
Product
Introducing GitHub Actions Scanning Support
Detect malware, unsafe data flows, and license issues in GitHub Actions with Socket’s new workflow scanning support.
MDN's next fr(ont)e(n)d.
.env-dist to .env and updatenpm installnpm run startnpm run start
NODE_ENV=production to run rari with the preview server, you'll need to have run npm run build firstnode --env-file=.env --run rari -- serve
npm run dev and npm run previewnpm run dev
npm run build
npm run preview to worknpm run preview
If you want to access fred from a different machine, you'll need to run with certain options:
HTTPS=true to enable HTTPS with a self-signed certificate, allowing Web APIs requiring a secure context to workORIGIN_MAIN=your.local.ip.address to allowlist your address in the playgroundSo a full command might look like:
HTTPS=true ORIGIN_MAIN=192.168.0.99 npm run start
This is useful to test changes on mobile, tablets and other platforms.
See the environment variables README.
We need to run some JS as soon as possible at page load, to avoid layout shifts and flashes.
We place this JS in entry.inline.js, and it's inlined on page load.
Rspack also generates the necessary CSP hash when doing a prod build with npm run build.
If this code is component-specific, it can be imported with ?source&csp=true and used to set the value of static inlineScript in a Server Component.
Remember to add an additional entry to the CSP hashes in yari when doing so.
We support a range of non-standard imports in our JavaScript. This includes:
?sourceImports the raw source of the file as a string.
import text from "./some-file.txt?source";
&csp=trueLogs a CSP hash for the source of the file during the production build.
Most commonly used alongside ?source to import the source of a file for inlining in a component, which needs to be allowlisted in our CSP:
import inlineScript from "./inline.js?source&csp=true`;
See the layout README.
We have a basic sandbox for testing and styling components in isolation at http://localhost:3000/sandbox
To add a component to the sandbox, add a sandbox.js file to the component, which exports a class named like MyComponentSandbox which extends the SandboxComponent exported from components/sandbox/class.js.
components/ folder, with reserved names which cause certain behavior, explained further below:
component-name/
global.css - (reserved): automatically added to global styleselement.js - (reserved): custom element, automatically imported client side, always imported server sideelement.css - (recommended): styles for custom element's shadow domserver.js - (reserved): server component, will automatically load the adjacent server.css file when usedserver.css - (reserved): automatically added to page styles when its server component is used in that pageglobal.css: components which have CSS which should be loaded on all pages should expose that through a global.css file:
mdn-component-name { display: block; } or similarelement.js: custom elements should be defined in components/component-name/element.js
MDNComponentName
HTMLElement class names, and added to ACRONYMS in build/plugins/generate-element-map.js to allow the correct types to be generatedmdn-component-nameimport()types/element-map.d.ts to provide proper types in e.g. querySelector("mdn-component-name")server.js: server components should be defined in components/component-name/server.js
ServerComponent from components/server/index.js, and be named ComponentNameserver.css: server component styles should be placed in components/component-name/server.css
ServerComponent is used
// @ts-expect-error so we get an error when we fix the error and don't leave unnecessary // @ts-ignore comments lying around. While we're in active development these can lack a comment, but eventually we'll require an explanatory comment on each.If our server side rendered custom elements are different to the initial state of our custom elements when rendered client side, Lit will error out during hydration, stopping the execution of our client side JS.
To avoid this, don't compute things that are server/client dependent in connectedCallback (or run functions which do this). Instead you must run these in firstUpdated (despite the warning lit will raise in development about the element scheduling an update after an update completed).
This issue is tracked upstream: https://github.com/lit/lit/issues/1434
FAQs
MDN's next fr(ont)e(n)d.
The npm package @mdn/fred receives a total of 2,636 weekly downloads. As such, @mdn/fred popularity was classified as popular.
We found that @mdn/fred demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Detect malware, unsafe data flows, and license issues in GitHub Actions with Socket’s new workflow scanning support.

Product
Add real-time Socket webhook events to your workflows to automatically receive pull request scan results and security alerts in real time.

Research
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.