Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
prettier-plugin-sort-json
Advanced tools
A plugin for Prettier that sorts JSON files by property name.
This module requires an LTS Node version (v14.0.0+), and prettier
v2.3.2+.
Using npm
:
npm install --save-dev prettier-plugin-sort-json
Using yarn
:
yarn add --dev prettier-plugin-sort-json
No configuration is necessary; Prettier will detect this plugin in your dependencies and use it automatically. There are some configuration options available (described below), but they are all optional.
This plugin adds a JSON preprocessor that will sort JSON files alphanumerically by key. By default, only top-level JSON objects are sorted. JSON files containing Arrays or other non-Object values are skipped.
Object entries are sorted by key lexically using Array.sort
, according to each character's Unicode code point value.
Note that this will not sort package.json
, package-lock.json
, or composer.json
. This plugin only affects the json
parser used by Prettier. Prettier uses an alternate parser (json-stringify
) for those three specific files (See here for details).
This also will not sort JSON objects within other types of files, such as JavaScript or TypeScript files. This is just for sorting JSON files.
Before:
{
"z": null,
"a": null,
"b": null,
"0": null,
"exampleNestedObject": {
"z": null,
"a": null
}
}
After:
{
"0": null,
"a": null,
"b": null,
"exampleNestedObject": {
"z": null,
"a": null
},
"z": null
}
These configuration options are all optional. Each option can be set as a CLI flag, or as an entry in your Prettier configuraton (e.g. in your .prettierrc
file).
Sort JSON objects recursively, including all nested objects. This also sorts objects within JSON arrays.
Default | CLI | Configuration |
---|---|---|
false | --json-recursive-sort | jsonRecursiveSort: <bool> |
Use a custom sort order. This order is specified using a JSON file that maps exact strings or regular expressions to sorting algorithms.
Default | CLI | Configuration |
---|---|---|
"" | --json-sort-order <path> | jsonSortOrder: <path> |
Here is an example JSON sort order file:
{
"placeThisFirst": null,
"/^[^\\d+]/": "lexical",
"/^\\d+/": "numeric"
}
This file sorts the key "placeThisFirst" ahead of all others. After that, the set of all keys that don't start with a number are sorted lexically. Lastly, the set of keys that start with a number are sorted numerically.
Each key represents a literal key value or a category of keys, represented by a regular expression. Regular expressions are identified by leading and trailing forward slashes, along with some number of paths optionally following the trailing slash (supported flags are i
, m
, s
, and u
).
Each category is ordered in relation to other categories. Each value represents the sorting algorithm to use within that category. If the value is null
, the default sorting algorithm lexical
is used. Here are the supported sorting algorithms:
Sorting Algorithm | Description |
---|---|
lexical | Sort lexically (i.e. lexicographically). This is the default. |
numeric | For keys that are prefixed with a number, sort by that number in ascending order. Otherwise sort lexically. |
reverseLexical | Reverse-order lexical sort. |
reverseNumeric | Reverse-order numeric sort. |
caseInsensitiveLexical | Case-insensitive lexical sort. |
caseInsensitiveNumeric | Case-insensitive numeric sort. |
caseInsensitiveReverseLexical | Case-insensitive reverse-order lexical sort. |
caseInsensitiveReverseNumeric | Case-insensitive reverse-order numeric sort. |
Keys that do not match any defined category are treated as being in an implied last category, with lexical
sorting.
nvm use
will automatically choose the right node version for you.yarn install
to install dependencies and run any requried post-install scriptsRun yarn test
to run the tests once. To run tests on file changes, run yarn test:watch
.
Run yarn lint
to run the linter, or run yarn lint:fix
to run the linter and fix any automatically fixable issues.
The project follows the same release process as the other libraries in the MetaMask organization. The GitHub Actions action-create-release-pr
and action-publish-release
are used to automate the release process; see those repositories for more information about how they work.
Choose a release version.
If this release is backporting changes onto a previous release, then ensure there is a major version branch for that version (e.g. 1.x
for a v1
backport release).
v1.0.2
release, you'd want to ensure there was a 1.x
branch that was set to the v1.0.1
tag.Trigger the workflow_dispatch
event manually for the Create Release Pull Request
action to create the release PR.
action-create-release-pr
workflow to create the release PR.Update the changelog to move each change entry into the appropriate change category (See here for the full list of change categories, and the correct ordering), and edit them to be more easily understood by users of the package.
yarn auto-changelog validate --rc
to check that the changelog is correctly formatted.Review and QA the release.
Squash & Merge the release.
action-publish-release
workflow to tag the final release commit and publish the release on GitHub.Publish the release on npm.
npm publish --dry-run
to examine the release contents to ensure the correct files are included. Compare to previous releases if necessary (e.g. using https://unpkg.com/browse/[package name]@[package version]/
).npm publish
.[0.0.3]
FAQs
Prettier plugin to sort JSON files alphanumerically by key
The npm package prettier-plugin-sort-json receives a total of 143,152 weekly downloads. As such, prettier-plugin-sort-json popularity was classified as popular.
We found that prettier-plugin-sort-json demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.