Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools oft miss.
webpack-version-plugin
Advanced tools
Use the webpack version plugin, you can get the hash and chunkhash, then do something.
npm
$ npm install webpack-version-plugin --save-dev
yarn
$ yarn add webpack-version-plugin --dev
// webpack.config.js
const fs = require('fs');
const path = require('path');
const webpack = require('webpack');
const WebpackVersionPlugin = require('webpack-version-plugin');
const versionConfig = require(path.join(__dirname, './version.json'));
module.exports = {
entry: {
app: 'src/app',
vendor: ['react', 'react-dom']
},
output: {
path: 'dist/',
filename: 'js/[name]_[hash:8].js',
publicPath: 'cdn_path'
},
plugins: [
new WebpackVersionPlugin({
// You must set the cb option
cb: function(hashMap) {
console.log(hashMap);
/* do something, the hashMap like this:
{
hash: 'fa74f31052feddb3032256f018063b88',
chunkHash: {
app: '4089fbc1699ec5b6009b0f9bfcdc8327',
vendor: 'ff7f0450afc7ff3030cba2428e593dcf'
}
}*/
versionConfig.vendorJsVersion = hashMap.hash;
fs.writeFileSync(path.join(__dirname, './version.json'), JSON.stringify(versionConfig, null, 2));
}
}),
...
]
}
// version.json
// before
{
"vendorJsVersion": "767e2c64d1208e06c8810bea26c29ab6",
"appVersion": "0cb630602d69887ef37c143c14bbeab7"
}
// after
{
"vendorJsVersion": "fa74f31052feddb3032256f018063b88",
"appVersion": "0cb630602d69887ef37c143c14bbeab7"
}
最近在给项目的生成文件需要添加形如 [hash:8]
版本号并把该版本号同步记录到某配置文件内,想到每次更改生成新的打包文件,都要去版本配置的文件里更改版本号,程序员最不喜欢做这种重复性的劳动了,就想着有没有 webpack
插件能做类似的功能,能把我的版本号写到配置文件里去,找了一圈只找到 webpack-version-hash-plugin ,而且只能输出在固定的位置和固定的格式 (╯‵□′)╯︵┻━┻ ,无奈,我当时直接用了时间戳作为构建的版本号,后来就做了现在的这个插件,我可以在插件的 cb
函数中把获取到的版本号写到我单独的 json
文件中,当然,这里获取到的是完整的hash
值,可以按需截取。
FAQs
webpack-version-plugin
The npm package webpack-version-plugin receives a total of 8 weekly downloads. As such, webpack-version-plugin popularity was classified as not popular.
We found that webpack-version-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools oft miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.