
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
@theia/monaco
Advanced tools
The @theia/monaco
extension contributes the integration of the monaco-editor.
This includes:
This package is intended to be the interface between the @theia/monaco-editor-core
package, the project's bundling of the monaco-editor-core
package published by the VSCode
team, and the rest of the application. When we uplift to a new version of monaco-editor-core
, this package will need to be checked particularly thoroughly. To facilitate that
process, the steps for undertaking a Monaco uplift are outlined here.
At the time of this writing the latest release tag is
1.67.2
, and the uplift branch ismonaco-uplift-2022-6
As you resolve conflicts and make changes to the VSCode repo, make sure you end up with a single commit on the uplift branch to make it easier for the next person to rebase.
yarn
and yarn run gulp editor-distro
.build/monaco/package.json
model
and a file named model.ts
in the same folder.For initial testing, it's easier to point dependencies to your local VSCode.
monaco-editor-core
using the steps above.@theia/monaco-editor-core
in package.json
s and replace their version with "link:<path to your local build of monaco-editor-core>"
.Using
link:
means that if you subsequently make changes on the VSCode side, you only need to rebuild VSCode and then rebuild Theia to see the effects.
node_modules
and yarn
and build Theia.bindMonacoPreferenceExtractor
function in examples/api-samples/src/browser/monaco-editor-preferences/monaco-editor-preference-extractor.ts
and run the commands there. Fix the EditorGeneratedPreferenceSchema
as necessary, and add or remove validations from the MonacoFrontendApplicationContribution
as appropriate.If you add these, mark them with @monaco-uplift - that'll make them easier to find in the future. Better: if you can remove them, do! Typically, the cause is mixing imports from private API and public API. Often public API fails to satisfy private declarations.
It may also be necessary to update our various
vscode
dependencies to match the current state of VSCode. It may not be necessary to upgrade all (or any) of these to successfully adopt a new Monaco version, but if something is misbehaving inexplicably, checking dependencies is a reasonable place to start. Check on:
vscode-debugprotocol
vscode-languageserver-protocol
vscode-oniguruma
vscode-proxy-agent
vscode-ripgrep
vscode-textmate
vscode-uri
Once you believe that everything is in working order, you'll need to publish the new @theia/monaco-editor-core
for testing. The instructions for doing so are
here. Once the package is published, point your package.json
s at the testing version and make
sure everything still works, then make a PR.
"Theia" is a trademark of the Eclipse Foundation https://www.eclipse.org/theia
See here for a detailed documentation.
FAQs
Theia - Monaco Extension
The npm package @theia/monaco receives a total of 5,688 weekly downloads. As such, @theia/monaco popularity was classified as popular.
We found that @theia/monaco demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.