
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
create-flow-upgrade
Advanced tools
A utility for upgrading your codebase to the latest version of Flow.
flow-upgrade
A utility for upgrading your codebase to the latest version of Flow.
Install using yarn add flow-upgrade
. We expect prettier
to be installed as a peer dependency wherever you are running flow-upgrade
.
You can then run:
yarn run flow-upgrade <current flow version> <target flow version>
You may also use npx
:
npx flow-upgrade <current flow version> <target flow version>
We also supply the flow-codemod
binary:
yarn run flow-codemod <codemod name>
If you just want to run a codemod without specifying Flow versions.
all
By default, Flow will only upgrade files that have an // @flow
header comment.
If you want to upgrade all of your JavaScript files you may pass in the --all
:
yarn create flow-upgrade --all
prettierrc
Path to a .prettierrc
file to use.
Upgrade codemods rely upon prettier
to print the resulting code after transformation.
If this is not provided, we will just use the defaults.
Converts static object assignments (e.g. const o = {}; o.a = 1;
) to inline properties (e.g. const o = {a: 1};
).
Run with yarn run flow-codemod collapseObjectInitialization
.
Replaces T: {}
with T: {...}
in type parameter bounds. The former is almost always wrong.
Run with yarn run flow-codemod typeParameterBoundExactEmptyObjectToInexact
.
Converts implicitly inexact object type syntax {}
to explicitly inexact {...}
.
Run with yarn run flow-codemod convertImplicitInexactObjectTypes
.
Converts explicitly exact object type syntax {| |}
to be just be { }
. To be done after you turn on exact_by_default=true
in your .flowconfig
.
Run with yarn run flow-codemod removeExplicitlyExactObjectTypeSyntax
.
Removes annotations nested inside of destructuring (e.g. const [o: number] = foo;
). These are not valid Flow syntax.
Run with yarn run flow-codemod removeAnnotationsInDestructuring
.
Part of the upgrade to 0.176
Removes useless duplicate class properties and fixes bad constructor binding in those classes.
Run with yarn run flow-codemod removeDuplicateClassProperties
.
Part of the upgrade to 0.170
$Partial
to Partial
Renames usages of the $Partial
utility type to its new name, Partial
.
Run with yarn run flow-codemod renamePartial
.
Part of the upgrade to 0.201
$Shape
to Partial
Converts usages of the deprecated and unsafe $Shape
utility type to its replacement, Partial
.
Run with yarn run flow-codemod convertShapeToPartial
.
(x: T)
to as
expressions x as T
Converts usages of the old casting syntax (x: T)
to the new casting syntax x as T
.
Run with yarn run flow-codemod typeCastToAsExpression
.
Converts usages of the internal React types like React$Node
to public facing ones like React.Node
.
Run with yarn run flow-codemod replaceReactDollarUtilityTypes
.
$TEMPORARY$*
typesConverts:
$TEMPORARY$object<{props}>
to $ReadOnly<{props}>
$TEMPORARY$array<T>
to $ReadOnlyArray<T>
$TEMPORARY$number<42>
annotations to number
$TEMPORARY$string<"foo">
annotations to string
React.AbstractComponent<...>
typesConverts:
React.AbstractComponent<Props>
to React.ComponentType<Props>
React.ElementConfig<React.AbstractComponent<Props, Instance>>
to Props
React.ElementRef<React.AbstractComponent<Props, Instance>>
to Instance
React.ElementRef<React.AbstractComponent<Props>
to mixed
FAQs
A utility for upgrading your codebase to the latest version of Flow.
The npm package create-flow-upgrade receives a total of 1 weekly downloads. As such, create-flow-upgrade popularity was classified as not popular.
We found that create-flow-upgrade demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.