
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
Table of Contents
You need Node.js 7.6 or higher.
npm install --save @weh/weh
Let's write a simple program that changes the content of all files in a directory to "hey, what's up":
const weh = require('@weh/weh')
// this is this simplest plugin you can build!
// conveniently, plugins are just normal functions
const plugin = () => {
// replace all file contents with the string
return files => files.map(file => {
file.contents = `hey, what's up`
return file
})
}
// enter our main function:
// the main function should be an async function so that
// it automatically returns a promise
weh(async site => {
// we register our plugin...
site.use(plugin)
// ...and initiate the build process
return site
})
Let's save this as example.js. To run it, you need Node.js version 7.6 or
higher. The latest stable version will work.
node example.js
weh doesn't output logs by default. If you want logs
(for example, for debugging), you can set the DEBUG environment variable to:
weh # for base logs
weh:read # for specific read logs
weh:write # for specific write logs
# you can also combine any of the three
weh,weh:read
To get all logs at once, you can just set the variable to weh*.
DEBUG=weh* node my_script # full logging!
weh plugins may implement logging with different DEBUG names.
It's fairly simple! What weh does can be split up into two things:
weh actually do things.weh writes the files as they are described
in the gigantic array to disk.It's that simple! Static site generators aren't rocket science or whatever.
If you got confused by looking at the Jekyll source code once, that's because
Jekyll is more fully fledged than weh is, that is, it provides some defaults.
But static site generators, at their core, are just programs that take a set of files, do something to them, and then output those files. That's it. The rest is just transformations on those files.
weh's goal is to reduce that essence to its very base, and to give you a
bunch of building blocks with which you can make your ideal site, using only
the stuff you need!
See API.md.
Official plugins are kept at wehjs/core!
Since it's really easy to write weh plugins, anyone can make and publish one!
If you make a plugin, you should add a GitHub topic weh and probably also
add weh as a keyword in your package.json.
Here's a list of all weh plugins on GitHub
To work on this repository, clone it and install the npm dependencies:
git clone https://github.com/wehjs/weh.git
cd weh
npm install
There are a couple of npm scripts provided for convenience:
npm test - runs linters and ava in ci modenpm run lint - runs lintersnpm run ava - only runs ava oncenpm run ava:ci - runs ava in ci mode (generates coverage data)npm run ava:watch - runs ava in watch modenpm run coverage - generates coverage datanpm run update-coc - pulls the latest weallbehave code of conductnpm run deploy - publishes npm package using npThis section is a little bit about how weh compares to other static site
generators (even though it isn't really that):
weh. Why am I still writing this?weh, and
as a matter of fact, its main inspiration. It's also plugin-based, and works
with roughly the same concepts. The major difference is that weh is more
up-to-date (I like promises a lot) and that the API is fairly different.
Also, it's just not really an active project with an active ecosystem
anymore (sadly!).deepmerge - used to handle configuration managementwalk - walks through directories to read themtrough - handles middleware chainsdebug - used for loggingto-vfile - converts to vfile, the virtual file format used by wehmkdirp - creates directories when writing to diskis-text-path - provides logic to correctly read binary filesIf you have any ideas as to how to eliminate a dependency, you're more than welcome to pitch it here!
This repository operates under the weallbehave Code of Conduct. Its contents can be found in CODE_OF_CONDUCT.md.
GNU AGPLv3 (see LICENSE document)
FAQs
small site generator
We found that @weh/weh demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.