Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Enables the use of variables in JSON and JSON-like configuration files
npm i --save json-vars
const jVars = require('json-vars')
const config = {
foo: {
bar: '${env:BAR|default("bar")}'
},
baz: 'foo.bar is equal to ${self:foo.bar}'
}
jVars.resolve(config).then( res => console.log(res) )
// Output => {
// foo: {
// bar: 'bar'
// },
// baz: 'foo.bar is equal to bar'
// }
Scope, Variable and Transformer's names can contain any letter,
number, -
, .
or _
.
An Argument can be any string, number or boolean. String Arguments can contain the same character set of names.
If it's needed, a Variable's name or a string Argument can be wrapped in single or double quotes, in which case any character is allowed.
The Scope indicates to json-vars
the context on which it should resolve the
Variable's name.
A Transformer can modify the value coming from the Scope before the final substitution happens. If multiple Transformers are chained, they are applied left to right.
Variables can also be placed inside a Variable's name or a string Argument, this works only for unquoted strings.
So in "${self:foo.${env:ENV_VAR}}"
the inner Variable will be resolved and
replaced before the outer variale, while in "${self:'foo.${env:ENV_VAR}'}"
the outer Variable's name will be left as is.
Once a Variable is resolved, its placeholder gets replaced with its resolved value.
There are two possible replacement methods:
{
"num": 42,
"stringified": "num is ${self:num}",
"preserved": "${self:num}"
}
// becomes
{
"num": 42,
"stringified": "num is 42",
"preserved": 42
}
env
Resolves the Variable against the current shell environment.
self
References another property of the current input object.
default(<defaultValue>)
Recover failures and return defaultValue
, otherwise it has no effect.
To run tests:
npm test
npm run lint
FAQs
Enables the use of variables in JSON and JSON-like configuration files
The npm package json-vars receives a total of 1 weekly downloads. As such, json-vars popularity was classified as not popular.
We found that json-vars demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.