Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
generator-custom-template
Advanced tools
This monorepo contains multiple packages that help create and publish custom stories for the News Design and Graphics departments. They can all be found in the `/packages` directory.
This monorepo contains multiple packages that help create and publish custom stories for the News Design and Graphics departments. They can all be found in the /packages
directory.
bespoke-tool
Bootstrap an Apple News story inside a custom template projectcreate-custom-template
Create a custom template project with one commandcustom-template
The Next.js template created by the create-custom-template packagecustom-template-utils
Utility functions to share across custom template packages and projectspub-tool
A CLI tool for publishing custom-template projectsThere are a few sources of documentation, other than this README:
npm run storybook
.Read more on how to best contribute to this project in our contributing guide.
If you run into issues, a more comprehensive getting started guide is in the Custom Template Onboarding guide.
The codebase runs on Node version 20.11.0
and npm 10.2.4
. We manage the version of Node and npm with nvm.
nvm
with these instructions.nvm use
. You may be prompted to install the version of Node. The output should be "Now using node v20.11.0 (npm 10.2.4)".npm i -g npm@10.2.4
and then check the version with npm --version
.npm install
from the repo's root. This will install all dependencies for all of our monorepo packages at once, and properly symlink them.You'll need to create a configuration file in your home directory. Follow these steps to create one.
This template fetches and saves environment variables via AWS Systems Manager Parameter Store. Follow these instruction to set up your pub
or newseng
profile. When running npm install
you will be asked at the end to confirm your AWS access to download .env
files.
Releases are staged and tested in an automated "Next Release" PR that collects all changes to dev. Release are made by following the steps below. Merging the "Next Release" PR will kick off a Lerna workflow that creates a Github tag, Github release, changelogs for each package, and publishing packages to npm. Reach out in the #template-custom if you need a release and we can walk through the process.
main
back into dev
and ‼️create a merge commit‼️ back to dev. Call the PR chore: Sync dev with main
Before we do a full release, we want to ensure someone can create, run, and publish a story from the dev branch. Run though the following steps:
dev
branch locally and run npm install
to ensure you have all the latest packages.npm run create-test-project
JNG2MGCOENBY3K4GJFWF3U3C6Q
.cd
into the new project’s directory and run npm start
to make sure you can start a project with no errors.npm run pub
and make a test pub.npm run pub
and make a live pub. The utils ellipsis ID above prevents the page from being publicly accessible. Check to make sure the live pub has /utils in the URL. If not, reach out for help in the #custom-template Slack channel.After we do a release, we want to ensure the same process works from the npm package. Run though the following steps that are similar to the pre-release steps:
npx @washingtonpost/create-custom-template@latest
.JNG2MGCOENBY3K4GJFWF3U3C6Q
.cd
into the new project’s directory and check that the package.json version matches the recent release version number.npm start
to make sure the project starts with no errors.npm run pub
and make a test pub.npm run pub
and make a live pub. The utils ellipsis ID above prevents the page from being publicly accessible. Check to make sure the live pub has /utils in the URL. If not, reach out for help.npm run lerna-publish:beta
A version should not be updated after a release! If there was an issue with a release, release another new version.
Lerna looks at the conventional commits to determine what what features and fixes to place in the change log. Sometimes commits make it in with the wrong package, type, or typos. You can amend those note by updating the CHANGELOG.md and updating the release notes in Github.
Sometimes we need to do a release to get one feature or fix out quickly without merging all changes from dev with the "Next Release" PR. To do this, follow these steps:
main
and check it out locally.git cherry-pick
with the commit hash you want to release.main
and ensure all tests pass.main
. Read the release process to learn how.main
.main
back into dev
to sync the new versions and changes.If we've introduced an important fix to a newer version of a package, we can selectively grab an older version and apply the fix for older projects:
git checkout [Commit ID]
git checkout -b hotfix-[package name]
cd
into the package you are needing to make a fix to. i.e. cd generator-custom-template/packages/pub-tool
package.json
. For example, increment the pub-tool
package.json version from 1.7.2
to 1.7.3
.npm publish
.Dependabot will diligently and somewhat ruthlessly remind us about what packages are behind. You can merge in each PR at a time on github, but that can be risky if it's a major bump or maybe breaks something in our build. The best way is to make a new PR with all the open PRs and test them together locally.
bump-dependencies
nvm use
to make sure you are using the right version of node and npm (this will affect the package lock version).npm i
in the root to make sure the new dependencies install correctly and you get a new package-lock.json. We use npm's workspaces
under the hood which knows how to communicate with all of our monorepo packages and will properly update/symlink as needed. There should only be one package-lock.json file and it will be in the root.npm run start
npm t
npm run build-storybook
cd packages/create-custom-template/template
and run npm run prod-preview
npm run pub
and make a test pub can be a nice check too if the pub tool was updatedKeep in mind the script on test 8 will run throughout the development and release process, but it's easier to catch dependencies errors now than later.
The <Story>
component doesn’t like siblings as first descendants. Avoid that by wrapping them in Fragment/<>
or divs.
To download a dropbox paper or google sheet, you can run npm run download
in the template directory.
For Ellipsis stories, your story is automatically re-downloaded every time you hit save on a file inside the src
folder in your project.
A fun alternative to all of the above: You can create a bookmark tab in your browser that will download any type of story you have listed. To do so, create the bookmark first, then set its link to: javascript:(fetch(window.location.href + 'update').then(f=>console.log('updated stories')))
FAQs
This monorepo contains multiple packages that help create and publish custom stories for the News Design and Graphics departments. They can all be found in the `/packages` directory.
We found that generator-custom-template demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.