads. As such, @lezer/lr popularity was classified as popular.
We found that @lezer/lr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.

Research
/Security News
Socket uncovered 26 malicious npm packages tied to North Korea's Contagious Interview campaign, retrieving a live 9-module infostealer and RAT from the adversary's C2.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.