acorn - npm Package Compare versions

Comparing version 0.12.0 to 1.0.0

package.json

 {
-    "name": "acorn",
-    "description": "ECMAScript parser",
-    "homepage": "http://marijnhaverbeke.nl/acorn/",
-    "main": "acorn.js",
-    "version": "0.12.0",
-    "engines": {"node": ">=0.4.0"},
-    "maintainers": [{"name": "Marijn Haverbeke",
-                     "email": "[e-mail]",
-                     "web": "http://marijnhaverbeke.nl"}],
-    "repository": {"type": "git",
-                   "url": "http://marijnhaverbeke.nl/git/acorn"},
-    "licenses": [{"type": "MIT",
-                  "url": "http://marijnhaverbeke.nl/acorn/LICENSE"}],
-    "scripts": {
-      "test": "node test/run.js",
-      "prepublish": "node bin/without_eval > acorn_csp.js"
+  "name": "acorn",
+  "description": "ECMAScript parser",
+  "homepage": "https://github.com/marijnh/acorn",
+  "main": "dist/acorn.js",
+  "version": "1.0.0",
+  "engines": {
+    "node": ">=0.4.0"
+  },
+  "maintainers": [
+    {
+      "name": "Marijn Haverbeke",
+      "email": "[e-mail]",
+      "web": "http://marijnhaverbeke.nl"
     },
-    "bin": {"acorn": "./bin/acorn"},
-    "devDependencies": {"regenerate": "~0.6.2",
-                        "unicode-7.0.0": "~0.1.5"}
+    {
+      "name": "Ingvar Stepanyan",
+      "email": "[e-mail]",
+      "web": "http://rreverser.com/"
+    }
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/marijnh/acorn.git"
+  },
+  "licenses": [
+    {
+      "type": "MIT",
+      "url": "https://raw.githubusercontent.com/marijnh/acorn/master/LICENSE"
+    }
+  ],
+  "scripts": {
+    "test": "node test/run.js",
+    "prepublish": "bin/prepublish.sh"
+  },
+  "bin": {
+    "acorn": "./bin/acorn"
+  },
+  "devDependencies": {
+    "babelify": "^5.0.4",
+    "browserify": "^9.0.3",
+    "unicode-7.0.0": "~0.1.5"
+  }
 }

README.md

@@ -5,3 +5,3 @@ # Acorn
 [![NPM version](https://img.shields.io/npm/v/acorn.svg)](https://www.npmjs.org/package/acorn)  
-[Author funding status: ![maintainer happiness](https://marijnhaverbeke.nl/fund/status_s.png)](https://marijnhaverbeke.nl/fund/)
+[Author funding status: ![maintainer happiness](https://marijnhaverbeke.nl/fund/status_s.png?force)](https://marijnhaverbeke.nl/fund/)
 
@@ -35,6 +35,6 @@ A tiny, fast JavaScript parser, written completely in JavaScript.
 
-### acorn.js
+### Main parser
 
-This file contains the actual parser (and is what you get when you
-`require("acorn")` in node.js).
+This is implemented in `dist/acorn.js`, and is what you get when you
+`require("acorn")` in node.js.
 
@@ -59,11 +59,16 @@ **parse**`(input, options)` is used to parse a JavaScript program.
 
-- **strictSemicolons**: If `true`, prevents the parser from doing
-  automatic semicolon insertion, and statements that do not end with
-  a semicolon will generate an error. Defaults to `false`.
+- **sourceType**: Indicate the mode the code should be parsed in. Can be
+  either `"script"` or `"module"`.
 
-- **allowTrailingCommas**: If `false`, the parser will not allow
-  trailing commas in array and object literals. Default is `true`.
+- **onInsertedSemicolon**: If given a callback, that callback will be
+  called whenever a missing semicolon is inserted by the parser. The
+  callback will be given the character offset of the point where the
+  semicolon is inserted as argument, and if `locations` is on, also a
+  `{line, column}` object representing this position.
 
-- **forbidReserved**: If `true`, using a reserved word will generate
-  an error. Defaults to `false`. When given the value `"everywhere"`,
+- **onTrailingComma**: Like `onInsertedSemicolon`, but for trailing
+  commas.
+
+- **allowReserved**: If `false`, using a reserved word will generate
+  an error. Defaults to `true`. When given the value `"never"`,
   reserved words and keywords can also not be used as property names
@@ -162,11 +167,12 @@ (as in Internet Explorer's old parser).
 
-**tokenize**`(input, options)` exports a primitive interface to
-Acorn's tokenizer. The function takes an input string and options
-similar to `parse` (though only some options are meaningful here), and
-returns a function that can be called repeatedly to read a single
-token, and returns a `{start, end, type, value}` object (with added
-`loc` property when the `locations` option is enabled and `range`
-property when the `ranges` option is enabled).
+**tokenizer**`(input, options)` returns an object with a `getToken`
+method that can be called repeatedly to get the next token, a `{start,
+end, type, value}` object (with added `loc` property when the
+`locations` option is enabled and `range` property when the `ranges`
+option is enabled). When the token's type is `tokTypes.eof`, you
+should stop calling the method, since it will keep returning that same
+token forever.
 
-In ES6 environment, returned result can be used as any other protocol-compliant iterable:
+In ES6 environment, returned result can be used as any other
+protocol-compliant iterable:
 
@@ -223,8 +229,7 @@ ```javascript
 
-The `bin/without_eval` script can be used to generate a version of
-`acorn.js` that has the generated code inlined, and can thus run
-without evaluating anything. In versions of this library downloaded
-from NPM, this script will be available as `acorn_csp.js`.
+The `dist/acorn_csp.js` file in the distribution (which is built
+by the `bin/without_eval` script) has the generated code inlined, and
+can thus run without evaluating anything.
 
-### acorn_loose.js ###
+### dist/acorn_loose.js ###
 
@@ -242,6 +247,6 @@ This file implements an error-tolerant parser. It exposes a single
 
-### util/walk.js ###
+### dist/walk.js ###
 
 Implements an abstract syntax tree walker. Will store its interface in
-`acorn.walk` when used without a module system.
+`acorn.walk` when loaded without a module system.
 
@@ -320,1 +325,62 @@ **simple**`(node, visitors, base, state)` does a 'simple' walk over
 The utility spits out the syntax tree as JSON data.
+
+## Build system
+
+Acorn is written in ECMAScript 6, as a set of small modules, in the
+project's `src` directory, and compiled down to bigger ECMAScript 3
+files in `dist` using [Browserify](http://browserify.org) and
+[Babel](http://babeljs.io/). If you are already using Babel, you can
+consider including the modules directly.
+
+The command-line test runner (`npm test`) uses the ES6 modules. The
+browser-based test page (`test/index.html`) uses the compiled modules.
+The `bin/build-acorn.js` script builds the latter from the former.
+
+If you are working on Acorn, you'll probably want to try the code out
+directly, without an intermediate build step. In your scripts, you can
+register the Babel require shim like this:
+
+    require("babelify/node_modules/babel-core/register")
+
+That will allow you to directly `require` the ES6 modules.
+
+## Plugins
+
+Acorn is designed support allow plugins which, within reasonable
+bounds, redefine the way the parser works. Plugins can add new token
+types and new tokenizer contexts (if necessary), and extend methods in
+the parser object. This is not a clean, elegant API—using it requires
+an understanding of Acorn's internals, and plugins are likely to break
+whenever those internals are significantly changed. But still, it is
+_possible_, in this way, to create parsers for JavaScript dialects
+without forking all of Acorn. And in principle it is even possible to
+combine such plugins, so that if you have, for example, a plugin for
+parsing types and a plugin for parsing JSX-style XML literals, you
+could load them both and parse code with both JSX tags and types.
+
+A plugin should register itself by adding a property to
+`acorn.plugins`, which holds a function. Calling `acorn.parse`, a
+`plugin` option can be passed, holding an object mapping plugin names
+to configuration values (or just `true` for plugins that don't take
+options). After the parser object has been created, the initialization
+functions for the chosen plugins are called with `(parser,
+configValue)` arguments. They are expected to use the `parser.extend`
+method to extend parser methods. For example, the `readToken` method
+could be extended like this:
+
+```javascript
+parser.extend("readToken", function(nextMethod) {
+  return function(code) {
+    console.log("Reading a token!")
+    return nextMethod.call(this, code)
+  }
+})
+```
+
+The `nextMethod` argument passed to `extend`'s second argument is the
+previous value of this method, and should usually be called through to
+whenever the extended method does not handle the call itself.
+
+There is a proof-of-concept JSX plugin in the [`jsx`
+branch](https://github.com/marijnh/acorn/tree/jsx) branch of the
+Github repository.

New alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

High entropy strings

Supply chain risk

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

Found 1 instance in 1 package

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

458752

increased by61.79%

Number of package files

43

increased by138.89%

Lines of code

11111

increased by68.22%

Number of low quality alerts

0

decreased by-100%

Number of lines in readme file

380

increased by21.02%

Worsened metrics

Dev dependency count

3

increased by50%

Number of low supply chain risk alerts

16

increased by1500%

Number of medium supply chain risk alerts

2

increased by100%

No dependency changes