Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
The stylis npm package is a lightweight CSS preprocessor that allows developers to write nested CSS, use mixins, and perform other transformations before the CSS is compiled. It is particularly designed to be used with CSS-in-JS libraries and offers a middleware architecture to extend its capabilities.
CSS Preprocessing
Stylis allows you to write nested CSS rules, which it will then flatten into valid CSS. The code sample demonstrates how to preprocess a nested CSS string.
const stylis = require('stylis');
const css = `
.parent {
color: red;
.child {
color: blue;
}
}
`;
const output = stylis('.parent', css);
console.log(output);
Prefixing
Stylis automatically adds vendor prefixes to CSS rules when necessary. The code sample shows how to automatically prefix the 'display: flex;' rule.
const stylis = require('stylis');
const css = `display: flex;`;
const output = stylis('', css);
console.log(output);
Middleware
Stylis supports middleware, allowing you to intercept and transform CSS at various stages of processing. The code sample demonstrates a middleware that changes the color property for elements with the class '.button'.
const stylis = require('stylis');
stylis.use((context, content, selectors, parents, line, column, length) => {
if (context === 2 && selectors[0] === '.button') {
return content.replace('color: red', 'color: blue');
}
});
const css = `.button { color: red; }`;
const output = stylis('', css);
console.log(output);
PostCSS is a tool for transforming CSS with JavaScript plugins. It is more established and has a larger ecosystem of plugins compared to stylis. PostCSS can be used for a wide range of tasks including linting, optimization, and applying polyfills.
Sass is a mature and feature-rich CSS extension language that allows for variables, nesting, mixins, and more. Unlike stylis, Sass has its own syntax and requires compilation to CSS, but it offers a more comprehensive set of features for styling.
Less is another CSS pre-processor that extends the capabilities of CSS with variables, mixins, functions, and more. It is similar to Sass and offers a different syntax and feature set compared to stylis.
Stylis is a small css compiler that turns this
stylis('#user', styles);
Where styles
is the following css
@root {
body {
background: yellow;
}
}
.name {
transform: rotate(30deg);
}
span, h1 {
color:red;
/**
* removes block comments and line comments
*/
}
&{
animation: slidein 3s ease infinite;
}
&:before {
animation: slidein 3s ease infinite;
}
@keyframes slidein {
from { transform: translate(10px); }
to { transform: translate(200px); }
}
@media (max-width: 600px) {
& { appearance: none; }
}
into this (minus the whitespace)
body {
background: yellow;
}
#user .name {
-webkit-transform: rotate(30deg);
transform: rotate(30deg);
}
#user span,
#user h1 {
color: red;
}
#user {
-webkit-animation: userslidein 3s ease infinite;
animation: userslidein 3s ease infinite;
}
#user:before {
-webkit-animation: userslidein 3s ease infinite;
animation: userslidein 3s ease infinite;
}
@-webkit-keyframes userslidein {
from {
-webkit-transform: translate(10px);
transform: translate(10px);
}
to {
-webkit-transform: translate(200px);
transform: translate(200px);
}
}
@keyframes userslidein {
from {
-webkit-transform: translate(10px);
transform: translate(10px);
}
to {
-webkit-transform: translate(200px);
transform: translate(200px);
}
}
@media (max-width: 600px) {
#user {
-webkit-appearance: none;
appearance: none;
}
}
and if you wanted to append this to a style element/string
// browser, if the element passed is a style element the css will
// be append to it, if it is another element a style element with the
// css will be appended to it, thus this adds css to the already
// present style element
stylis('#user', styles, document.querySelector('style'));
// and this appends a style element to the head
stylis('#user', styles, document.head);
// or explicity request a string,
// in node this returns the css wrapped in <style id=stylis-${namespace}></style> tags
// and in the browser this returns a style element with the css
stylis('#user', styles, true);
// you can also pass a function
stylis('#user', styles (type, props, children) => {});
// where the arguments passed are
{
type: {string} 'style';
props: {Object} {id: 'stylis-${namespace}'};
output: {string} '...compiled css';
}
<script src=stylis.min.js></script>
<script src=https://unpkg.com/stylis@0.2.0/stylis.min.js></script>
npm install stylis --save
stylis(namespace: {string}, styles: {string}, element: {(function|boolean|Node)});
// if element is a function the arguments passed are ('style', stylis-${namespace}, output)
// you can also access the low level compiler
stylis.compiler === (ns, id, chars, isattr) => output;
// that can be used as follows
stylis.compiler('.', 'class1', 'css string...', false);
// or using the isattr set to true
stylis.compiler('data-scope', 'user', 'css string...', true);
// that will compile the namespace to '[data-scope=user]';
Stylis can be used to build an abstraction ontop of it, for example imagine we want to build an abstract that makes the following React Component possible
class Heading extends React.Component {
stylesheet(){
return `
&{
color: blue
}
`;
}
render() {
return (
React.createElement('h1', 'Hello World')
);
}
}
We could simply extend the Component class as follows
React.Component.prototype.stylis = function () {
var ctx = this;
var namespace = this.displayName;
return function () {
this.setAttribute(namespace);
stylis(namespace, ctx.stylesheet(), document.head);
}
}
Then use it in the following way
class Heading extends React.Component {
stylesheet(){
return `
&{
color: blue
}
`;
}
render() {
return (
React.createElement('h1', {ref: this.stylis}, 'Hello World')
);
}
}
When the first instance of the component is mounted the function assigned to the ref will get executed adding a style element with the compiled output of stylesheet()
where as only the namespace attribute is added to any subsequent instances.
You can of course do this another way
class Heading extends React.Component {
constructor (props) {
super(props);
// or you can even inline this
this.style = stylis(this.displayName, this.stylesheet(), React.createElement);
// this.style will be the return value of
// React.createElement('style', {id: 'stylis-Heading'}, this.stylesheet())
}
stylesheet(){
return `
&{
color: blue
}
`;
}
render() {
return (
React.createElement('h1', null, 'Hello World', this.style)
);
}
}
Both will add the resulting style element generated only once, one will add it to the head another will render it in place with the component.
If you want a picture into what can be done, there is an abstraction i created for dio.js that does away with the boilerplate entirely http://jsbin.com/mozefe/1/edit?js,output
FAQs
A Light–weight CSS Preprocessor
The npm package stylis receives a total of 9,967,976 weekly downloads. As such, stylis popularity was classified as popular.
We found that stylis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.