strata-css - npm Package Compare versions

Comparing version 1.6.14 to 1.7.14

bin/strata.js

@@ -12,4 +12,5 @@ #!/usr/bin/env node
 
-const args = process.argv.slice(2)
-const cwd  = process.cwd()
+const args    = process.argv.slice(2)
+const cwd     = process.cwd()
+const verbose = args.includes('--verbose') || args.includes('-v')
 
@@ -121,2 +122,16 @@ function ask(rl, question) {
   console.log(`[Strata] ✓ Built → ${outputFile} (CSS ${cssSize} KB, JS ${jsSize} KB) in ${ms}ms`)
+
+  // Report what the scan actually did. A build that silently produces no CSS
+  // used to look identical to a healthy one; these lines make the difference
+  // obvious without anyone needing to opt in.
+  const { getScanStats, getScanWarnings } = require('../src/scanner/scanner')
+  const stats = getScanStats()
+  if (verbose) {
+    console.log(`[Strata]   scanned ${stats.scanned}/${stats.matched} matched file(s), ` +
+                `${stats.skipped} skipped, ${stats.classes} class name(s) found`)
+    console.log(`[Strata]   globs: ${stats.globs.join(', ')}  (relative to ${stats.cwd})`)
+  }
+  for (const w of getScanWarnings()) {
+    console.warn(`[Strata] ⚠  ${w}`)
+  }
 }
@@ -123,0 +138,0 @@

CHANGELOG.md

@@ -5,2 +5,20 @@ # Changelog
 
+## [1.7.14] — 2026-08-05
+
+### Added
+- **Scan diagnostics.** Every scanner bug in this project's history has failed *open*: files matched but were skipped, globs resolved against the wrong directory, class shapes went unrecognised. In each case the build succeeded, the config looked correct, and the CSS was quietly wrong — which is why several survived for years. The scanner now reports what it actually did:
+  - `strata --build --verbose` (or `-v`) prints `scanned N/M matched file(s), K skipped, C class name(s) found` along with the globs and the directory they resolved against.
+  - **A scan that produces nothing now warns by default, with no opt-in.** Zero files matched, or files matched but no classes found, is reported on the CLI and as a real PostCSS warning — so consumers building through webpack, Turbopack, Vite or esbuild see it too, not just CLI users. The message names both the globs and the directory they were resolved against, which is precisely the information that made the 1.6.14 `cwd` bug invisible.
+  - New exports `getScanStats()` and `getScanWarnings()` from `src/scanner/scanner.js` for tooling.
+
+### Security
+- **`brace-expansion` 5.0.8 → 5.0.9** — high-severity DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation. Reaches consumers transitively through `glob`, a runtime dependency.
+- **`undici` 7.28.0 → 7.29.0** — resolves five advisories (one high, four moderate): cross-user information disclosure and parse-time crash via degenerate private cache directives, CRLF injection via blob-like body `type`, cache-control whitespace disclosure, cookie attribute injection, and response desynchronisation via the retry interceptor. Dev-only dependency; not shipped to consumers.
+- `npm audit` now reports 0 vulnerabilities.
+
+### Fixed
+- The lockfile's recorded package version was stale at `1.4.10`; it now tracks the real version.
+
+---
+
 ## [1.6.14] — 2026-08-05
@@ -7,0 +25,0 @@

package.json

 {
   "name": "strata-css",
-  "version": "1.6.14",
+  "version": "1.7.14",
   "_versioningNote": "Stable: 1.0.0 / 1.1.0 / 2.0.0  |  Beta: 1.1.0-beta.1 / 1.1.0-beta.2",
@@ -5,0 +5,0 @@ "description": "A modern CSS framework combining Bootstrap components with Tailwind JIT processing",

src/index.js

@@ -108,3 +108,3 @@ /**
 
-    const { scanFiles, getWatchFiles } = require('./scanner/scanner')
+    const { scanFiles, getWatchFiles, getScanWarnings } = require('./scanner/scanner')
     const { generate }  = require('./generator/generator')
@@ -119,2 +119,9 @@
 
+    // Surface a scan that produced nothing as a real PostCSS warning. Most
+    // consumers build through a bundler rather than the CLI, and an empty or
+    // near-empty stylesheet used to arrive with no diagnostic at all.
+    for (const w of getScanWarnings()) {
+      result.warn(`[strata] ${w}`, { plugin: 'strata-css' })
+    }
+
     // Tell the caller's bundler (webpack/Turbopack/esbuild/etc.) that this
@@ -121,0 +128,0 @@ // output depends on every scanned content file, not just the CSS file

src/scanner/scanner.js

@@ -234,2 +234,11 @@ /**
 
+// Stats from the most recent scanFiles() call. Every bug in this scanner's
+// history has been a silent one: files matched but skipped, globs resolved
+// against the wrong directory, class shapes not understood. In each case the
+// build succeeded and the CSS was quietly wrong. Reporting what the scan
+// actually did is what makes that whole family visible.
+let lastScanStats = {
+  globs: [], cwd: null, matched: 0, scanned: 0, skipped: 0, classes: 0,
+}
+
 function scanFiles(contentGlobs, cwd) {
@@ -239,10 +248,50 @@ const allClasses = new Set()
 
+  let scanned = 0
+  let skipped = 0
   for (let i = 0; i < files.length; i++) {
     const classes = extractClassesFromFile(files[i])
-    if (classes) classes.forEach(cls => allClasses.add(cls))
+    if (classes) {
+      scanned++
+      classes.forEach(cls => allClasses.add(cls))
+    } else {
+      skipped++
+    }
   }
 
+  lastScanStats = {
+    globs:   contentGlobs.slice(),
+    cwd:     cwd || process.cwd(),
+    matched: files.length,
+    scanned,
+    skipped,
+    classes: allClasses.size,
+  }
+
   return allClasses
 }
 
+function getScanStats() {
+  return Object.assign({}, lastScanStats)
+}
+
+// Returns human-readable problems with the last scan, or [] if it looks sane.
+// Deliberately conservative: only conditions that are almost certainly a
+// misconfiguration rather than a legitimate empty state.
+function getScanWarnings() {
+  const s = lastScanStats
+  const warnings = []
+  if (s.matched === 0) {
+    warnings.push(
+      `no files matched the content globs [${s.globs.join(', ')}] ` +
+      `relative to ${s.cwd} — no utility CSS will be generated`
+    )
+  } else if (s.classes === 0) {
+    warnings.push(
+      `${s.matched} file(s) matched the content globs but no class names were ` +
+      `found in them — check that classes appear in class/className attributes`
+    )
+  }
+  return warnings
+}
+
 function getWatchFiles(contentGlobs, cwd) {
@@ -266,2 +315,5 @@ return getFiles(contentGlobs, cwd)
 
-module.exports = { scanFiles, extractClassesFromFile, getWatchFiles, clearFileCache }
+module.exports = {
+  scanFiles, extractClassesFromFile, getWatchFiles, clearFileCache,
+  getScanStats, getScanWarnings,
+}

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

321243

1.47%

Lines of code

6015

1.14%

No dependency changes