Compiling Ember apps into spec-compliant, modern Javascript.
Installations
npm install @embroider/addon-shim
Releases
v7.0.0-@embroider/addon-dev
Published on 11 Nov 2024
v3.7.0-@embroider/compat
Published on 06 Nov 2024
v1.9.0-@embroider/addon-shim
Published on 31 Oct 2024
v3.6.5-@embroider/compat
Published on 10 Oct 2024
v1.0.1-@embroider/broccoli-side-watch
Published on 09 Oct 2024
v6.0.1-@embroider/addon-dev
Published on 09 Oct 2024
Developer
embroider-build
Developer Guide
Module System
CommonJS
Min. Node Version
12.* || 14.* || >= 16
Typescript Support
Yes
Node Version
20.14.0
NPM Version
10.8.2
Statistics
339 Stars
5,156 Commits
138 Forks
28 Watching
147 Branches
87 Contributors
Updated on 27 Nov 2024
Bundle Size
321.08 kB
Minified
86.89 kB
Minified + Gzipped
Languages
TypeScript (93.19%)
JavaScript (6.1%)
HTML (0.66%)
CSS (0.03%)
Handlebars (0.02%)
Total Downloads
Cumulative downloads
Total Downloads
15,868,855
Last day
-32.3%
17,044
Compared to previous day
Last week
-15.3%
106,489
Compared to previous week
Last month
21.7%
529,630
Compared to previous month
Last year
49.7%
7,970,656
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Embroider: translating existing Ember code into spec-compliant modern JavaScript
This repo implements a new three-stage build system for Ember apps:
-
The first stage achieves backward compatibility by building each classic Ember Addon package into a new v2 package format. This makes each package much more static and analyzable. The eventual goal is to do less and less work in this stage, as addons publish to NPM natively in v2 format.
-
The second stage takes a collection of v2-formatted addons plus an application and "compiles out" all Ember-specific conventions, such that the output can be understood by any tool that can handle standards-compliant Javascript. This stage is setup with good inputs and outputs that make it much easier to benefit from incremental improvements to our dependency analysis. The immediate goal is not to implement every possible optimization, but rather to make a good place for those optimizations to happen.
-
The third stage ("final packaging") can be handled by existing tools like Webpack, Rollup, or Parcel with only a small amount of configuration. Not because we want to force every Ember developer to choose and configure one of these tools! But because a stable, standards-compliant API between stage 2 and 3 improves our ability to innovate and experiment with taking the best parts of wider JS ecosystem tooling.
You can read more about the motivation and key ideas in the intro to the SPEC.
Status / Should I Use It?
Several large, heavily-tested Ember apps are shipping to production with Embroider. So if you are excited to adopt Embroider, it is a reasonable choice. The main risks to be aware of if you choose to use Embroider in production are:
- you're likely to discover some Ember addons don't work or break your build
- Embroider's own configuration options are subject to change, so you'll need to read the CHANGELOG.md when updating the Embroider packages.
Alternatively, it is totally safe to stick with the traditional build pipeline and wait for the official cutover point when EmberCLI starts generating new apps with Embroider by default.
For Addon Authors
Addon authors should see ADDON-AUTHOR-GUIDE.md for advice on how to get their existig addons ready for Embroider.
The v2 Addon Format RFC is the official spec for the packages that Embroider natively handles. Common patterns and best practices for authoring these have been collected in the v2 addon FAQs. For creating a new v2 addon from scratch, we recommend using our v2 addon blueprint. For porting existing v1 addons, we refer to the v2 porting guide.
How to try it
-
Add dependencies:
yarn add --dev @embroider/core @embroider/compat @embroider/webpack webpack
-
Edit
ember-cli-build.js
:1-return app.toTree(); 2+const { Webpack } = require('@embroider/webpack'); 3+return require('@embroider/compat').compatBuild(app, Webpack);
Alternatively, if you are passing optional extra broccoli trees into
app.toTree()
, you can rewrite like:1-return app.toTree(extraTreeHere); 2+const { Webpack } = require('@embroider/webpack'); 3+return require('@embroider/compat').compatBuild(app, Webpack, { 4+ extraPublicTrees: [extraTreeHere] 5+});
-
Use
ember serve
,ember test
, andember build
as usual.
Options
You can pass options into Embroider by passing them into the compatBuild
function like:
1return require('@embroider/compat').compatBuild(app, Webpack, { 2 // staticAddonTestSupportTrees: true, 3 // staticAddonTrees: true, 4 // staticHelpers: true, 5 // staticModifiers: true, 6 // staticComponents: true, 7 // staticEmberSource: true, 8 // splitAtRoutes: ['route.name'], // can also be a RegExp 9 // packagerOptions: { 10 // webpackConfig: { } 11 // } 12});
The options are documented in detail in Core Options, Compat Options, and Webpack Options.
The recommended steps when introducing Embroider into an existing app are:
- First make it work with no options. This is the mode that supports maximum backward compatibility. If you're hitting errors, first look at the "Compatibility with Classic Builds" section below.
- Enable
staticAddonTestSupportTrees
andstaticAddonTrees
and test your application. This is usually safe, because most code in these trees gets consumed viaimport
statements that we can analyze. But you might find exceptional cases where some code is doing a more dynamic thing. - Enable
staticHelpers
andstaticModifiers
and test. This is usually safe because addon helpers and modifiers get invoked declaratively in templates and we can see all invocations. - Enable
staticComponents
, and work to eliminate any resulting build warnings about dynamic component invocation. You may need to addpackageRules
that declare where invocations like{{component someComponent}}
are gettingsomeComponent
from. - Once your app is working with all of the above, you can enable
splitAtRoutes
and add the@embroider/router
and code splitting should work. See the packages/router/README.md for details and limitations.
Configuring asset URLs
If you are serving your assets from a different origin (like a CDN) from where your index.html content will
be served from, you can use the publicAssetURL option to specify the base URL. In pre-Embroider Ember apps,
this was accomplished by configuring the fingerprint: { prepend: ... }
option handled by broccoli-asset-rev.
1return require('@embroider/compat').compatBuild(app, Webpack, { 2 packagerOptions: { 3 publicAssetURL: EmberApp.env() === 'production' ? 'https://your-cdn-here.com/' : '/', // This should be a URL ending in "/" 4 }, 5});
Template Tag Codemod
Edit ember-cli-build.js
:
1return require('@embroider/compat').templateTagCodemod(app, { 2 shouldTransformPath: (path) => { return true; }, 3 nameHint: (path) => { 4 // example path: shared/my-button 5 return path; 6 }, 7 dryRun: true, 8});
Run a normal ember build to transform your hbs templates into template tag single file components. Requires optimized build (static* flags to be turned on)
Options
shouldTransformPath
- allows users to filter the templates that the code mod would run onnameHint
- optional function control the import name and template replacement values - valid JS identifier required or it will be coerced into onedryRun
- option can be used to obtain a summary of the changed the build would perform and which files it would act upon
Limitations
- App templates only
@embroider/compat
>= 3.6.0
Compatibility
Ember version
Requires Ember 3.28.11 or greater
With Classic Builds
While we have a strong emphasis on backward compatibility with classic builds, there are a few places where you may need to make changes to your code:
Lazy Engines
If you're using lazy loaded engines, you need to use @embroider/router
, which is a drop-in replacement for @ember/routing/router
:
1-import EmberRouter from '@ember/routing/router'; 2+import EmberRouter from '@embroider/router';
See @embroider/router README for more details.
Analyzing Bundles
see ANALYZING.md
Contributing
see CONTRIBUTING.md
License
This project is licensed under the MIT License.
Acknowledgements
Thanks to Cardstack for sponsoring Embroider's development.
Thanks to the Embroider Initiative sponsors for contributing to Embroider's development:
No vulnerabilities found.
Reason
30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish.yml:35
Reason
Found 1/6 approved changesets -- score normalized to 1
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/plan-release.yml:37
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/publish.yml:41
- Warn: no topLevel permission defined: .github/workflows/ci.yml:1
- Warn: no topLevel permission defined: .github/workflows/plan-release.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish-unstable.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish.yml:1
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Info: Possibly incomplete results: error parsing job operating system: .github/workflows/ci.yml:54
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/ci.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/ci.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/plan-release.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/plan-release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/plan-release.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/plan-release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/plan-release.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/plan-release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-unstable.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/publish-unstable.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-unstable.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/publish-unstable.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/publish.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/publish.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/embroider-build/embroider/publish.yml/main?enable=pin
- Info: 0 out of 9 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Reason
17 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-whgm-jr23-g3j9
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-wxhq-pm8v-cw75
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
- Warn: Project is vulnerable to: GHSA-2pr6-76vf-7546
- Warn: Project is vulnerable to: GHSA-8j8c-7jfh-h6hx
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-6vfc-qv3f-vr6c
- Warn: Project is vulnerable to: GHSA-7wpw-2hjm-89gp
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-rp65-9cf3-cjxr
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-4wf5-vphf-c2xc
Score
4.3
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More