
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@wordpress/sync
Advanced tools
Sync entity data between peers for real-time collaboration using CRDT documents.
This package provides the syncing layer for real-time collaboration in the WordPress editor. It is built on Yjs, a CRDT implementation that enables multiple users to edit shared data concurrently without conflicts.
See CODE.md for architecture details.
Install the module
npm install @wordpress/sync --save
The Awareness protocol should not be considered a public API. It is a third-party library that will experience breaking changes in the future.
In general, awareness for core entity types is implemented by the core-data package and third-party Yjs providers should not provide their own awareness implementation. However, it may be desirable for custom entities to have a custom awareness implementation.
Private @wordpress/sync APIs.
Yjs should not be considered a public API. It is a third-party library that will experience breaking changes in the future. However, in order to allow third-party plugins to provide their own Yjs providers / sync transport, they must import and consume our instance of Yjs due to this bug / feature:
https://github.com/yjs/yjs/issues/438
In other words, external code must be able to import Yjs from the @wordpress/sync package in their code, e.g.:
import { Y } from '@wordpress/sync';
Additionally, this import must resolve to wp.sync via DependencyExtractionWebpackPlugin. If you are using an older version of @wordpress/scripts that does not treat @wordpress/sync as an unbundled package, then you can use Webpack externals to manually resolve the package to the global wp.sync variable:
externals: {
...existingConfig.externals,
// Resolve @wordpress/sync to the global `wp.sync` provided by WordPress.
'@wordpress/sync': 'wp.sync',
// Resolve Yjs to the global `wp.sync.Y` provided by the sync package.
// Since dependencies import 'yjs' directly, we need to avoid importing
// and packaging two different Yjs instances, which would result in this
// conflict:
//
// https://github.com/yjs/yjs/issues/438
yjs: 'wp.sync.Y',
},
The major version of Yjs that is bundled and exported by this package. This can be used by third-party code to ensure that they are targeting a compatible version of Yjs.
This is an individual package that's part of the Gutenberg project. The project is organized as a monorepo. It's made up of multiple self-contained software packages, each with a specific purpose. The packages in this monorepo are published to npm and used by WordPress as well as other software projects.
To find out more about contributing to this package or Gutenberg as a whole, please read the project's main contributor guide.

FAQs
Sync Data.
The npm package @wordpress/sync receives a total of 40,392 weekly downloads. As such, @wordpress/sync popularity was classified as popular.
We found that @wordpress/sync demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 23 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.