![Maven Central Adds Sigstore Signature Validation](https://cdn.sanity.io/images/cgdhsj6q/production/7da3bc8a946cfb5df15d7fcf49767faedc72b483-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
THIS PROJECT IS (kind of) BRAND NEW AND NOT SAFE TO USE YET! :)
Software complexity analysis of Mozilla-format abstract syntax trees.
Currently the library reports on:
Mozilla's Parser API has become a de-facto standard for the in-memory data representation of parsed JavaScript programs. It defines an abstract syntax tree format composed of objects that publish their type information, allowing consuming programs to easily navigate those trees using generic logic.
By accepting a syntax tree in such a widely supported format, escomplex is decoupled from a specific input language. Any language that compiles to JavaScript and has a conforming parser can be the subject of complexity analysis by this library.
Some examples of conforming parsers are:
The library is published on npm
under the name escomplex
.
To install,
you can add it to the dependencies
in your package.json
file
or simply run:
npm install escomplex
You can load escomplex
in your own code
by calling require
:
var escomplex = require('escomplex');
It exports one function,
called analyse
:
var result = escomplex.analyse(ast, options);
The first argument, ast
,
must be either
an abstract syntax tree
as defined by Mozilla's Parser API
or an array of said syntax trees.
The second argument, options
,
is an optional object
containing properties that modify some of the complexity calculations:
options.logicalor
:
Boolean indicating whether operator ||
should be considered a source of cyclomatic complexity,
defaults to true
.options.switchcase
:
Boolean indicating whether switch
statements
should be considered a source of cyclomatic complexity,
defaults to true
.options.forin
:
Boolean indicating whether for
...in
loops
should be considered a source of cyclomatic complexity,
defaults to false
.options.trycatch
:
Boolean indicating whether catch
clauses
should be considered a source of cyclomatic complexity,
defaults to false
.options.newmi
:
Boolean indicating whether the maintainability
index should be rebased on a scale from 0 to 100,
defaults to false
.If a single abstract syntax tree object
is passed in the ast
argument,
the result will be a report object
detailing the complexity of that syntax tree.
If ast
is an array,
the result will be an array of complexity reports.
TODO: Properties on the returned object
TODO
TODO
FAQs
Software complexity analysis of JavaScript-family abstract syntax trees.
The npm package escomplex receives a total of 824 weekly downloads. As such, escomplex popularity was classified as not popular.
We found that escomplex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.