Security News
JSR Working Group Kicks Off with Ambitious Roadmap and Plans for Open Governance
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
jscodeshift
Advanced tools
jscodeshift is a toolkit for running codemods over multiple JavaScript or TypeScript files. It provides a runner as well as a wrapper around the recast AST toolkit, making it easier to write codemods that can transform code and assist in large-scale codebase refactors or migrations.
Transforming Syntax
This feature allows you to transform the syntax of JavaScript code. For example, the code sample provided changes all variable declarations to use 'const' instead of 'var' or 'let'.
const jscodeshift = require('jscodeshift');
const transform = (fileInfo, api) => {
const j = api.jscodeshift;
return j(fileInfo.source)
.find(j.VariableDeclaration)
.forEach(path => {
j(path).replaceWith(
j.variableDeclaration('const', path.node.declarations)
);
})
.toSource();
};
Code Analysis
jscodeshift can be used to analyze code and extract information. In this example, the code collects all the identifiers from a JavaScript file.
const jscodeshift = require('jscodeshift');
const analyze = (fileInfo, api) => {
const j = api.jscodeshift;
const root = j(fileInfo.source);
const identifiers = [];
root.find(j.Identifier).forEach(path => {
identifiers.push(path.node.name);
});
return identifiers;
};
Refactoring
The package can be used to perform refactoring tasks, such as renaming functions across a codebase. The provided code sample renames all function declarations to 'newFunctionName'.
const jscodeshift = require('jscodeshift');
const refactor = (fileInfo, api) => {
const j = api.jscodeshift;
return j(fileInfo.source)
.find(j.FunctionDeclaration)
.renameTo('newFunctionName')
.toSource();
};
babel-codemod rewrites JavaScript and TypeScript using Babel plugins. It is similar to jscodeshift but leverages the Babel ecosystem, which might be more familiar to some developers. It also supports the latest JavaScript features and TypeScript out of the box.
lebab is a tool that transforms legacy JavaScript code into modern, readable, and maintainable code using ES6+ syntax. It is similar to jscodeshift in its goals but is more opinionated and focused on upgrading to modern JavaScript syntax.
jscodeshift is a toolkit for running codemods over multiple JS files. It provides:
Get jscodeshift from npm:
$ npm install -g jscodeshift
This will install the runner as jscodeshift
.
The CLI provides the following options:
$ jscodeshift --help
Usage: jscodeshift <path>... [options]
path Files or directory to transform
Options:
-t FILE, --transform FILE Path to the transform file. Can be either a local path or url [./transform.js]
-c, --cpus (all by default) Determines the number of processes started.
-v, --verbose Show more information about the transform process [0]
-d, --dry Dry run (no changes are made to files)
-p, --print Print output, useful for development
--babel Apply Babel to transform files [true]
--extensions File extensions the transform file should be applied to [js]
--ignore-pattern Ignore files that match a provided glob expression
--ignore-config FILE Ignore files if they match patterns sourced from a configuration file (e.g., a .gitignore)
--run-in-band Run serially in the current process [false]
-s, --silent No output [false]
--parser The parser to use for parsing your source files (babel | babylon | flow) [babel]
--version print version and exit
This passes the source of all passed through the transform module specified
with -t
or --transform
(defaults to transform.js
in the current
directory). The next section explains the structure of the transform module.
The transform is simply a module that exports a function of the form:
module.exports = function(fileInfo, api, options) {
// transform `fileInfo.source` here
// ...
// return changed source
return source;
};
fileInfo
Holds information about the currently processed file.
Property | Description |
---|---|
path | File path |
source | File content |
api
This object exposes the jscodeshift
library and helper functions from the
runner.
Property | Description |
---|---|
jscodeshift | A reference to the jscodeshift library |
stats | A function to collect statistics during --dry runs |
jscodeshift
is a reference to the wrapper around recast and provides a
jQuery-like API to navigate and transform the AST. Here is a quick example,
a more detailed description can be found below.
/**
* This replaces every occurrence of variable "foo".
*/
module.exports = function(fileInfo, api) {
return api.jscodeshift(fileInfo.source)
.findVariableDeclarators('foo')
.renameTo('bar')
.toSource();
}
Note: This API is exposed for convenience, but you don't have to use it. You can use any tool to modify the source.
stats
is a function that only works when the --dry
options is set. It accepts
a string, and will simply count how often it was called with that value.
At the end, the CLI will report those values. This can be useful while developing the transform, e.g. to find out how often a certain construct appears in the source(s).
options
Contains all options that have been passed to runner. This allows you to pass additional options to the transform. For example, if the CLI is called with
$ jscodeshift -t myTransforms fileA fileB --foo=bar
options
would contain {foo: 'bar'}
. jscodeshift uses nomnom to parse
command line options.
The return value of the function determines the status of the transformation:
The CLI provides a summary of the transformation at the end. You can get more
detailed information by setting the -v
option to 1
or 2
.
You can collect even more stats via the stats
function as explained above.
The transform can let jscodeshift know with which parser to parse the source files (and features like templates).
To do that, the transform module can export parser
, which can either be one
of the strings "babel"
, "babylon"
, or "flow"
, or it can be a parser
object that is compatible with recast.
For example:
module.exports.parser = 'flow'; // use the flow parser
// or
module.exports.parser = {
parse: function(source) {
// return estree compatible AST
},
};
$ jscodeshift -t myTransform.js src
Processing 10 files...
Spawning 2 workers with 5 files each...
All workers done.
Results: 0 errors 2 unmodified 3 skipped 5 ok
As already mentioned, jscodeshift also provides a wrapper around recast. In order to properly use the jscodeshift API, one has to understand the basic building blocks of recast (and ASTs) as well.
An AST node is a plain JavaScript object with a specific set of fields, in
accordance with the Mozilla Parser API. The primary way to identify nodes
is via their type
.
For example, string literals are represented via Literal
nodes, which
have the structure
// "foo"
{
type: 'Literal',
value: 'foo',
raw: '"foo"'
}
It's OK to not know the structure of every AST node type. The (esprima) AST explorer is an online tool to inspect the AST for a given piece of JS code.
Recast itself relies heavily on ast-types which defines methods to traverse the AST, access node fields and build new nodes. ast-types wraps every AST node into a path object. Paths contain meta-information and helper methods to process AST nodes.
For example, the child-parent relationship between two nodes is not explicitly
defined. Given a plain AST node, it is not possible to traverse the tree up.
Given a path object however, the parent can be traversed to via path.parent
.
For more information about the path object API, please have a look at ast-types.
To make creating AST nodes a bit simpler and "safer", ast-types defines a couple
of builder methods, which are also exposed on jscodeshift
.
For example, the following creates an AST equivalent to foo(bar)
:
// inside a module transform
var j = jscodeshift;
// foo(bar);
var ast = j.callExpression(
j.identifier('foo'),
[j.identifier('bar')]
);
The signature of each builder function is best learned by having a look at the definition files.
In order to transform the AST, you have to traverse it and find the nodes that need to be changed. jscodeshift is built around the idea of collections of paths and thus provides a different way of processing an AST than recast or ast-types.
A collection has methods to process the nodes inside a collection, often resulting in a new collection. This results in a fluent interface, which can make the transform more readable.
Collections are "typed" which means that the type of a collection is the
"lowest" type all AST nodes in the collection have in common. That means you
cannot call a method for a FunctionExpression
collection on an Identifier
collection.
Here is an example of how one would find/traverse all Identifier
nodes with
jscodeshift and with recast:
// recast
var ast = recast.parse(src);
recast.visit(ast, {
visitIdentifier: function(path) {
// do something with path
return false;
}
});
// jscodeshift
jscodeshift(src)
.find(jscodeshift.Identifier)
.forEach(function(path) {
// do something with path
});
To learn about the provided methods, have a look at the Collection.js and its extensions.
jscodeshift provides an API to extend collections. By moving common operators into helper functions (which can be stored separately in other modules), a transform can be made more readable.
There are two types of extensions: generic extensions and type-specific extensions. Generic extensions are applicable to all collections. As such, they typically don't access specific node data, but rather traverse the AST from the nodes in the collection. Type-specific extensions work only on specific node types and are not callable on differently typed collections.
// Adding a method to all Identifiers
jscodeshift.registerMethods({
logNames: function() {
return this.forEach(function(path) {
console.log(path.node.name);
});
}
}, jscodeshift.Identifier);
// Adding a method to all collections
jscodeshift.registerMethods({
findIdentifiers: function() {
return this.find(jscodeshift.Identifier);
}
});
jscodeshift(ast).findIdentifiers().logNames();
jscodeshift(ast).logNames(); // error, unless `ast` only consists of Identifier nodes
You may want to change some of the output settings (like setting '
instead of "
).
This can be done by passing config options to recast.
.toSource({quote: 'single'}); // sets strings to use single quotes in transformed code.
You can also pass options to recast's parse
method by passing an object to
jscodeshift as second argument:
jscodeshift(source, {...})
More on config options here
jscodeshift comes with a simple utility to allow easy unit testing with Jest, without having to write a lot of boilerplate code. This utility makes some assumptions in order to reduce the amount of configuration required:
__tests__
)__testfixtures__
directoryThis results in a directory structure like this:
/MyTransform.js
/__tests__/MyTransform-test.js
/__testfixtures__/MyTransform.input.js
/__testfixtures__/MyTransform.output.js
To define a test, use defineTest
or defineInlineTest
from the testUtils
module. A simple example is bundled in the sample directory.
defineTest
jest.autoMockOff();
const defineTest = require('jscodeshift/dist/testUtils').defineTest;
defineTest(__dirname, 'MyTransform');
An alternate fixture filename can be provided as the fourth argument to defineTest
. This also means that multiple test fixtures can be provided:
defineTest(__dirname, 'MyTransform', null, 'FirstFixture');
defineTest(__dirname, 'MyTransform', null, 'SecondFixture');
This will run two tests: One for __testfixtures__/FirstFixture.input.js
and one for __testfixtures__/SecondFixture.input.js
defineInlineTest
const transform = require('../myTransform');
defineInlineTest(transform, {}, 'input', 'expected output', 'test name (optional)');
FAQs
A toolkit for JavaScript codemods
The npm package jscodeshift receives a total of 5,307,175 weekly downloads. As such, jscodeshift popularity was classified as popular.
We found that jscodeshift demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
Security News
Research
An advanced npm supply chain attack is leveraging Ethereum smart contracts for decentralized, persistent malware control, evading traditional defenses.
Security News
Research
Attackers are impersonating Sindre Sorhus on npm with a fake 'chalk-node' package containing a malicious backdoor to compromise developers' projects.