
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
nycadvanced
Advanced tools
[](https://travis-ci.org/istanbuljs/nyc) [](https://coveralls.io/r/bcoe/nyc?branch=master) [ nyc supports both inline source-maps and
.map files.
Important: If you are using nyc with a project that pre-instruments its code,
run nyc with the configuration option --exclude-after-remap set to false.
Otherwise nyc's reports will exclude any files that source-maps remap to folders
covered under exclude rules.
babel-plugin-istanbul for Babel SupportWe recommend using babel-plugin-istanbul if your project uses the babel tool chain:
babel-plugin-istanbul plugin: {
"babel": {
"presets": ["@babel/preset-env"],
"env": {
"test": {
"plugins": ["istanbul"]
}
}
}
}
Note: With this configuration, the Istanbul instrumentation will only be active when NODE_ENV or BABEL_ENV is test unless the environment is a valid entry in "env" within the .babelrc file.
We recommend using the cross-env package to set these environment variables
in your package.json scripts in a way that works cross-platform.
package.json:{
"nyc": {
"require": [
"@babel/register"
],
"sourceMap": false,
"instrument": false
},
"scripts": {
"test": "cross-env NODE_ENV=test nyc mocha"
}
}
That's all there is to it, better ES2015+ syntax highlighting awaits:
Supporting file extensions can be configured through either the configuration arguments or with the nyc config section in package.json.
nyc --extension .jsx --extension .mjs npm test
{
"nyc": {
"extension": [
".jsx",
".mjs"
]
}
}
nyc can fail tests if coverage falls below a threshold. After running your tests with nyc, simply run:
nyc check-coverage --lines 95 --functions 95 --branches 95
nyc also accepts a --check-coverage shorthand, which can be used to
both run tests and check that coverage falls within the threshold provided:
nyc --check-coverage --lines 100 npm test
The above check fails if coverage falls below 100%.
To check thresholds on a per-file basis run:
nyc check-coverage --lines 95 --per-file
Once you've run your tests with nyc, simply run:
nyc report
To view your coverage report:
You can use any reporters that are supported by istanbul: clover, cobertura, html, json-summary, json, lcov, lcovonly, none, teamcity, text-lcov, text-summary, text.
nyc report --reporter=lcov
You can find examples of the output for various reporters here.
You also have the choice of using a custom reporter.
Install custom reporters as a development dependency and you can use the --reporter flag to load and view them:
nyc report --reporter=<custom-reporter-name>
You can tell nyc to exclude specific files and directories by adding
an nyc.exclude array to your package.json. Each element of
the array is a glob pattern indicating which paths should be omitted.
Globs are matched using minimatch.
For example, the following config will exclude any files with the extension .spec.js,
and anything in the build directory:
{
"nyc": {
"exclude": [
"**/*.spec.js",
"build"
]
}
}
Note: Since version 9.0 files under
node_modules/are excluded by default. add the exclude rule!**/node_modules/to stop this.
Note: exclude defaults to
['coverage/**', 'test/**', 'test{,-*}.js', '**/*.test.js', '**/__tests__/**', '**/node_modules/**'], which would excludetest/__tests__directories as well astest.js,*.test.js, andtest-*.jsfiles. Specifying your own exclude property overrides these defaults.
As an alternative to providing a list of files to exclude, you can provide
an include key with a list of globs to specify specific files that should be covered:
{
"nyc": {
"include": ["**/build/umd/moment.js"]
}
}
nycuses minimatch for glob expansions, you can read its documentation here.
Note: include defaults to
['**']
Use the
--allflag to include files that have not been required in your tests.
The --require flag can be provided to nyc to indicate that additional
modules should be required in the subprocess collecting coverage:
nyc --require @babel/register --require @babel/polyfill mocha
You can run nyc with the optional --cache flag, to prevent it from
instrumenting the same files multiple times. This can significantly
improve runtime performance.
nycAny configuration options that can be set via the command line can also be specified in the nyc stanza of your package.json, or within a .nycrc file:
package.json:
{
"description": "These are just examples for demonstration, nothing prescriptive",
"nyc": {
"check-coverage": true,
"per-file": true,
"lines": 99,
"statements": 99,
"functions": 99,
"branches": 99,
"include": [
"src/**/*.js"
],
"exclude": [
"src/**/*.spec.js"
],
"ignore-class-method": "methodToIgnore",
"reporter": [
"lcov",
"text-summary"
],
"require": [
"./test/helpers/some-helper.js"
],
"extension": [
".jsx"
],
"cache": true,
"all": true,
"temp-dir": "./alternative-tmp",
"report-dir": "./alternative"
}
}
nyc allows you to inherit other configurations using the key extends. As an example,
an alternative way to configure nyc for babel-plugin-istanbul would be to use the
@istanbuljs/nyc-config-babel preset:
{
"nyc": {
"extends": "@istanbuljs/nyc-config-babel"
}
}
To publish and resuse your own nyc configuration, simply create an npm module that
exports an index.json with your nyc config.
Several of the coverage reporters supported by nyc display special information for high and low watermarks:
You can specify custom high and low watermarks in nyc's configuration:
{
"nyc": {
"watermarks": {
"lines": [80, 95],
"functions": [80, 95],
"branches": [80, 95],
"statements": [80, 95]
}
}
}
There may be some sections of your codebase that you wish to purposefully exclude from coverage tracking, to do so you can use the following parsing hints:
/* istanbul ignore if */: ignore the next if statement./* istanbul ignore else */: ignore the else portion of an if statement./* istanbul ignore next */: ignore the next thing in the source-code (
functions, if statements, classes, you name it)./* istanbul ignore file */: ignore an entire source-file (this should be
placed at the top of the file).There may be some methods that you want to universally ignore out of your classes rather than having to ignore every instance of that method:
{
"nyc": {
"ignore-class-method": "render"
}
}
coveralls.io is a great tool for adding coverage reports to your GitHub project. Here's how to get nyc integrated with coveralls and travis-ci.org:
npm install coveralls nyc --save-dev
{
"scripts": {
"test": "nyc mocha",
"coverage": "nyc report --reporter=text-lcov | coveralls"
}
}
For private repos, add the environment variable COVERALLS_REPO_TOKEN to travis.
add the following to your .travis.yml:
after_success: npm run coverage
That's all there is to it!
Note: by default coveralls.io adds comments to pull-requests on GitHub, this can feel intrusive. To disable this, click on your repo on coveralls.io and uncheck
LEAVE COMMENTS?.
nyc npm test && nyc report --reporter=text-lcov > coverage.lcov && codecov
codecov is a great tool for adding coverage reports to your GitHub project, even viewing them inline on GitHub with a browser extension:
Here's how to get nyc integrated with codecov and travis-ci.org:
npm install codecov nyc --save-dev
{
"scripts": {
"test": "nyc tap ./test/*.js",
"coverage": "nyc report --reporter=text-lcov > coverage.lcov && codecov"
}
}
For private repos, add the environment variable CODECOV_TOKEN to travis.
add the following to your .travis.yml:
after_success: npm run coverage
That's all there is to it!
Many testing frameworks (Mocha, Tape, Tap, etc.) can produce TAP output. tap-nyc is a TAP formatter designed to look nice with nyc.
You can find more tutorials at http://istanbul.js.org/docs/tutorials
Take a look at http://istanbul.js.org/docs/advanced/ and please feel free to contribute documentation.
FAQs
[](https://travis-ci.org/istanbuljs/nyc) [](https://coveralls.io/r/bcoe/nyc?branch=master) [
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.