
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
feather2是继feather之后基于fis3.0进行扩展的工程化框架。
feather2的架构做出了很大的调整,提高用户的易用性,并于feather1.x不同,feather2起初仅仅只适用于纯静态页面的前端项目,比如webapp,或结合一些mvvm框架进行开发的项目。2.1开始,集成mustache模板语法,提供除lothar外其他动态语言开发的框架选择,mustache支持多达几十种开发语言,简单简洁的语法,集合feather所提供的模板扩展标签使用,基本可以满足简单的动态语言开发需求,更复杂的一些场景还是建议直接进行定制化
基于feather2可以非常容易的再次扩展出动态语言的工程化框架,并且开发量也较少,如: lothar(blade模板引擎)
| 功能 | 1.x | 2.x |
|---|---|---|
| fis基本功能 | 支持 | 支持 |
| 本地服务器、url转发、mock数据 | 支持(java) | 支持(node) |
| 压缩、合并、csssprite、预编译 | 支持 | 支持 |
| 项目脚手架 | 支持 | 支持 |
| livereload | 支持 | 支持 |
| 模块化 | 支持 | 支持 |
| 模板继承 | 不支持 | 支持 |
| bigrender/pipe/quickly | 部分支持 | 支持 |
| 包管理 | 不支持 | 支持 |
| 多人协同 | 支持 | 支持 |
| 多模块开发 | 动态支持 | 动态支持 |
| 静态资源位置优化、去重 | 支持 | 支持 |
| 静态资源按需加载、combo | 不支持 | 支持 |
| 远程deploy方式 | http | http/ftp |
npm install -g feather2
feather2 init demo
feather2 release -r demo
feather2 server start
parser阶段
hook
preprocessor阶段
postpackager阶段
FAQs
feather2.0
The npm package feather2 receives a total of 24 weekly downloads. As such, feather2 popularity was classified as not popular.
We found that feather2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.