
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
semgrator provides an utility to support backward compatibility when building frameworks and runtimes
that do not introduce breaking changes via new options.
If you want to create a product that is configurable, but you do not want to break your users on behavior changes, you can introduce a new option that turns on and off the new behavior, and turn the new behavior by default. Users of the previous behavior would be required to change their configuration to keep using the software.
semgrator run migrations code based on semantic version rules. So on a breaking/behavior change that results in a new
compatibility option in your configuration file, you can add a new migration rule that set the new option to false
automatically.
npm i semgrator
import type { Migration } from 'semgrator'
import type { Config } from '../your-config-meta.js'
export const migration: Migration<Config> = {
version: '1.0.0',
toVersion: '1.42.0',
up: (input: Config) => {
// Do something with Config
return input
},
}
The version peroperty specifies the minimum version that do not need the change.
In other terms, all versions before the specified one will trigger the migration.
The toVersion property will be used by semgrator as the resulting version after the change.
This is useful in case you want to have a final version that is higher than version.
import { semgrator } from 'semgrator'
type MyConfig = {
result: unknown
}
const res = await semgrator<MyConfig, MyConfig>({
version: '1.0.0',
path: 'path/to/migrations',
input: {
result: { foo: 'bar' } as unknown,
},
})
console.log(res.result)
console.log(res.changed)
console.log(res.version)
import { semgrator } from 'semgrator'
type MyConfig = {
result: unknown
}
const iterator = semgrator<MyConfig, MyConfig>({
version: '1.0.0',
path: 'path/to/migrations',
input: {
result: { foo: 'bar' } as unknown,
},
})
for await (const res of iterator) {
console.log(res.version, res.result)
}
Apache-2.0
FAQs
Run migrations code based on semantic version rules
We found that semgrator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.