
Security News
Rust RFC Proposes a Security Tab on crates.io for RustSec Advisories
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.
import-maps-webpack-plugin
Advanced tools
A plugin for providing static import maps support to Webpack.
The import-maps-webpack-plugin module for declaring / using import maps. These externals will not be bundled in directly, but only be loaded if not already present. :rocket:
It follows pretty much the parcel-plugin-import-maps implementation.
To begin, you'll need to install import-maps-webpack-plugin:
npm install import-maps-webpack-plugin --save-dev
You can now add a new key to your package.json: importmap. The key can either hold an importmap structure (see specification) or a reference to a valid JSON file holding the structure.
Example for the containing the structure in the package.json:
{
"name": "my-app",
"version": "1.0.0",
"devDependencies": {
"webpack": "4.x",
"import-maps-webpack-plugin": "latest"
},
"importmap": {
"imports": {
"/app/helper": "node_modules/helper/index.mjs",
"lodash": "./node_modules/lodash-es/lodash.js"
}
}
}
Alternative version:
{
"name": "my-app",
"version": "1.0.0",
"devDependencies": {
"webpack": "4.x",
"import-maps-webpack-plugin": "latest"
},
"importmap": "./my-imports.json"
}
where the my-imports.json looks like
{
"imports": {
"/app/helper": "node_modules/helper/index.mjs",
"lodash": "./node_modules/lodash-es/lodash.js"
}
}
With this equipped the given modules are loaded asynchronously at the beginning of the application. If multiple applications with import maps are loaded then the dependencies are either shared or not shared depending on their individual hashes.
This ensures proper dependency isolation while still being able to share what makes sense to be shared.
Most importantly, the plugin allows you to place scripts from other locations easily without bundling them in:
{
"imports": {
"lodash": "https://cdn.jsdelivr.net/npm/lodash@4.17.15/lodash.min.js"
}
}
For proper IDE (or even TypeScript) usage we still advise to install the respective package or at least its bindings locally.
The required import maps are loaded at startup asynchronously. Therefore, you'd need to wait before using them.
Unfortunately, in the current version this cannot be done implicitly (reliably), even though its desired for the future.
Right now the only way is to change code like (assumes lodash is used from an import map like above)
//app.js
import * as _ from 'lodash';
const _ = require('lodash');
export const partitions = _.partition([1, 2, 3, 4], n => n % 2);
});
to be
//app.js
require('importmap').ready().then(() => {
const _ = require('lodash');
return {
partitions: _.partition([1, 2, 3, 4], n => n % 2),
};
});
or, alternatively (more generically),
//index.js
module.exports = require('importmap').ready().then(() => require('./app'));
//app.js
import * as _ from 'lodash';
const _ = require('lodash');
export const partitions = _.partition([1, 2, 3, 4], n => n % 2);
});
You could also trigger the loading already in the beginning, i.e.,
//app.js
require('importmap');
// ...
//other.js
require('importmap').ready('lodash').then(() => {
// either load or do something with require('lodash')
});
where we use ready with a single argument to determine what package should have been loaded to proceed. This is the deferred loading approach. Alternatively, an array with multiple package identifiers can be passed in.
(No options yet.)
The following examples show how one might use import-maps-webpack-plugin and what the result would be.
Using the plugin is as simple as just importing the ImportMapsWebpackPlugin class and providing an instance of it to the webpack configuration.
Example:
import { ImportMapsWebpackPlugin } from 'import-maps-webpack-plugin';
module.exports = {
// ... standard webpack
plugins: [
new ImportMapsWebpackPlugin(),
],
};
This will the importmap virtual module and its API. All dependencies are then specified as via the given import maps specification.
Contributions in any form are appreciated and much welcome!
Just make sure to post an issue or reach out to me on Gitter before starting actual work on anything. It really helps to avoid problems.
This plugin is released using the MIT license.
0.6.8 (May 25, 2021)
v0 bannerSuffix logic.FAQs
A plugin for providing static import maps support to Webpack.
The npm package import-maps-webpack-plugin receives a total of 155 weekly downloads. As such, import-maps-webpack-plugin popularity was classified as not popular.
We found that import-maps-webpack-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.

Security News
/Research
Socket found a Rust typosquat (finch-rust) that loads sha-rust to steal credentials, using impersonation and an unpinned dependency to auto-deliver updates.

Research
/Security Fundamentals
A pair of typosquatted Go packages posing as Google’s UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.