Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Control concurrency of gulp tasks.
Gulp always attempts to run tasks with "maximum concurrency".
While this is usually a good thing, there are occasions where contention
over constrained resources (disk, network, memory, etc) can cause problems.
You could use something like gulp-sequence
to limit concurrency,
but that requires you to build a specific sequence for every scenario
and essentially fights against gulps task orchestrator.
gulp-lock
helps you limit concurrency only where needed.
Consider the following diagram:
Properly orchestrating these tasks presents a few difficulties; Which task will be ready to run first? What if it varies (network congestion, etc)? How do you compose them as dependencies to other tasks in a non-verbose way?
gulp-lock
allows you to simply identify contentious tasks, wrap them with a lock,
and then compose them with other tasks as you normally would.
var lock = require('gulp-lock');
var diskLock = lock(2); // create a lock with a concurrency limit of 2
var networkLock = lock(); // create a lock with default concurrency limit (1).
gulp.task('disk-task1', ['dependency'], diskLock.stream(function() {
return gulp.src(/*...*/)
.pipe(/*...*/)
// ...
});
// disk-task2 ... disk-taskN - only two will run at once.
gulp.task('net-task1', ['dependency'], networkLock.cb(function(cb) {
// ...
});
A lock object provides three different wrapper methods for your task.
lock.cb(taskFunc)
wraps a task method that takes a completion callback.
Once the concurrency limit is reached, tasks will queue until a task
releases it's hold on the lock by calling the callback.lock.stream(taskFunc)
wraps a task method that returns a stream.
(i.e. return gulp.src(...)
). A task releases its hold on a lock
when the returned stream ends.lock.promise(taskFunc)
wraps a task that returns a promise. Tasks
release their hold on the lock when the promise is resolved.These are the three forms of asynchronous tasks allowed by gulps orchestrator, so you should be able to wrap any async task with minimal effort. Gulp does allow a fourth task type, the synchronous type. Since javascript is single threaded synchronous tasks already enforce a lock with a concurrency of 1, so there would be no point in providing a wrapper.
Tasks are queued for execution for by gulps orchestrator. Whichever task has it's dependencies met first will be queued first. This is an attempt to maximize concurrency (within the limits set by the lock).
FAQs
control concurrency of gulp tasks.
The npm package gulp-lock receives a total of 506 weekly downloads. As such, gulp-lock popularity was classified as not popular.
We found that gulp-lock demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.