
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
danger-plugin-commit-lint
Advanced tools
This is a Danger Plugin that ensures nice and tidy commit messages.
This is a Danger Plugin that ensures nice and tidy commit messages. The checks performed on each commit message are inspired by Tim Pope's blog post on good commit messages, echoed by git's own documentation on the subject. This is almost a direct typescript port of the ruby version, which you can find here. Thanks to @jonallured for creating the ruby version.
yarn add danger-plugin-commit-lint -D
Simply add this to your Dangerfile:
import * as commitLint from 'danger-plugin-commit-lint'
commitLint.check()
That will check each commit in the PR to ensure the following is true:
subject_cap)subject_words)subject_length)subject_period)empty_line)By default, Commit Lint fails, but you can configure this behavior.
Configuring Commit Lint is done by passing a hash. The three keys that can be passed are:
disablefailwarnTo each of these keys you can pass true or an array of checks. Here are some ways you could configure Commit Lint:
// warn on all checks (instead of failing)
commitLint.check({ warn: true })
// disable the `subject_period` check
commitLint.check({ disable: ["subject_period"] })
Remember, by default all checks are run and they will fail. Think of this as the default:
commitLint.check({ fail: true })
Also note that there is one more way that Commit Lint can behave:
commitLint.check({ disable: true })
This will actually throw a warning that Commit Lint isn't doing anything.
See the GitHub release history.
See CONTRIBUTING.md.
FAQs
This is a Danger Plugin that ensures nice and tidy commit messages.
The npm package danger-plugin-commit-lint receives a total of 225 weekly downloads. As such, danger-plugin-commit-lint popularity was classified as not popular.
We found that danger-plugin-commit-lint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.