
Security News
Critical Security Vulnerability in React Server Components
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.
sg1-platform
Advanced tools
This node package enables developers to build micro-frontend platforms using React. Inspired by micro-service architectures, this approach splits the front-end into separate modules to be developed and deployed independently from one another.
SG1 was inspired by Shipt's desire to migrate from a monolith application to one which could easily be maintained by devlopers across many teams. After searching for the right solution, we found that there really weren't any good approaches in the developer community for solving this problem and decided to build SG1. It is comprised of popular, open-source frameworks to help teams of developers rapidly build applications using a modular, micro-frontend architecture.
The SG1 platform is comprised of several node packages with @shipt/sg1 at its core.
@okta/okta-react@shipt/novaaxiosreact-router-domstyled-componentsThe following environment variables must be set in SG1 Apps.
| Name | Default | Description |
|---|---|---|
| REACT_APP_CDN | https://sg1-modules.staging.shipt.com | Domain hosting SG1 modules |
| REACT_APP_SITE_ROOT | http://localhost:3000 | Application domain |
| REACT_APP_LOCALHOSTS | [] | Alternate domains hosting SG1 modules (JSON array) |
| REACT_APP_OAUTH_URL | https://shipt.okta.com | Okta OAuth URL |
| REACT_APP_OAUTH_ISSUER | https://shipt.okta.com/oauth2/aus4lad0y7z7crJyw2p7 | Okta OAuth issuer |
| REACT_APP_OAUTH_CLIENTID | 0oa4ejb77uZEbODj92p7 | Okta OAuth client ID |
Note:
.envfiles are supported via CRA
N/A
N/A
N/A
Semantic Versioning (SemVer) is used when publishing to NPM.
git clone git@github.com:shipt/sg1.gitcd sg1npm installnpm testnpx create-react-app SG1_APP_NAME \
--scripts-version @shipt/sg1-scripts \
--template @shipt/sg1
cd SG1_APP_NAME.env file with the required env vars.npm startopen http://localhost:3000npx create-react-app SG1_MODULE_NAME \
--scripts-version @shipt/sg1-module-scripts \
--template @shipt/sg1-module
cd SG1_MODULE_NAMEnpm startopen http://localhost:5000/manifest.jsonESLint + Prettier is used to lint and format Typescript code according to both Shipt and the React community's best practices.
VS Code users can take advantage of the Prettier extension to automatically fix lint errors on save.
code --install-extension esbenp.prettier-vscode
The master branch is default and feature branches should be created from it for all development.
git checkout mastergit pull origin mastergit checkout -b GH_USER/PR_TASK/PR_FEATURE_DESCRIPTIONJest + React Testing Library is used to verify component functionality.
SG1 itself is published as a Node package via @shipt/sg1.
Simply build, deploy, and host the SPA as you normally would.
There are a few strings that need to be pulled to get your module into production.
SG1 is driven by a manifest that contains the module name, references to the module context and the module itself.
To deploy your module to production, those items need to be added to the manifest file. To eliminate the requirement of a human having to make changes to the manifest file, the CI process will inject that information into the manifest when a merge occurs to the master branch.
Ensure your project's root directory contains a .npmrc file with the latest npm token. This is required to allow private repositories to be installed in the DevOps pipeline. Check here for the latest version.
Using this as a reference build your .drone.yml. Then I would recommend dropping the following message in the #ask-devops:
Would someone be a lamb and review the .drone.yml to be sure it is set up correctly for my module to go to production? Could you also initialize Drone for our SG1 module repo
module repo url here
One Drone is initialized and your .drone.yml file is set up correctly, any merges to the master branch will trigger a new build of your module and deployment to production SG1.
Code coverage should never decrease. The metrics for this are here.
FAQs
Monorepo for SG1 platform.
We found that sg1-platform demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated “elf-*” npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.

Research
/Security News
Malicious Rust crate evm-units disguised as an EVM version helper downloads and silently executes OS-specific payloads likely aimed at crypto theft.