![Understanding the Security Concerns of npm Shrinkwrap](https://cdn.sanity.io/images/cgdhsj6q/production/37156cfb4523f411022d98b3b06138985ac81496-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Understanding the Security Concerns of npm Shrinkwrap
Explore the security risks of using npm shrinkwrap, the potential for outdated dependencies, and best practices for mitigating these concerns in your projects.
corejs-upgrade-webpack-plugin
Advanced tools
a webpack plugin that transforms core-js v2 paths to core-js v3 paths
Readme
I wrote this to ensure the latest version of core-js is used everywhere in an application.
Sometimes you're depending on components or libraries that haven't updated yet, and this can increase bundle-size, or even break your app if these dependencies didn't have core-js as a dependency themselves.
This Webpack Plugin will essentially do a search and replace on all requires and if the require path matches /core-js/
it will try and resolve the require.
If it can, nothing happens. If the resolve fails (this would normally break your app) this plugin tries to map the old core-js path to the new path structure, and resolve that instead.
This plugin will allow you to specify a resolveFrom
option, so you can resolve core-js from any path you'd like.
This is useful if you know there are going to be multiple core-js version installed, and you want to pick a specific one installed somewhere.
yarn add corejs-upgrade-webpack-plugin
simple example:
import CoreJSUpgradeWebpackPlugin from 'corejs-upgrade-webpack-plugin';
// add this to your webpack.plugins config
new CoreJSUpgradeWebpackPlugin();
example with options:
import CoreJSUpgradeWebpackPlugin from 'corejs-upgrade-webpack-plugin';
// add this to your webpack.plugins config
new CoreJSUpgradeWebpackPlugin({
resolveFrom: [process.cwd()],
});
FAQs
a webpack plugin that transforms core-js v2 paths to core-js v3 paths
We found that corejs-upgrade-webpack-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Explore the security risks of using npm shrinkwrap, the potential for outdated dependencies, and best practices for mitigating these concerns in your projects.
Security News
Node.js is taking steps towards removing Corepack from its distribution, aiming for changes in the next major release.
Security News
OpenSSF has released a guide to help package repositories adopt Trusted Publishers, which enhances security by using short-lived identity tokens for authentication, reducing the risks associated with long-lived secrets.