Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
@new-black/lyra
Advanced tools
Note: This package is currently under development and should not be used in a production environment.
Lyra is a comprehensive design system aimed at providing consistent and reusable components, styles, and guidelines for building user interfaces. It is designed to streamline the UI development process and ensure a cohesive visual and interactive experience across all projects.
npm i @new-black/lyra
or
yarn add @new-black/lyra
// tailwind.config.ts
import { lyraPreset } from "@new-black/lyra";
export default {
content: [
...,
"./node_modules/@new-black/lyra/dist/**/*.{js,ts,jsx,tsx,mdx}",
]
presets: [lyraPreset],
...
} satisfies Config;
/** index.css */
@tailwind base;
@tailwind components;
@tailwind utilities;
@layer base {
/* Add your fonts there */
@font-face {
font-family: "Inter";
src: url("/fonts/inter-regular.ttf") format("truetype");
font-weight: 400;
}
/* set global styling */
* {
-webkit-font-smoothing: antialiased;
}
}
For the icons used in Lyra we use an SVG sprite. To copy the SVG sprite to your public folder, execute the following command in your terminal:
cp -r node_modules/@new-black/lyra/dist/icons public
<link rel="prefetch" href="/icons/icon-defs.svg" as="image" type="image/svg+xml" />
SVG sprites are a convenient way to use icons in web development. Here's why they are nice to use:
Overall, SVG sprites offer a lightweight, flexible, and performant solution for incorporating icons into web projects.
// Some root component
import { Provider } from "@new-black/lyra";
import "./index.css";
import "@new-black/lyra/dist/style.css";
export const Root = () => {
return (
<Provider locale="en">
<App />
</Provider>
);
};
Once installed, you can import Lyra components and styles into your project:
import { Button, Accordion } from "@new-black/lyra";
Check out the documentation (not yet available) for a detailed guide on using and customizing Lyra.
This package uses semantic-release for automated versioning and publishing. The release process differs based on the branch:
Pushes to main
trigger releases of stable versions to npm under the latest
tag. These are production-ready releases following semantic versioning (e.g., 1.0.0, 1.1.0, etc.).
Pushes to develop
create pre-releases under the next
tag on npm. These versions are suffixed with -next.X
(e.g., 1.0.0-next.1). Install pre-releases using:
npm install @new-black/lyra@next
We follow the Conventional Commits specification for commit messages to determine version bumps:
fix:
- Patches (0.0.X)
fix: button hover state color
fix(button): hover state color
feat:
- Minor releases (0.X.0)
feat: add new toast component
feat(toast): add new component
Other common types are: build, chore, ci, docs, style, refactor, perf, test
Common scopes in this project include component names (button
, modal
, toast
), systems (theme
, icons
), or areas (docs
, build
).
Tests are written using Playwright Test for both component and end-to-end testing. To run the tests:
# Run all tests
npm run test
# Run tests in UI mode for debugging
npm run test:ui
# Run tests with debug inspector
npm run test:debug
We use Playwright's snapshot testing for visual regression tests. When writing tests that check component appearance:
test("component visual test", async ({ mount }) => {
const component = await mount(<MyComponent />);
await expect(component).toHaveScreenshot(); // you could add a filename inside the function
});
When you make intentional changes to component visuals or add new visual tests, you'll need to update the snapshot references. You can force a new screenshot update for specific test files by commenting on a pull request with the following command:
/force-update-screenshot
tests/my-component.spec.ts
tests/another-component.spec.ts
Take note that you need to add a code block (three backticks) around the files to be tested.
This command will trigger the CI to update the snapshots for the specified test files.
Tests run automatically on GitHub Actions:
The CI pipeline:
When tests fail in CI:
For local debugging:
# Run with UI mode
npm run test:ui
# Run with debug inspector
npm run test:debug
# Run specific test file
npx playwright test tests/components/my-component.spec.ts
FAQs
Stylable design system based on tailwind and react-aria.
The npm package @new-black/lyra receives a total of 228 weekly downloads. As such, @new-black/lyra popularity was classified as not popular.
We found that @new-black/lyra demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.