Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
This is a simple package that pulls in a lot of boilerplate grunt logic for a reusable javascript module.
Install grunt and grunt-dry using NPM:
npm install --save-dev grunt grunt-dry
Then create a gruntfile.js containing:
module.exports = function(grunt) {
grunt.initConfig({
gruntDry: {
pkg: grunt.file.readJSON('package.json');
}
});
grunt.task.loadNpmTasks('grunt-dry');
});
Then run the following grunt tasks:
grunt build
Uses grunt-pure-cjs to generate browser/<module_name>.js and browser/specs/*.spec.js by bundling the commonjs files into a single file for both the module itself and any mocha spec files.
Each file is generated using a umd wrapper so it can be loaded through a variety of front-end module systems.
grunt test
Runs unit tests using server-side mocha in node.js from specs/*.js
and in browser using `browser/specs/*.js.
All tests are loaded using requirejs.
If the module and/or the tests requires external dependencies, they should be included in the deps
option of the grunt config. Each entry should contain a path to the browser build of the module as well as an optional flag to indicate if it is test-only.
For example the following configuration would indicate that the library depends on underscore
and the tests also depend on chai
:
deps: {
'underscore': {
browserBuild: 'node_modules/underscore/underscore.js'
},
'chai': {
browserBuild: 'node_modules/chai/chai.js',
testOnly: true
}
}
See grunt-dry-test/gruntfile.js for a complete working example.
The configuration supports the following options:
node_modules/grunt-dry
.FAQs
grunt scaffolding for reusable modules
The npm package grunt-dry receives a total of 1 weekly downloads. As such, grunt-dry popularity was classified as not popular.
We found that grunt-dry demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.