Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
isolated-externals-plugin
Advanced tools
[![Build Status](https://travis-ci.com/WTW-IM/isolated-externals-plugin.svg?branch=master)](https://travis-ci.com/github/WTW-IM/isolated-externals-plugin) [![npm version](https://badge.fury.io/js/isolated-externals-plugin.svg)](https://badge.fury.io/js/is
To install, simply run:
npm install --save-dev isolated-externals-plugin
The IsolatedExternalsPlugin
allows you to load external dependencies into the scope of your webpack bundle without having to have them in your global scope. If you're curious about why you might want this, there are some use cases listed below.
The plugin is built as an ES Module, so you'll need to load it in by using the default
property:
const IsolatedExternalsPlugin = require('isolated-externals-plugin').default;
It currently only works with UMD javascript dependencies, and with an externals
declaration that has a similar shape to this:
...
externals: {
["react-dom"]: "ReactDOM",
react: "React",
},
...
For the externals
above, your IsolatedExternalsPlugin
configuration might look like the following:
new IsolatedExternalsPlugin({
entryName: {
react: {
url: 'https://unpkg.com/react@16/umd/react.development.js'
},
['react-dom']: {
url: 'https://unpkg.com/react-dom@16/umd/react-dom.development.js'
}
}
});
entryName
, in this instance, is the name of one of your webpack Entry Points.
The external files will be loaded and applied to your context in the order that they're listed, so if you have dependencies that depend on other dependencies (like ReactDOM
depends on React
), then you'll want to make sure you list the ones they depend on first.
IsolatedExternalsPlugin
wraps your webpack bundle in a self-calling function, evaluating the external dependencies and your bundle with an in-memory context object. This allows those external dependencies to only exist on that in-memory context, and will not require them to exist on the broader global context.
Here are two valid use cases. There may be others, but these are the reason we built this plugin!:
This package uses semantic-release
. Changes will be compiled into a changelog and the package versioned, tagged and published automatically.
Please ensure your commit messages adhere to the following structure:
<type>: <subject>
<BLANK LINE>
<body>
Only the header is mandatory. The supported types are based off of the ESLint Convention.
FAQs
![Build Status](https://github.com/im-open/isolated-externals-plugin/actions/workflows/main.yml/badge.svg) [![npm version](https://badge.fury.io/js/isolated-externals-plugin.svg)](https://badge.fury.io/js/isolated-externals-plugin)
The npm package isolated-externals-plugin receives a total of 424 weekly downloads. As such, isolated-externals-plugin popularity was classified as not popular.
We found that isolated-externals-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.