ejs-prerender-loader - npm Package Compare versions

Comparing version 0.1.0-alpha.2 to 1.0.0

index.js

@@ -5,6 +5,3 @@ const ejs = require('ejs');
 const merge = require('merge');
-const path = require('path');
 
-const pkg = require('./package.json');
-
 const {
@@ -16,18 +13,13 @@ getBaseComponentsDir,
 module.exports = function (source) {
-  console.log(`Invoking ejs-render-loader@${pkg.version}`, Object.keys(ejsPrerender));
-  // console.log('ejs-render-loader source', source);
   this.cacheable && this.cacheable();
 
   const config = getConfig();
-  // console.log('ejs-render-loader config', config);
   const baseComponentsDir = getBaseComponentsDir(config);
-  // console.log('ejs-render-loader baseComponentsDir', baseComponentsDir);
 
-  const options = merge({
-    // Default options here
+  const defaultOptions = {
     views: [baseComponentsDir],
-  }, utils.getOptions(this));
-  // options.client = true; // Messes with the include function
+  };
 
-  // console.log('ejs-render-loader options', options);
+  const options = merge(defaultOptions, utils.getOptions(this));
+  // options.client = true; // Removes the include() function in favor of a callback
 
@@ -39,6 +31,14 @@ const filename = utils.getRemainingRequest(this).replace(/^!/, "");
 
+  // Most plugins return this template function. I can't do that because the internal referenced
+  // are no longer in closure.
   const template = ejs.compile(source, options);
-  console.log('template fn in loader', template.toString());
 
-  return 'module.exports = ' + template;
+  // Go ahead and invoke template function while it has closure.
+  const renderedTemplate = template();
+
+  // Create my own template function to return the rendered html.
+  // I may need to do something to protect backticks being used in the .ejs.
+  const templateFn = new Function(`return \`${renderedTemplate}\``);
+
+  return 'module.exports = ' + templateFn;
 };

package.json

 {
   "name": "ejs-prerender-loader",
-  "version": "0.1.0-alpha.2",
+  "version": "1.0.0",
   "description": "",
@@ -12,3 +12,2 @@ "main": "index.js",
   "dependencies": {
-    "@piuccio/ejs-compiled-loader": "^3.0.0",
     "ejs": "^3.0.1",
@@ -19,3 +18,3 @@ "ejs-prerender": "^1.1.0-beta.1",
   },
-  "gitHead": "a04007753a61f0f363b1579d8e0277e2a7d6cbf4"
+  "gitHead": "7689b8076e625a5cf0c7c6b62e96f9de2e43306a"
 }

New alerts

Uses eval

Supply chain risk

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Dependency count

4

decreased by-20%

Number of low quality alerts

2

decreased by-33.33%

Worsened metrics

Total package byte prevSize

2861

decreased by-1.04%

Lines of code

30

decreased by-3.23%

Number of medium supply chain risk alerts

1

increased byInfinity%

Dependency changes

• - Removed@piuccio/ejs-compiled-loader@^3.0.0

• - Removed@piuccio/ejs-compiled-loader@3.0.0(transitive)

• - Removedajv@6.12.6(transitive)

• - Removedajv-keywords@3.5.2(transitive)

• - Removedcamel-case@3.0.0(transitive)

• - Removedclean-css@4.2.4(transitive)

• - Removedcommander@2.17.12.19.0(transitive)

• - Removedejs@2.7.4(transitive)

• - Removedfast-deep-equal@3.1.3(transitive)

• - Removedfast-json-stable-stringify@2.1.0(transitive)

• - Removedhe@1.2.0(transitive)

• - Removedhtml-minifier@3.5.21(transitive)

• - Removedjson-schema-traverse@0.4.1(transitive)

• - Removedlower-case@1.1.4(transitive)

• - Removedno-case@2.3.2(transitive)

• - Removedparam-case@2.1.1(transitive)

• - Removedpunycode@2.3.1(transitive)

• - Removedrelateurl@0.2.7(transitive)

• - Removedschema-utils@0.4.7(transitive)

• - Removedsource-map@0.6.1(transitive)

• - Removeduglify-js@3.4.10(transitive)

• - Removedupper-case@1.1.3(transitive)

• - Removeduri-js@4.4.1(transitive)