Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Gear.js is a scriptable build system using simple tasks that act like a sequence of piped commands.
Features include:
To get the most out of Gear.js, you will want to install gear-lib which contains tasks for linting, minifying, and deploying JS/CSS assets.
$ npm install gear
$ npm install gear-lib
new Queue()
.load('foo.js')
.log('read foo.js')
.inspect()
.write('foobarbaz.js')
.run();
new Queue()
.load(['foo.js', {name: 'bar.js'}, 'baz.js'])
.log('read foo.js')
.inspect()
.write(['newfoo.js', 'newbar.js']) // Not writing 'baz.js'
.run();
new Queue()
.load('foo.js')
.log('Complex Task')
.tasks({
read: {task: 'load', options: ['foo.js', 'bar.js', 'baz.js']}
combine: {task: 'concat', requires: 'read'}
minify: {task: 'jsminify', requires: 'combine'}
print: {task: 'inspect', requires: ['read', 'combine', 'minify']} // Runs when read, combine, and minify complete
parallel: {task: 'log', options: "Hello gear world!"} // Run parallel to read
}).run();
Queue constructor.
Arguments
Example
new Queue()
.log('test')
.run();
Helper method to run the specified task. Preferred task execution style is to call the task directly i.e. inspect()
instead of task('inspect')
.
Arguments
Example
new Queue()
.task('log', 'Hello, world!')
.run();
Runs the queue.
Arguments
Example
new Queue()
.log('test')
.run();
Creates a new Registry instance. Registries contain available tasks.
Arguments
Example
new Registry();
Load tasks from NPM, directory, or file.
Arguments
Example
new Registry().load({dirname: 'foo'});
Loads blobs from different sources.
Arguments
Example
// source - Filename or object to load.
// source.name - Filename of resource.
.load('foo')
.load(['foo', 'baz'])
.load([{name: 'foo'}, {name: 'bar'}, {name: 'baz'}])
Arguments
Write the blob to disk.
Example
.write('foo')
.write({name: 'foo'})
Concatenates blobs.
Example
.concat()
Inspects blobs.
Example
.inspect()
Arguments
Log a message.
Example
.log('Finished')
Arguments
Execute tasks in parallel with optional dependencies. Data is joined on completion.
Example
// label - Task instance name.
// label.task - Task name.
// label.options - Task options.
// label.requires - List of labels that must be executed before this task runs.
.tasks({
label_1: {task: 'log', options: 'Hello, world!'}
label_2: {task: 'log', options: 'Hello, world 2!', requires: 'label_1'}
})
## Library Tasks
Install gear-lib which contains tasks such as:
$ npm install gear-lib
## Custom Tasks
Writing a task is especially easy compared to other Node build systems. There is no need to use Gear.js internals within a task. Tasks operate on immutable blobs. Blobs have a body property. The task returns transformed data via its callback.
Arguments
Example
// example.js
// Example task creates new blob containing `string`
exports.example = function(string, blob, done) {
done(null, new blob.constructor(string)); // blob.constructor() is equivalent to Blob()
};
Running Example Task
new Queue({registry: new Registry({filename: 'example.js'})})
.example('EXAMPLE')
.run();
Gear.js takes inspiration from a few sources:
FAQs
Gear.js - Build System for Node.js and the Browser
We found that gear demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.