
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
piped-webpack
Advanced tools
Webpack already function as a great build tool, and in many cases you don't even need Gulp.
Combining Gulp with webpack, however, allow you to do many more things without writing webpack plugins:
At TipMe we started out with webpack-stream. However, we found that it doesn't work with DllPlugin (#149). So we set out to create a new implementation:
peerDependencies, so you can use any version you wanted without passing the instance.output for you, make sure that your output.path is not set or set to process.cwd()ProgressPlugin). If you want any plugin you can add them manually.The reason we name this as piped-webpack is because webpack-stream also appear as gulp-webpack on npm.
Migrating from webpack-stream is simple: just change your require to piped-webpack and, if you're passing webpack instance, remove it. Also remove callback argument if you're using it. We'll implement something later.
Install this module from npm:
npm install --save-dev piped-webpack
Pipe your entrypoint files to piped-webpack:
const gulp = require('gulp');
const pipedWebpack = require('piped-webpack');
gulp.task('webpack', function(){
return gulp.src(['js/entry1.js', 'js/entry2.js'])
.pipe(pipedWebpack({
// your webpack config
}))
.pipe(gulp.dest(__dirname + '/static/'));
});
In the above case, the webpack config can omit the entry object.
If you already have entry set, you can pipe an empty stream to pipedWebpack:
gulp.src([])
.pipe(pipedWebpack({
entry: {
// your entrypoints
},
// your webpack config
}))
.pipe(gulp.dest(__dirname + '/static/'));
Note that due to webpack's limitation we don't actually use the files from stream, only path. Therefore, don't pipe anything else but gulp.src into this plugin.
If you need to use load something in your entrypoints (eg. babel-polyfill) you can use additionalEntries option:
const gulp = require('gulp');
const pipedWebpack = require('piped-webpack');
gulp.task('webpack', function(){
return gulp.src(['js/entry1.js', 'js/entry2.js'])
.pipe(pipedWebpack({
// your webpack config
additionalEntries: ['babel-polyfill'],
}))
.pipe(gulp.dest(__dirname + '/static/'));
You can also specify a function that returns an array. The function will receive Vinyl file object as argument.
Here's how we submit source maps to Sentry, and removing it from production servers
const gulp = require('gulp');
const filter = require('gulp-filter');
const sentryRelease = require('gulp-sentry-release');
const merge = require('merge-stream');
const pipedWebpack = require('piped-webpack');
const SENTRY_URL = 'https://app.getsentry.com/api/0/projects/mycompany/myapp/';
const SENTRY_API_KEY = 'apikeygoeshere'; // see gulp-sentry-release docs on how to get this key
const webpackConfig = {
// ...
// sentry requires that your source map have a visible comment
devtool: 'source-map',
};
gulp.task('webpack', function(){
// filter out source maps
let mapFilter = filter(['**', '!**/*.map'], {restore: true, passthrough: false});
let codeStream = gulp.src(['*/js/*.js', '!static/**'])
.pipe(pipedWebpack(webpackConfig))
.pipe(mapFilter) // remove all map files
.pipe(gulp.dest(__dirname + '/static/'));
let mapStream = mapFilter.restore
.pipe(sentryRelease({
API_URL: SENTRY_URL,
API_KEY: SENTRY_API_KEY,
DOMAIN: '~',
version: '1.0.0', // you can use git-rev to update this automatically
}).release());
return merge(codeStream, mapStream);
});
Set watch: true in your configuration to use webpack's watch system. This can be done like this:
gulp.task('webpack', function(){
// invoke your webpack normally
});
gulp.task('watch', function(){
webpackConfig.watch = true;
gulp.start('webpack');
});
piped-webpack is licensed under the MIT License
FAQs
Run webpack through a stream interface
The npm package piped-webpack receives a total of 44 weekly downloads. As such, piped-webpack popularity was classified as not popular.
We found that piped-webpack demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.