Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
@quartz/teams
Advanced tools
This repo contains team information and metadata to assist in building integrations, e.g., a Slack bot.
const { dev } = require( '@quartz/teams' );
const janesSlackUserId = dev
.find( user => 'jane' === user.githubUsername )
.slackUserId;
This repo is published as a scoped NPM module: @quartz/teams
When you make updates to NPM modules, you will need to update the version of the package, publish it, then update the dependency in projects that use it.
You probably want to do steps 1-3 and include step 4 in your pull request.
Make sure you have an NPM account and it has been added to the
@quartz
organization.
Log in to NPM: npm login
Update the package version:
cd /path/to/my-package
npm version [patch|minor|major]
Commit the version change.
Make sure everything is correct! There is no undo!
Publish the new version: npm publish
Update the dependency in projects that use the package, e.g.:
cd /path/to/my-project-that-uses-my-package
npm update --save-dev my-package@1.0.1
FAQs
Team composition and metadata for integrations
The npm package @quartz/teams receives a total of 9 weekly downloads. As such, @quartz/teams popularity was classified as not popular.
We found that @quartz/teams demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.