
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
@onflow/fcl-bundle
Advanced tools
FCL-Bundle is a module bundler used internally by FCL which aims to be low configuration and consistent across the monorepo. FCL-Bundle uses rollup and generates cjs, esm, and umd formats of the bundled modules.
Usage: fcl-bundle [options]
Options:
-V, --version output the version number
-w, --watch Run the build in watch mode
-h, --help display help for command
All of the configuration for FCL-Bundle currently takes place within the package.json of the modules which you wish to bundle. The following configuration options are available:
| Key | Required | Value Type | Description |
|---|---|---|---|
source | Yes | string | Specify a source file entry point or an dictionary of Output Configuration objects keyed by respective source files (for multiple builds) - see Source Configuration for more details |
main | No | string | Specify cjs bundle output path if not manually specified by Output Configuration (as well as cjs entry point if not overridden by package.exports) |
module | No | string | Specify esm bundle output path if not manually specified by Output Configuration (as well as esm entry point if not overriden by package.exports) |
unpkg | No | string | Specify umd bundle output path if not manually specified by Output Configuration (as well as umd entry point if not overriden by package.exports) |
Note: If output paths end in ".min.js", the resulting bundle will be minified
An Output Configuration object exists with the following properties:
| Key | Required | Value Type | Description |
|---|---|---|---|
cjs | No | string | Path of the cjs output bundle |
esm | No | string | Path of the esm output bundle |
umd | No | string | Path of the umd output bundle |
banner | No | string | Either a string representing a banner to be prepended to all output bundles for this build or a Banner Configuration object |
An empty Output Configuration will fallback to the default outputs if none are provided. However, if at least one output format is provided, the missing outputs will be excluded from the final build.
In practice, these Output Configuration objects will be consumed as shown in the Source Configuration below.
Note: If output paths end in ".min.js", the resulting bundle will be minified
A source configuration can be provided in one of three ways:
A string identifying the path to the entry source file. Build outputs will be inferred from either the root level main, module, and unpkg fields or from the default outputs if none are provided.
{
...
"source": "./src/index.js",
}
An array of entry source files. Build outputs will be inferred from the default outputs.
{
...
"source": [
"./src/indexA.js",
"./src/indexB.js"
]
}
A dictionary of Output Configuration objects keyed by respective source files.
{
...
"source": {
"./src/indexA.js": {
"cjs": "./dist/indexA.js"
},
"./src/indexB.js": {
"cjs": "./dist/indexB.js",
"esm": "./dist/indexB.module.js"
},
"./src/indexC.js": {
"cjs": "./dist/indexC.js",
"esm": "./dist/indexC.module.js",
"umd": "./dist/indexC.umd.js"
}
}
}
Note: if no output bundles (cjs,esm,umd) are specifified in either the root of package.json (main, module, unpkg) or an Output Configuration object, the bundler will produce the following defaults:
cjs -> dist/${basename(entry)}.jsesm -> dist/${basename(entry)}.module.jsumd -> dist/${basename(entry)}.umd.js| Key | Required | Value Type | Description |
|---|---|---|---|
banner | Yes | string | Text to be displayed in banner |
raw | No | boolean | If false, wraps the banner in JS comment, if true no extra formatting is applied to banner (default false) |
PACKAGE_CURRENT_VERSION in bundled code with the current version of the package being bundled from package.json@babel/preset-env and babel rollup pluginpostcss.config.js in the root of the package@rollup/plugin-image plugin as base64 stringsterser if output paths end in ".min.js".ts fileFAQs
FCL Bundler Tool
The npm package @onflow/fcl-bundle receives a total of 16 weekly downloads. As such, @onflow/fcl-bundle popularity was classified as not popular.
We found that @onflow/fcl-bundle demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.