Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
@onflow/fcl-bundle
Advanced tools
FCL-Bundle is a module bundler used internally by FCL which aims to be low configuration and consistent across the monorepo. FCL-Bundle uses rollup and generates cjs, esm, and umd formats of the bundled modules.
Usage: fcl-bundle [options]
Options:
-V, --version output the version number
-w, --watch Run the build in watch mode
-h, --help display help for command
All of the configuration for FCL-Bundle currently takes place within the package.json
of the modules which you wish to bundle. The following configuration options are available:
Key | Required | Value Type | Description |
---|---|---|---|
source | Yes | string | Specify a source file entry point or an dictionary of Output Configuration objects keyed by respective source files (for multiple builds) - see Source Configuration for more details |
main | No | string | Specify cjs bundle output path if not manually specified by Output Configuration (as well as cjs entry point if not overridden by package.exports ) |
module | No | string | Specify esm bundle output path if not manually specified by Output Configuration (as well as esm entry point if not overriden by package.exports ) |
unpkg | No | string | Specify umd bundle output path if not manually specified by Output Configuration (as well as umd entry point if not overriden by package.exports ) |
Note: If output paths end in ".min.js", the resulting bundle will be minified
An Output Configuration object exists with the following properties:
Key | Required | Value Type | Description |
---|---|---|---|
cjs | No | string | Path of the cjs output bundle |
esm | No | string | Path of the esm output bundle |
umd | No | string | Path of the umd output bundle |
banner | No | string | Either a string representing a banner to be prepended to all output bundles for this build or a Banner Configuration object |
An empty Output Configuration will fallback to the default outputs if none are provided. However, if at least one output format is provided, the missing outputs will be excluded from the final build.
In practice, these Output Configuration objects will be consumed as shown in the Source Configuration below.
Note: If output paths end in ".min.js", the resulting bundle will be minified
A source configuration can be provided in one of three ways:
A string
identifying the path to the entry source file. Build outputs will be inferred from either the root level main
, module
, and unpkg
fields or from the default outputs if none are provided.
{
...
"source": "./src/index.js",
}
An array of entry source files. Build outputs will be inferred from the default outputs.
{
...
"source": [
"./src/indexA.js",
"./src/indexB.js"
]
}
A dictionary of Output Configuration objects keyed by respective source files.
{
...
"source": {
"./src/indexA.js": {
"cjs": "./dist/indexA.js"
},
"./src/indexB.js": {
"cjs": "./dist/indexB.js",
"esm": "./dist/indexB.module.js"
},
"./src/indexC.js": {
"cjs": "./dist/indexC.js",
"esm": "./dist/indexC.module.js",
"umd": "./dist/indexC.umd.js"
}
}
}
Note: if no output bundles (cjs,esm,umd) are specifified in either the root of package.json (main
, module
, unpkg
) or an Output Configuration object, the bundler will produce the following defaults:
cjs
-> dist/${basename(entry)}.js
esm
-> dist/${basename(entry)}.module.js
umd
-> dist/${basename(entry)}.umd.js
Key | Required | Value Type | Description |
---|---|---|---|
banner | Yes | string | Text to be displayed in banner |
raw | No | boolean | If false, wraps the banner in JS comment, if true no extra formatting is applied to banner (default false) |
PACKAGE_CURRENT_VERSION
in bundled code with the current version
of the package being bundled from package.json
@babel/preset-env
and babel rollup pluginpostcss.config.js
in the root of the package@rollup/plugin-image
plugin as base64 stringsterser
if output paths end in ".min.js".ts
fileFAQs
FCL Bundler Tool
We found that @onflow/fcl-bundle demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.