
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
lightningcss-wasm
Advanced tools
An extremely fast CSS parser, transformer, and minifier written in Rust. Use it with Parcel, as a standalone library or CLI, or via a plugin with any other tool.
calc()
expressions where possible.color-mix()
functionlab(from purple calc(l * .8) a b)
lab()
, lch()
, oklab()
, and oklch()
colorscolor()
function supporting predefined color spaces such as display-p3
and xyz
rgb
and hsl
functionshwb()
color syntax#rgba
and #rrggbbaa
hex colors:not
with multiple arguments:lang
with multiple arguments:dir
:is
red 40% 80%
)clamp()
, round()
, rem()
, and mod()
math functionsplace-items
)overflow
shorthand@media (width <= 100px)
or @media (100px < width < 500px)
)display
property (e.g. inline flex
)system-ui
font family fallbacks@keyframes
names, grid lines/areas, @counter-style
names, etc.:local()
and :global()
selectorscomposes
propertyLightning CSS can be used from Parcel, as a standalone library from JavaScript or Rust, using a standalone CLI, or wrapped as a plugin within any other tool.
See the TypeScript definitions for full API docs.
Here is a simple example that compiles the input CSS for Safari 13.2, and minifies the output.
const css = require('lightningcss');
let {code, map} = css.transform({
filename: 'style.css',
code: Buffer.from('.foo { color: red }'),
minify: true,
sourceMap: true,
targets: {
// Semver versions are represented using a single 24-bit number, with one component per byte.
// e.g. to represent 13.2.0, the following could be used.
safari: (13 << 16) | (2 << 8)
}
});
You can also convert the results of running browserslist
into targets which can be passed to Lightning CSS:
const browserslist = require('browserslist');
const css = require('lightningcss');
let targets = css.browserslistToTargets(browserslist('>= 0.25%'));
Bundling is also possible by using the bundle
API. This processes @import
rules and inlines them. This API requires filesystem access, so it does not accept code
directly via the API.
let {code, map} = css.bundle({
filename: 'style.css',
minify: true
});
The bundleAsync
API is an asynchronous version of bundle
, which also accepts a custom resolver
object. This allows you to provide custom JavaScript functions for resolving @import
specifiers to file paths, and reading files from the file system (or another source). The read
and resolve
functions are both optional, and may either return a string synchronously, or a Promise for asynchronous resolution.
let {code, map} = await css.bundleAsync({
filename: 'style.css',
minify: true,
resolver: {
read(filePath) {
return fs.readFileSync(filePath, 'utf8');
},
resolve(specifier, from) {
return path.resolve(path.dirname(from), specifier);
}
}
});
Note that using a custom resolver can slow down bundling significantly, especially when reading files asynchronously. Use readFileSync
rather than readFile
if possible for better performance, or omit either of the methods if you don't need to override the default behavior.
See the Rust API docs on docs.rs.
Parcel includes Lightning CSS as the default CSS transformer. You should also add a browserslist
property to your package.json
, which defines the target browsers that your CSS will be compiled for.
While Lightning CSS handles the most commonly used PostCSS plugins like autoprefixer
, postcss-preset-env
, and CSS modules, you may still need PostCSS for more custom plugins like TailwindCSS. If that's the case, your PostCSS config will be picked up automatically. You can remove the plugins listed above from your PostCSS config, and they'll be handled by Lightning CSS.
You can also configure Lightning CSS in the package.json
in the root of your project. Currently, three options are supported: drafts
, which can be used to enable CSS nesting and custom media queries, pseudoClasses
, which allows replacing some pseudo classes like :focus-visible
with normal classes that can be applied via JavaScript (e.g. polyfills), and cssModules
, which enables CSS modules globally rather than only for files ending in .module.css
, or accepts an options object.
{
"@parcel/transformer-css": {
"cssModules": true,
"drafts": {
"nesting": true,
"customMedia": true
},
"pseudoClasses": {
"focusVisible": "focus-ring"
}
}
}
See the Parcel docs for more details.
The lightningcss-wasm
package can be used in Deno or directly in browsers. This uses a WebAssembly build of Lightning CSS. Use TextEncoder
and TextDecoder
convert code from a string to a typed array and back.
import init, {transform} from 'https://unpkg.com/lightningcss-wasm';
await init();
let {code, map} = transform({
filename: 'style.css',
code: new TextEncoder().encode('.foo { color: red }'),
minify: true,
});
console.log(new TextDecoder().decode(code));
css-minimizer-webpack-plugin has builtin support for Lightning CSS. Install Lightning CSS in your project, and configure the plugin as documented in its README.
Lightning CSS includes a standalone CLI that can be used to compile, minify, and bundle CSS files. It can be used when you only need to compile CSS, and don't need more advanced functionality from a larger build tool such as code splitting and support for other languages.
To use the CLI, install the lightningcss-cli
package with an npm compatible package manager:
npm install lightningcss-cli
Then, you can run the lightningcss
command via npx
, yarn
, or by setting up a script in your package.json.
{
"scripts": {
"build": "lightningcss --minify --nesting --bundle --targets '>= 0.25%' --sourcemap input.css -o output.css"
}
}
To see all of the available options, use the --help
argument:
npx lightningcss --help
By default, Lightning CSS is strict, and will error when parsing an invalid rule or declaration. However, sometimes you may encounter a third party library that you can't easily modify, which unintentionally contains invalid syntax, or IE-specific hacks. In these cases, you can enable the errorRecovery
option (or --error-recovery
CLI flag). This will skip over invalid rules and declarations, omitting them in the output, and producing a warning instead of an error. You should also open an issue or PR to fix the issue in the library if possible.
$ node bench.js bootstrap-4.css
cssnano: 544.809ms
159636 bytes
esbuild: 17.199ms
160332 bytes
lightningcss: 4.16ms
143091 bytes
$ node bench.js animate.css
cssnano: 283.105ms
71723 bytes
esbuild: 11.858ms
72183 bytes
lightningcss: 1.973ms
23666 bytes
$ node bench.js tailwind.css
cssnano: 2.198s
1925626 bytes
esbuild: 107.668ms
1961642 bytes
lightningcss: 43.368ms
1824130 bytes
For more benchmarks comparing more tools and input, see here. Note that some of the tools shown perform unsafe optimizations that may change the behavior of the original CSS in favor of smaller file size. Lightning CSS does not do this – the output CSS should always behave identically to the input. Keep this in mind when comparing file sizes between tools.
FAQs
A CSS parser, transformer, and minifier written in Rust
The npm package lightningcss-wasm receives a total of 14,533 weekly downloads. As such, lightningcss-wasm popularity was classified as popular.
We found that lightningcss-wasm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.