
Product
Introducing Tier 1 Reachability: Precision CVE Triage for Enterprise Teams
Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.
Create and maintain developer norms and PR template for your project in your repo.
Add developer norms and a PR template to your project by executing:
npx dev-norms create
Sensible defaults are a great way to smoothly kick start a new project. They make life easier in the beginning, but you can always tweak things later on as your needs change. This is true for new packages/libraries/frameworks you download and this is also true for new teams you start or join. Code is written for human consumption, the fact that they can be compiled is a great side effect. Clean code leads to less bugs, less frustration and overall better developer happiness.
Developer norms are a necessary way to set some ground rules, so your code base can retain some consistency, remain maintainable over the next days, months and years and all developers are on the same page.
Why keep your norms elsewhere, when you can keep them as a living piece of documentation right in your repo.
There are two main commands create
and update
.
Run npx dev-norms create
to create a starter list of norms in the root of your project, called dev-norms.md
. Keep it relevant and update it to suit your needs.
Run npx dev-norms update --path=.
command to overwrite your norms with the latest norms.
If you want team members to be aware of this tool, make it a part of your package.json
file by executing:
npm install --save-dev dev-norms
Feel free to suggest new sensible defaults, by submitting a PR on https://github.com/duluca/dev-norms to update base dev-norms.md
.
FAQs
Create and maintain developer norms and PR template for your project in your repo.
We found that dev-norms demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.