Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
hooks.macro
Advanced tools
Babel Macros for React Hooks automatic memoization invalidation.
Extracts all references used, and adds them to the inputs array.
Favors strict correctness over performance, but uses safe optimizations:
skips constants and useless memoization keys;
traverses all functions called or referenced, and appends their dependencies too, removing the need for unnecessary useCallback
hooks.
By lowering the bar for high correctness, strives to:
make the use of useAutoMemo
and useAutoCallback
simple and applicable in many more contests;
reduce the overhead of modifying an input’s semantics (for example from a constant to a prop);
reduce to the bare minimum cases of missed inputs — and therefore stale memoizations or effects.
Thoroughly tested: 50+ test cases and 100% code coverage.
ref.current
).useAutoMemo
them!auto()
generic macro to be used with other hooks and APIs with the same signature.Requires babel-plugin-macros
, which is already configured for you if you are using Create React App v2+.
npm install --dev hooks.macro
yarn add --dev hooks.macro
Replace:
import { useMemo } from 'react';
function MyComponent({ labels }) {
const myComputation = useMemo(
() => labels.map(label => label.toUpperCase()),
[labels],
);
}
With:
import { useAutoMemo } from 'hooks.macro';
function MyComponent({ labels }) {
const myComputation = useAutoMemo(() =>
labels.map(label => label.toUpperCase()),
);
}
Or even:
import { useAutoMemo } from 'hooks.macro';
function MyComponent({ labels }) {
const myComputation = useAutoMemo(labels.map(label => label.toUpperCase()));
}
useAutoMemo
Exactly like React’s useMemo
but automatically identifies value dependencies.
Can be passed a factory function or directly a value, will convert the latter to a function for you.
import { useAutoMemo } from 'hooks.macro';
useAutoMemo(value);
useAutoMemo(() => value);
Both become:
useMemo(() => value, [value]);
useAutoCallback
Exactly like React’s useCallback
but automatically identifies value dependencies.
import { useAutoCallback } from 'hooks.macro';
useAutoCallback(() => {
doSomethingWith(value);
});
Becomes:
useCallback(() => {
doSomethingWith(value);
}, [doSomethingWith, value]);
useAutoEffect
, useAutoLayoutEffect
They work exactly like their standard React counterpart, but they automatically identify value dependencies.
import { useAutoEffect, useAutoLayoutEffect } from 'hooks.macro';
useAutoEffect(() => {
doSomethingWith(value);
});
Becomes:
useEffect(() => {
doSomethingWith(value);
}, [doSomethingWith, value]);
To make this work I currently needed to pose some limitations. This could change in the future (PR very welcome).
Only variables created in the scope of the component body are automatically trapped as value dependencies.
Only variables, and not properties’ access, are trapped. This means that if you use obj.prop
only [obj]
will become part of the memoization invalidation keys. This is a problem for refs, and will be addressed specifically in a future release.
You can work around this limitation by creating a variable which holds the current value, such as const { current } = ref
.
Currently there’s no way to add additional keys for more fine grained cache invalidation. Could be an important escape hatch when you do nasty things, but in that case I’d prefer to use useMemo
/useCallback
directly.
Only locally defined functions declarations and explicit function expressions (let x = () => {}
) are traversed for indirect dependencies — all other function calls (such as xxx()
) are treated as normal input dependencies and appended too. This is unnecessary (but not harmful) for setters coming from useState
, and not an issue at all if the function is the result of useCallback
or useAutoCallback
.
React documentation about useMemo
and use*Effect
hooks cites: (emphasis mine)
The array of inputs is not passed as arguments to the function. Conceptually, though, that’s what they represent: every value referenced inside the effect function should also appear in the inputs array. In the future, a sufficiently advanced compiler could create this array automatically.
This project tries to cover exactly that: to create the inputs array automatically.
MIT
FAQs
> Babel Macros for React Hooks automatic memoization invalidation.
We found that hooks.macro demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.