Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
arc-server
Advanced tools
The arc-server
api is split into 3 submodules:
arc-server
import { withFlags, setFlags, getFlags } from "arc-server";
setFlags(flags): void
: sets arc flags for the current synchronous execution and then persists the flags through any following asynchronous calls.withFlags<T>(flags, fn: () => T): T
: sets arc flags for the synchronous execution of the provided fn
and then persists the flags through asynchronous calls made within the provided fn
. Returns the result of calling fn
.getFlags(): Record<string, boolean> | undefined
: gets the currently set flags or undefined.import { setFlags, getFlags } from "arc-server";
function start(flags, delay) {
setFlags(flags);
wait(delay);
}
function wait(delay) {
setTimeout(logFlags, delay);
}
function logFlags() {
// The flags weren't passed here, but we can get them from the context
console.log(getFlags());
}
start({ foo: true }, 100);
start({ baz: true }, 10);
start({ baz: true }, 50);
// After 10ms, { bar:true } is logged
// After 50ms, { baz:true } is logged
// After 100ms, { foo:true } is logged
import { withFlags, getFlags } from "arc-server";
function start(flags, delay) {
withFlags(flags, () => {
wait(delay);
});
}
function wait(delay) {
setTimeout(logFlags, delay);
}
function logFlags() {
// The flags weren't passed here, but we can get them from the context
console.log(getFlags());
}
start({ foo: true }, 100);
start({ baz: true }, 10);
start({ baz: true }, 50);
// After 10ms, { bar:true } is logged
// After 50ms, { baz:true } is logged
// After 100ms, { foo:true } is logged
Example usage in example-arc-server/index.js
arc-server/install
import "arc-server/install";
If you are not bundling your server files with another arc
plugin, you should import
/require
this module near the beginning of your application entry point before loading any modules that need to be adaptable.
arc-server/proxy
import createAdaptiveProxy from "arc-server/proxy";
An AdaptiveProxy
is returned from an import
/require
call. It can be treated as if it were the underlying module (with a few caveats. You probably won't need to use this module directly.
createAdaptiveProxy(matches)
matches
: a MatchSet
where each value is the loaded moduleApplies if you require an adaptive file that sets exports
to a primitive value:
module.exports = "Hello World";
Proxy and Reflect are used to provide adaptive values, but these do not support primitive values (string
, number
, boolean
).
To work around this, these primitives are converted into instances of String
, Number
, or Boolean
. In many cases, you will be able to treat this as if it were the original value, but there are differences.
One notable example is truthiness:
// Objects are truthy, regardless of value
!!new Boolean(false) === true;
!!new String("") === true;
!!new Number(0) === true;
Another is typeof
:
// typeof is object, regardless of value
typeof new Boolean(true) === "object";
typeof new String("hello") === "object";
typeof new Number(10) === "object";
If you need a true primitive, you can convert an adaptive primitive to its resolved primitive value using valueOf
:
let string = adaptiveString.valueOf();
Native functions, eg from Object.prototype
, or String.prototype
are bound to the adapted object:
let valueOf = adaptiveValue.valueOf;
// works because it is bound
valueOf();
// this doesn't change, because it was previously bound
valueOf.bind(newThis);
FAQs
<img src="https://img.shields.io/github/license/eBay/ar
We found that arc-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.