
Security News
Package Maintainers Call for Improvements to GitHub’s New npm Security Plan
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Multi tier configuration loader as a package
The conf package reads configurations options in an overriding fashion from a number of sources. In order of importance:
Overrides can not be overriden or changed at any point in time. The are defined in conf/lib/overrides.js
and should be reserved for static run time properties. Conf serves as a central place to get that information.
For example, the full path to the packages directory is resolved at run time and loaded in to the conf loader. It won't / can't change during run time, but may change in the future. By getting the information from conf, application logic does not need to change between restarts or releases.
If overrides need to be change or added the overrides.js
file must be changed
Command line arguments are the highest level of maliable values. The can be used to set specific and nested values in the configuration JSON document but using a :
spearator between keys. For example, using the flag: --foo:bar=1
, would create an object like
{
"foo":{
"bar": 1
}
}
Environment variables work much the same as command line arguments. However, most bash implenetations don't read :
's very well, so the double underscore ( __
) is used in its place foo__bar=1
npm start
{
"foo":{
"bar": 1
}
}
The conf
options can be set to read specific configuration from a file(s). The value should be a full path. If the path points to a directory, the conf loader will read all json files, sort them and load their values in an overriding order. Sorting is done in a descending, lexigraphical order.
└── conf
├── 20-second.json
├── 10-first.json
└── 30-third.json
Given the above directory of conf files, the server can be configured by pointing the conf
arguments at the directory
node server --conf=$HOME/conf
The configruation would be read in the following priority
10-first.json < 20-second.json < 30-third.json
where 20 overrides 10, and 30 overrides 20.
defaults are what they sound like. Sane defaults for values that are needed to get the application running. They are located in conf/lib/defaults.js
and are used only as fallback values.
Top level options can be aliased. Short hand aliases can be found and defined in the lib/shorthands.js
module.
Flag | Shorthand | Description |
---|---|---|
PORT | p | Specifies the port the server will bind to |
logger | l | specify the type(s) of logging transports for the server to use |
the following invocations are treated the same
node server --PORT=3001 --logger=stdout --logger=file
PORT=3001 logger=stdout nodeserver -l file
node server -p 3001 -l stdout -l file
FAQs
Multi tier configuration loader as a package
We found that keef demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.