edx-pattern-library - npm Package Compare versions

Comparing version 0.10.4 to 0.11.0

CHANGELOG.md

@@ -8,2 +8,13 @@ # Changelog
 
+## 0.11.0 (2016-03-22)
+* Added a PR cover letter to the repo
+* Updated Jekyll dependencies
+* Added example HTML boilerplates
+* Bundling assets with WebPack
+* Automated publishing preview version of doc site with S3
+* Added Dropdown Menu component styles and examples
+* Added JS tab to document site at component level
+
+- - -
+
 ## 0.10.4 (2016-02-04)
@@ -10,0 +21,0 @@ * FIX - republish to get around an npm publish failure

package.json

 {
   "name": "edx-pattern-library",
-  "version": "0.10.4",
+  "version": "0.11.0",
   "author": "edX Pattern Library Team <[e-mail]>",
@@ -28,7 +28,10 @@ "license": "Apache-2.0",
     "requirejs-plugins": "^1.0.2",
+    "sizzle": "^2.3.0",
     "susy": "^2.2.9"
   },
   "devDependencies": {
+    "backbone": "*",
     "browser-sync": "*",
     "del": "*",
+    "edx-ui-toolkit": "~0.7.0",
     "gulp": "*",
@@ -48,7 +51,11 @@ "gulp-autoprefixer": "*",
     "gulp-util": "*",
+    "gulp-webpack": "*",
     "imagemin-pngquant": "*",
     "lodash": "*",
     "merge-stream": "*",
+    "minimist": "*",
     "require-dir": "*",
-    "run-sequence": "*"
+    "run-sequence": "*",
+    "text-loader": "*",
+    "webpack": "*"
   },
@@ -55,0 +62,0 @@ "scripts": {

pattern-library/js/afontgarde.js

@@ -200,3 +200,3 @@ /*! afontgarde - v0.1.6 - 2015-03-13
 	win.FontFaceOnload = FontFaceOnload;
-})( this, this.document );
+})( window, window.document );
 
@@ -288,2 +288,2 @@ /*
 
-})( this );
+})( window );

pattern-library/js/edx-icons.js

@@ -1,9 +0,9 @@
-define([
-    'afontgarde' // require this for this script to work
-    ], function() {
+define(['afontgarde'],
+    function() {
+        'use strict';
 
-    AFontGarde('edx-icons', {
-        // Check a few random icons to see if our font loads
-        glyphs: '\uE621\uE622\uE623'
+        window.AFontGarde('edx-icons', {
+            // Check a few random icons to see if our font loads
+            glyphs: '\uE621\uE622\uE623'
+        });
     });
-});

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Mixed license

License

(Experimental) Package contains multiple licenses.

Found 1 instance in 1 package

Unidentified License

License

(Experimental) Something that seems like a license was found, but its contents could not be matched with a known license.

Found 1 instance in 1 package

Improved metrics

Number of low license alerts

0

decreased by-100%

License quality

100

increased by25%

Worsened metrics

Total package byte prevSize

2906764

decreased by-30.41%

Dependency count

8

increased by14.29%

Dev dependency count

27

increased by28.57%

Number of package files

175

decreased by-63.47%

Lines of code

15742

decreased by-59.42%

Number of low supply chain risk alerts

8

increased by300%

Dependency changes

• + Addedsizzle@^2.3.0

• + Addedsizzle@2.3.10(transitive)