Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
isolated-externals-plugin
Advanced tools
[![Build Status](https://travis-ci.com/WTW-IM/isolated-externals-plugin.svg?branch=master)](https://travis-ci.com/github/WTW-IM/isolated-externals-plugin) [![npm version](https://badge.fury.io/js/isolated-externals-plugin.svg)](https://badge.fury.io/js/is
To install, simply run:
npm install --save-dev isolated-externals-plugin
The IsolatedExternalsPlugin
allows you to load external dependencies inside the scope of your webpack bundle without having to have them in your global scope. If you're curious about why you might want this, there are some use cases listed below.
It's an opinionated plugin in this way:
IsolatedExternalsPlugin
utilize externalsType.promise
, which utilizes async
/await
syntax.The plugin is built as an ES Module, so you'll need to load it in by using the default
property:
const IsolatedExternalsPlugin = require('isolated-externals-plugin').default;
An IsolatedExternalsPlugin
configuration might look like the following:
new IsolatedExternalsPlugin({
entry1: {
react: {
url: 'https://unpkg.com/react@16/umd/react.development.js',
globalName: 'React',
},
['react-dom']: {
url: 'https://unpkg.com/react-dom@16/umd/react-dom.development.js',
globalName: 'ReactDOM',
},
},
entry2: {
react: {
url: 'https://unpkg.com/react@16/umd/react.development.js',
globalName: 'React',
},
['react-dom']: {
url: 'https://unpkg.com/react-dom@16/umd/react-dom.development.js',
globalName: 'ReactDOM',
},
},
});
Each property of the configuration follows this structure:
[entryName]: {
[packageName]: {
url: [url],
globalName: [globalName]
}
}
Part | Description |
---|---|
entryName * | The name of one of your webpack Entry Points. |
packageName * | The name of the import for your externalized dependency (like 'react-dom'). |
url * | The URL from which to load your dependency file. |
globalName | The UMD name of your dependency (like ReactDOM ). If this is not provided, IsolatedExternalsPlugin will try to match the packageName to one of your externals entries, and will use the value from that as the globalName |
* | required |
The external files will be loaded and applied to your context in the order that they're listed, so if you have dependencies that depend on other dependencies (like ReactDOM
depends on React
), then you'll want to make sure you list the ones they depend on first.
IsolatedExternalsPlugin
loads the text of your externals URLs via a shared Cache (or a shared global object if Cache
is not available), and processes the text on a context object which is singular to your bundle. This allows you to load multiple bundles per page with different versions of a dependency—or with the same version of a dependency separately—without polluting a global scope, and without loading the same dependency over the wire more than once. This keeps bundle sizes down while also providing complete autonomy to any individual JS bundle.
Here are two valid use cases. There may be others, but these are the reason we built this plugin!:
This package uses semantic-release
. Changes will be compiled into a changelog and the package versioned, tagged and published automatically.
Please ensure your commit messages adhere to the following structure:
<type>: <subject>
<BLANK LINE>
<body>
Only the header is mandatory. The supported types are based off of the ESLint Convention.
FAQs
![Build Status](https://github.com/im-open/isolated-externals-plugin/actions/workflows/main.yml/badge.svg) [![npm version](https://badge.fury.io/js/isolated-externals-plugin.svg)](https://badge.fury.io/js/isolated-externals-plugin)
The npm package isolated-externals-plugin receives a total of 424 weekly downloads. As such, isolated-externals-plugin popularity was classified as not popular.
We found that isolated-externals-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.