
Security News
Risky Biz Podcast: Making Reachability Analysis Work in Real-World Codebases
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Documentation generating tool for JavaScript that matches comments to AST nodes.
doc-tree
parses comments in JavaScript code and outputs the structure and context of the comments in any particular format, JSDoc is the default but any documentation parsing function can be supplied. It traverses the Abstract Syntax Tree (AST) to determine the context of a comment. Basically it's glue code between the AST parser Acorn, and the JSDoc parser Doctrine, though any user-supplied parsing function may be used.
Get it from npm
:
$ npm install -g doc-tree
doc-tree
operates over stdio
. Running doc-tree
on its own source code, and outputting the result to docs.json
:
$ doc-tree < lib/index.js > docs.json
Or you could use it programmatically, as part of a Node-based build script:
import fs from 'fs'
import docTree from 'doc-tree'
// Parse a string or a buffer.
let doc = docTree.parse(fs.readFileSync('example.js'))
// An array of parsed comments matched with their contexts.
let output = doc.output()
The output
method accepts 2 arguments, a function that accepts a comment and returns anything, and an options
object to pass to the custom function or the built-in parser, Doctrine.
This code documentation:
/**
* This is a **Foo** class.
*/
class Foo {
/**
* This is the constructor.
*
* @param {Object} options
*/
constructor (options) { ... }
}
Gets outputted as:
[{ comment: { description: '<p>This is a <strong>Foo</strong> class.</p>', tags: [] },
context: { location: { start: [Object], end: [Object] },
name: 'Foo', type: 'class' }
},
{ comment: { description: '<p>This is the constructor.</p>', tags: [Object] },
context: { location: { start: [Object], end: [Object] },
type: 'constructor', target: 'Foo' }
}]
Descriptions are rendered into HTML using CommonMark. Use { render: false }
in the options for output
to turn it off.
The default JSDoc parser will only consider block comments that start with /**
.
This software is licensed under the GNU General Public License v3.
FAQs
Documentation generating tool for JavaScript that matches comments to AST nodes.
The npm package doc-tree receives a total of 2 weekly downloads. As such, doc-tree popularity was classified as not popular.
We found that doc-tree demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.