Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
lego-father
Advanced tools
A package parser that can resolve self and dependencies, supporting lego, component.
A package parser that can resolve self and dependencies, supporting lego / component.
$ npm install lego-father -g
// using LegoPackage
var Package = require('lego-father').LegoPackage;
var pkg = new Package('path/to/package')
console.log(pkg.name);
console.log(pkg.version);
console.log(pkg.main);
console.log(pkg.dependencies); // return a object contains dependencies
console.log(pkg.get('each')); // return a package named each
// using ComponentPackage
var Package = require('lego-father').ComponentPackage;
The properties of Package instance
Unique id for each package
= {pkg.name}@{pkg.version}
require
Package's name
require
Package's version
Entry point of the package, default is index.js
Package's dependencies, each one will return a Package instance
All used files will exist in pkg.files, it will be parsed from pkg.main. Each file contains dependent files (no deep dependencies).
Example below
{
files: {
'index.js': {
dependencies: ['each', './feature']
}
}
}
The base directory of the package
The origin package info
Export files when build
Get a package by id
Set a package
Get all dependent packages
Get file object by given path
Get all file objects
The options when instantiation
new Package('path/to/package', options);
Generally, files will be parsed from pkg.main, no dependent file will not be included. entry
will be another entry point.
Files
// a.js <- pkg.main
console.log('no require');
// b.js
require('./c');
// c.js
console.log('no require');
Code
new Package('path/to/package', {
entry: ['b.js']
});
Return
// without entry
{
...
files: {
'a.js': []
}
}
// with entry
{
...
files: {
'a.js': [],
'b.js': ['./c'],
'c.js': []
}
}
// a.js
require('b')
If you want to skip file or package, you can specify skip. And it won't parse b and won't exist in dependencies.
new Package('path/to/package', {
skip: ['b']
});
yield
define('a', [], function(require) {
require('b')
});
Almost same as skip, however it will exist in dependency.
Where is your modules
what you get in pkg.files is file objects that is extending vinyl.
var fileObj = pkg.files['a.js'];
fileObj.pkg
fileObj.relative
fileObj.extension
fileObj.path // = fileObj.pkg.dest + fileObj.relative
lookup all dependencies and can be filtered or transformed in callback
fileObj.lookup(function(fileInfo) {
// fileInfo.path: filepath of fileinfo
// fileInfo.relative: filepath based on packagge
// fileInfo.pkg: package info
// fileInfo.isRelative: required by file in the same package
// fileInfo.dependent: dependent package
// fileInfo.extension: exntesion of the file
return fileInfo.filepath;
return false; // ignore
});
Determine whether it has the matched extension in all dependencies.
fileObj.hasExt('css'); // return false
If you want to use it for your package, you can extend Package and override readPackage.
var Package = require('lego-father').Package;
var Custom = Package.extend({
readPackage: function() {
// 1. read config file, E.g. component.json
// 2. return a package contains id, name, version, dependencies, main, dest, files, origin
// 3. dependencies should contain id, name, version, dest
};
})
Example for returned object by readPackage
{
id: 'a',
name: 'a'
version: '1.0.0',
main: 'index.js',
dest: '/home/user/a',
dependencies: {
b: {
id: 'b@1.1.0',
name: 'b',
version: '1.1.0',
dest: '/home/user/a/components/b'
}
}
}
Copyright (c) 2014 herbertliu. Licensed under the MIT license.
FAQs
A package parser that can resolve self and dependencies, supporting lego, component.
We found that lego-father demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.