Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
@zeit/ncc
Advanced tools
[![CI Status](https://github.com/zeit/ncc/workflows/CI/badge.svg)](https://github.com/zeit/ncc/actions?workflow=CI) [![codecov](https://codecov.io/gh/zeit/ncc/branch/master/graph/badge.svg)](https://codecov.io/gh/zeit/ncc)
Simple CLI for compiling a Node.js module into a single file, together with all its dependencies, gcc-style.
go
)npm i -g @zeit/ncc
$ ncc <cmd> <opts>
Eg:
$ ncc build input.js -o dist
Outputs the Node.js compact build of input.js
into dist/index.js
.
Note: If the input file is using a
.cjs
extension, then so will the corresponding output file. This is useful for packages that want to use.js
files as modules in native Node.js using a"type": "module"
in the package.json file.
build <input-file> [opts]
run <input-file> [opts]
cache clean|dir|size
help
version
-o, --out [file] Output directory for build (defaults to dist)
-m, --minify Minify output
-C, --no-cache Skip build cache population
-s, --source-map Generate source map
--no-source-map-register Skip source-map-register source map support
-e, --external [mod] Skip bundling 'mod'. Can be used many times
-q, --quiet Disable build summaries / non-error outputs
-w, --watch Start a watched build
--v8-cache Emit a build using the v8 compile cache
--stats-out [file] Emit webpack stats as json to the specified output file
For testing and debugging, a file can be built into a temporary directory and executed with full source maps support with the command:
$ ncc run input.js
The only requirement is to point ncc
to .ts
or .tsx
files. A tsconfig.json
file is necessary. Most likely you want to indicate es2015
support:
{
"compilerOptions": {
"target": "es2015",
"moduleResolution": "node"
}
}
Some packages may need some extra options for ncc support in order to better work with the static analysis.
See package-support.md for some common packages and their usage with ncc.
require('@zeit/ncc')('/path/to/input', {
// provide a custom cache path or disable caching
cache: "./custom/cache/path" | false,
// externals to leave as requires of the build
externals: ["externalpackage"],
// directory outside of which never to emit assets
filterAssetBase: process.cwd(), // default
minify: false, // default
sourceMap: false, // default
sourceMapBasePrefix: '../', // default treats sources as output-relative
// when outputting a sourcemap, automatically include
// source-map-support in the output file (increases output by 32kB).
sourceMapRegister: true, // default
watch: false, // default
v8cache: false, // default
quiet: false, // default
debugLog: false // default
}).then(({ code, map, assets }) => {
console.log(code);
// Assets is an object of asset file names to { source, permissions, symlinks }
// expected relative to the output code (if any)
})
When watch: true
is set, the build object is not a promise, but has the following signature:
{
// handler re-run on each build completion
// watch errors are reported on "err"
handler (({ err, code, map, assets }) => { ... })
// handler re-run on each rebuild start
rebuild (() => {})
// close the watcher
void close ();
}
FAQs
[![CI Status](https://github.com/zeit/ncc/workflows/CI/badge.svg)](https://github.com/zeit/ncc/actions?workflow=CI) [![codecov](https://codecov.io/gh/zeit/ncc/branch/master/graph/badge.svg)](https://codecov.io/gh/zeit/ncc)
The npm package @zeit/ncc receives a total of 7,153 weekly downloads. As such, @zeit/ncc popularity was classified as popular.
We found that @zeit/ncc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 57 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.