
Security News
Critical Security Vulnerability in React Server Components
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.
@sproutsocial/racine
Advanced tools
Install Racine using npm or yarn:
$ yarn add @sproutsocial/racine react styled-components
# or
$ npm install @sproutsocial/racine react styled-components
You may also require specific peer dependencies when starting a new project or sandbox environment:
@sproutsocial/seeds-border
@sproutsocial/seeds-color
@sproutsocial/seeds-depth
@sproutsocial/seeds-motion
@sproutsocial/seeds-networkcolor
@sproutsocial/seeds-space
@sproutsocial/seeds-typography
moment
prop-types
react
react-dates
styled-components
Then, wrap your app's React root in Racine's ThemeProvider component:
import { ThemeProvider } from "@sproutsocial/racine";
const App = (props) => (
<ThemeProvider>
<div>your app here</div>
</ThemeProvider>
);
Racine uses Storybook for local development. Please refer to the root README for more information on getting started before continuing.
Spin up a draft PR immediately for two reasons:
Note: the snapshot will post as a comment on the PR once it has been generated.
Racine is documented on the Seeds reference site
Racine uses Storybook as a local development environment, and for running tests against components. Every component has a .stories.js file where developers can write "stories" to test components in isolation. Running yarn storybook will open the Racine Storybook in your browser so that you can see changes live as you make them. You can read more about writing stories on the Storybook website.
Contributions to Racine are welcomed from any member of the wider Sprout org. Whether you're adding a new component or simply fixing a bug, every improvement to the library is future leverage for our peers, our product, and our customers.
When writing code for Racine, please refer to the code-guidelines.mdx story in Storybook.
There are a few ways to get involved:
Racine's file structure is set up like this:
codemods - For major updates to Racine that have breaking changes, codemods are included for automatically handling component API updates. Codemods are also discovered from other @sproutsocial/seeds-react-* packages automatically.src
ComponentName - Deprecated components that won't get added to the monorepo have a folder within the src directory.Most components in Racine are exported at the root from their own packages. Each package typically structures its files similarly to how they appeared in Racine:
src
index.js - This file should contain all necessary exports for the component.index.stories.js - Storybook stories can be written here.index.test.js - All component tests live inside this file.styles.js - Any style-specific components live here.And you can interact with Racine via the command line with these commands:
yarn start - This will watch the Racine package for changes, and also run Storybook locally so that you can see your changes as you go.yarn change - This command will generate a changeset file that is used to document changes to the Racine package. If you are making a PR to Racine that should result in a version bump to the package, you will need to run this command to add a changeset. You can learn more about this command in step 3.yarn build - Generate production builds for the Racine package.yarn test - Run Racine's test suite. Note: yarn start must be run before yarn test to build generated files and directoriesyarn clean - Delete all generated files and directories.yarn release - This will trigger the release process for creating a new version of the Racine package on npm. Only Racine administrators can perform the release process.Codemods are automated scripts that help migrate code when component APIs change. They're available via the racine-codemod CLI tool and are automatically discovered from both racine and other @sproutsocial/seeds-react-* packages.
List available codemods:
racine-codemod
View codemod documentation:
racine-codemod <codemod-name>
Run a codemod:
racine-codemod <codemod-name> <path-to-files>
Example:
racine-codemod badge-1.x-to-2.x src --parser=tsx --quote=double
After running a codemod, you should run Prettier to fix any formatting issues:
yarn format
For more information on codemods, see the migration documentation on the Seeds reference site.
Cut a feature branch off main and start coding! As updates are merged into main by other developers over time you'll want to pull those updates into your branch, ideally via rebase, to avoid any conflicts when you open a pull request.
We use a visual regression testing suite to capture any unintended changes during development. After running yarn build you can run the suite locally with yarn test:visual-regression, which will open a report in your browser to show you what passed and what failed. If any fails are actually intentional visual changes you can add the update-failed-snapshots πΈ label to your PR and rerun the VRT workflow to approve those changes as new reference images and include them in your PR.
As you develop you'll want to track the scope of the changes you make. Racine supports this with a tool called changesets to automatically pick new version numbers and update the changelog whenever we publish a new version of the package.
Run yarn change at the root of the Seeds repo to generate a changeset that will be used to derive the next version number for Racine from your changes.
We use semantic versioning for the Racine package, which allows users to understand the scope of a package's changes based on the version number, which is in the format major.minor.patch.
When running this command, you will be asked to select whether your change is a patch, minor, or major change.
x.x.0)x.0.x)0.x.x). These types of changes are rare and should be coordinated in advance with the Design Systems team.The changeset CLI will also ask you to input a message detailing your changes. The completion of the command will generate a new changeset markdown file. You are more than welcome to edit this file after it has been generated, so don't get hung up on trying to write the perfect text from the command line. Aim to make the text of the changeset file(s) as descriptive and informative as possible, as they will be used to build a changelog file when the new version is released. Check out our documentation for the Seeds Release Process for examples of what makes a good or bad changeset.
You can add as many changesets to a PR as you would like. If your PR makes several distinct changes to Racine, you should create a changeset detailing each one individually.
Once you're ready to submit your changes for review, open a PR against the main branch. A few things will happen:
html_report/index.html in Report.zip will show you what passed and what failed.yarn test to run these tests locally. If there are any issues, they will need to be resolved before the PR can be merged.You may be asked to make changes to match Racine's contribution guidelines, so expect to keep attention on your PR for a little bit. Once your tests are passing and you have at least one approving Design Systems review, you're welcome to merge your PR. It may sometimes take a little while to get an approval from the DS team since a merge queues your contribution into the next release and the DS team needs to make sure they have the bandwidth to validate any contribution before it releases.
When the Design Systems team prepares the next Racine release, changsets will generate a PR called Version Packages. This PR will detail all of the changes that have been made to the package since the last publish. Merging this PR will release a new version of Racine.
When the PR is merged, GitHub will kick off a publish of the new version. There will be a notification in #design-systems in Slack when the new version is available.
Racine components are documented in Seeds, Sprout's design system. You can open a PR to the reference site app to add or edit component documentation. It's a good idea to have documentation changes ready to go at the same time your Racine contributions are deployed, so start early! Reach out to the Design Systems team if you need help getting started.
When making breaking changes to a component API, you should create a codemod to help users migrate their code. Codemods should be added to the package that needs migration (not racine), and will be automatically discovered by the racine-codemod CLI.
When to create a codemod:
Initial Setup (for packages adding their first codemod):
Update tsup.config.ts:
export default defineConfig([
// Main package build
{ entry: ["src/index.ts"], format: ["cjs", "esm"], /* ... */ },
// Codemods build (CJS only)
{ entry: ["codemods/**/*.ts"], format: ["cjs"], dts: false, /* ... */ },
]);
Update package.json:
exports field for codemods:{
"exports": {
".": { /* existing exports */ },
"./codemods/*": {
"require": "./dist/codemods/*.js"
}
},
"files": ["dist", "codemods"]
}
@types/jscodeshift and jscodeshift to devDependencies (if not already present)Update tsconfig.json:
codemods/**/* to the include arrayCreating a New Codemod:
codemods/ directory (e.g., codemods/my-codemod.ts)jscodeshift (avoid any types)module.exports = transformer;codemods/__tests__/my-codemod.test.tsracine/codemods/codemod-docs.jsyarn build or turbo build)racine-codemod CLI after package is builtTesting codemods locally:
yarn build to compile codemod to JavaScriptyarn test to run codemod testsracine-codemod my-codemod path/to/test/filesExample structure:
my-package/
codemods/
my-codemod.ts
__tests__/
my-codemod.test.ts
dist/
codemods/
my-codemod.js (built automatically)
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated βelf-*β npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.

Research
/Security News
Malicious Rust crate evm-units disguised as an EVM version helper downloads and silently executes OS-specific payloads likely aimed at crypto theft.