Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
tsserver-lean
Advanced tools
lean subset of tsserver that only supports typechecking
Implements a tiny sub-set of tsserver
, also using different internal APIs. Its reason d'etré is to i) emit diagnostics for a particular TypeScript module; ii) doing the least amount of work possible.
tsserver-lean
expects communication to be done through its stdin
and stdout
pipes, like tsserver
. It expects a set of requests defined in protocol.ts
that are mapped to responses in a handler, on session.ts
.
After a refactor, we are now using TypeScript's ProjectService
API, that is responsible for managing multiple configured projects. With current setup, that means that we have a ProjectService
for each project that we've requested diagnostics for. It has several efficiency affordances like caching of many adjacent functionality (ScriptInfo
, module resolution, dependency type checkings) and the ability to extract diagnostics directly from a source file.
There are some contracts and premises that is worth being aware of:
tsserver-lean
uses readline
to read its input, so whenever we want to programmatically write to the process' stdin, it is required that a \n
is added to the end of the request message.tsserver-lean
will write a \n
to its stdout, so it is required that the client reads until it finds a \n
to know that the response has ended.So far, the only need for this server is to emit diagnostics for a particular module, on demand.
{ "command": "geterr", "type": "request", "seq": 0, "arguments": { "files": ["path/a/.ts", "path/b/.ts"] } }
Used as a first message sent to stdout to indicate a successful start-up.
{ "command": "handshake", "type": "request", "seq": 0 }
FAQs
lean subset of tsserver that only supports typechecking
The npm package tsserver-lean receives a total of 10 weekly downloads. As such, tsserver-lean popularity was classified as not popular.
We found that tsserver-lean demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.