Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
@sparkbox/cachebust
Advanced tools
Straight forward asset fingerprinting "cachebuster" for production applications.
Requires Node 8.5.0 or higher.
Installing
npm install @sparkbox/cachebust
The recommended way to use cachebust
is to either add your
input data in package.json
or in a .cachebust.config
file (see config).
cachebust
: will create your fingerprinted assests & update fingerprinted "source file" names inside the
target "template file(s)" as specified in the package.json file or the .cachebust.config file.
If you need to restore your template files, you can run: cachebust --restore
Globbing is allowed for target
files. So "target": ["path/to/target/**/*.html"]
is allowed.
Create a key in your package.json
file at the root level, with source/target keys.
For example:
{
...
"cachebust": {
"source": [
"path/to/source/css/style.css",
"path/to/source/js/script.js"
],
"target": [
"path/to/target/template.html"
]
}
...
}
Also you may create a config file in the root of the project directory called .cachebust.config
This will be a JSON object like the following:
{
"cachebust": {
"source": [
"path/to/source/css/style.css",
"path/to/source/js/script.js"
],
"target": [
"path/to/target/**/*.html"
]
}
}
cachebust allows you to directly specify the source and the target you'll need to pass in a comma seperated list for example:
cachebust -s path/to/source/css/style.css,path/to/source/js/script.js -t path/to/target/template.html
Note Direct input will override the config and package json cacehebust paramaters.
This will fingerprint the following files:
- path/to/source/css/style.css
- path/to/source/js/script.js
This will then update your template "target" file with the updated filenames:
- path/to/target/template.html
To restore these you'll have to again pass the target and source files:
cachebust -r -s path/to/source/css/style.css,path/to/source/js/script.js -t path/to/target/template.html
** WARNING ** If run this without a backup, it is descructive. It will not backup your files.
Added a -n
or --no-backup
option to cachebust, this will no generate a manifest file. See https://github.com/sparkbox/cachebust/issues/9
In some cases this is desired, say on a build server, or in a git versioned repo, there is no reason to keep a manifest since each deploys a copy of the original is retained from the source control.
You can run cachebust --help
for more options.
-V, --version output the version number
-s, --source [files] source file(s) to be fingerprinted; comma seperated file list
-t, --target [files] target file(s), template files that need the fingerprinted asset file names; comma seperated file list
-r, --restore copies the backup file(s) back to the original; backup file(s) are removed.
-q, --quiet', All normal output is surpressed. Some errors will still be generated.
-n, --no-backup Warning: this will not generate the manifest file. This is only to be used on PRODUCTION servers or under version control. This is descructive!
-h, --help output usage information
Ensure that the file lists for -s
or --source
and -t
and --target
are comma seperated.
-s dir/path/file.ext,dir/otherpath/otherfile.ext
etc.
You can pass in one file (no comma, or mutliple files for both source and target).
You may also specify a single file, without a comma.
The MIT License (MIT)
FAQs
A simple cache buster
The npm package @sparkbox/cachebust receives a total of 13 weekly downloads. As such, @sparkbox/cachebust popularity was classified as not popular.
We found that @sparkbox/cachebust demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.