
Security News
Risky Biz Podcast: Making Reachability Analysis Work in Real-World Codebases
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
requirements
Advanced tools
[](https://www.npmjs.com/package/requirements) [](https://coveralls.io/r/chimurai/requirements) [!
Validate your project's software requirements.
$ npm install -D requirements
$ yarn add --dev requirements
Scaffold a new requirements.config.mjs
configuration file
$ npx requirements --init
Configure the requirements.config.mjs
file in your project root.
export default {
software: {
node: '*',
yarn: '~1.17.3',
nginx: {
semver: '>= 1.16.x',
optional: true, // optional (won't fail)
installMessage: '<install instruction>', // custom message when binary is not found
updateMessage: '<update instruction>', // custom message when binary has wrong version
},
httpd: {
semver: '^1.x',
flag: '-v', // custom version flag
},
},
// custom functions to verify requirements which are not related to software versions
// see ./tests/custom-check-ssh.config.mjs for an example
custom: {
'Example title for custom requirements check', {
fn: () => { throw new Error('throw Error when requirement not met.') },
errorMessage: 'This error message is shown when the above function throws Error',
}
}
};
Run requirements
command in the project root. By default it will try to find the requirements.config.mjs
file.
npx requirements
Or use a custom path:
npx requirements --config <filepath>
npx requirements --help
Options:
--help, -h Show help [boolean]
--version, -v Show version number [boolean]
--init, -i Create a requirements.config.mjs file
--config, -c Path to the configuration file
[default: "requirements.config.mjs"]
--force, -f Succeeds even if not all requirements are satisfied
[boolean] [default: false]
--quiet, -q Only output when errors are present [boolean]
--debug Print raw data [boolean]
const { checkSoftware, renderTable } = require('requirements');
(async () => {
const result = await checkSoftware({ node: '*' });
console.log(renderTable(result));
})();
checkSoftware() returns an Array with results
[
{
bin: 'node',
semver: '*',
installed: true,
version: '12.8.1',
satisfies: true,
},
];
# test functionality
yarn build
node bin/requirements.js --config tests/requirements.config.mjs
# unit tests
yarn test
The MIT License (MIT)
Copyright (c) 2017-2024 Steven Chim
FAQs
[](https://www.npmjs.com/package/requirements) [](https://coveralls.io/r/chimurai/requirements) [!
The npm package requirements receives a total of 158 weekly downloads. As such, requirements popularity was classified as not popular.
We found that requirements demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.