npmpackage.info

Gathering detailed insights and metrics for @rollup/plugin-replace

Other packages similar to @rollup/plugin-replace

rollup-plugin-replace

2.2.0

[![](https://img.shields.io/npm/v/rollup-plugin-replace.svg?style=flat)](https://www.npmjs.com/package/rollup-plugin-replace)

rollup-plugin-replace-shebang

1.2.0

一个自动替换shebang的rollup插件

rollup-plugin-re

1.0.7

rollup replace plugin

rollup-plugin-search-and-replace

1.0.1

A rollup plugin that searches for and replaces text in one or more files. It works synchronously and makes a single replacement or several replacements at once.

Gathering detailed insights and metrics for @rollup/plugin-replace

@rollup/plugin-replace

🍣 The one-stop shop for official Rollup plugins

6.0.2

3,713

MIT

JavaScript

23.06 kB

3.9

Installations

npm install @rollup/plugin-replace

Developer Guide

BETA

Typescript

Yes

Module System

CommonJS, ESM

Min. Node Version

>=14.0.0

Node Version

20.18.1

NPM Version

10.8.2 Score

92.7

Supply Chain

99.5

Quality

Maintenance

100

Vulnerability

99.6

License

Pull Requests

Open

9

Total

757

Closed

186

Merged

562

Issues

Open

21

Total

1,033

Closed

1,012

Releases

Unable to fetch releases

Languages

JavaScript

TypeScript

Shell

JavaScript (75.16%)

TypeScript (24.83%)

Shell (0.01%)

Developer

rollup

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

MIT License

3,713 Stars

1,228 Commits

604 Forks

35 Watchers

5 Branches

270 Contributors

Updated on Jul 10, 2025

Maintainers

View All 270 Contributors

Package Meta Information

Latest Version

6.0.2

Package Id

@rollup/plugin-replace@6.0.2

Unpacked Size

23.06 kB

Size

6.18 kB

File Count

NPM Version

10.8.2

Node Version

20.18.1

Published on

Dec 15, 2024

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

@rollup/plugin-replace

🍣 A Rollup plugin which replaces targeted strings in files while bundling.

Requirements

This plugin requires an LTS Node version (v14.0.0+) and Rollup v1.20.0+.

Install

Using npm:

1npm install @rollup/plugin-replace --save-dev

Usage

Create a rollup.config.js configuration file and import the plugin:

1import replace from '@rollup/plugin-replace';
2
3export default {
4  input: 'src/index.js',
5  output: {
6    dir: 'output',
7    format: 'cjs'
8  },
9  plugins: [
10    replace({
11      'process.env.NODE_ENV': JSON.stringify('production'),
12      __buildDate__: () => JSON.stringify(new Date()),
13      __buildVersion: 15
14    })
15  ]
16};

Then call rollup either via the CLI or the API.

The configuration above will replace every instance of process.env.NODE_ENV with "production" and __buildDate__ with the result of the given function in any file included in the build.

Note: Values must be either primitives (e.g. string, number) or function that returns a string. For complex values, use JSON.stringify. To replace a target with a value that will be evaluated as a string, set the value to a quoted string (e.g. "test") or use JSON.stringify to preprocess the target string safely.

Typically, @rollup/plugin-replace should be placed in plugins before other plugins so that they may apply optimizations, such as dead code removal.

Options

In addition to the properties and values specified for replacement, users may also specify the options below.

`delimiters`

Type: Array[String, String]
Default: ['\\b', '\\b(?!\\.)']

Specifies the boundaries around which strings will be replaced. By default, delimiters are word boundaries and also prevent replacements of instances with nested access. See Word Boundaries below for more information. For example, if you pass typeof window in values to-be-replaced, then you could expect the following scenarios:

typeof window will be replaced
typeof window.document will not be replaced due to (?!\.) boundary
typeof windowSmth will not be replaced due to a \b boundary

Delimiters will be used to build a Regexp. To match special characters (any of .*+?^${}()|[]\), be sure to escape them.

`objectGuards`

Type: Boolean
Default: false

When replacing dot-separated object properties like process.env.NODE_ENV, will also replace typeof process object guard checks against the objects with the string "object".

For example:

1replace({
2  values: {
3    'process.env.NODE_ENV': '"production"'
4  }
5});

1// Input
2if (typeof process !== 'undefined' && process.env.NODE_ENV === 'production') {
3  console.log('production');
4}
5// Without `objectGuards`
6if (typeof process !== 'undefined' && 'production' === 'production') {
7  console.log('production');
8}
9// With `objectGuards`
10if ('object' !== 'undefined' && 'production' === 'production') {
11  console.log('production');
12}

`preventAssignment`

Type: Boolean
Default: false

Prevents replacing strings where they are followed by a single equals sign. For example, where the plugin is called as follows:

1replace({
2  values: {
3    'process.env.DEBUG': 'false'
4  }
5});

Observe the following code:

1// Input
2process.env.DEBUG = false;
3if (process.env.DEBUG == true) {
4  //
5}
6// Without `preventAssignment`
7false = false; // this throws an error because false cannot be assigned to
8if (false == true) {
9  //
10}
11// With `preventAssignment`
12process.env.DEBUG = false;
13if (false == true) {
14  //
15}

`exclude`

Type: String | Array[...String]
Default: null

A picomatch pattern, or array of patterns, which specifies the files in the build the plugin should ignore. By default no files are ignored.

`include`

Type: String | Array[...String]
Default: null

A picomatch pattern, or array of patterns, which specifies the files in the build the plugin should operate on. By default all files are targeted.

`sourceMap` or `sourcemap`

Type: Boolean
Default: false

Enables generating sourcemaps for the bundled code. For example, where the plugin is called as follows:

1replace({
2  sourcemap: true
3});

`values`

Type: { [key: String]: Replacement }, where Replacement is either a string or a function that returns a string. Default: {}

To avoid mixing replacement strings with the other options, you can specify replacements in the values option. For example, the following signature:

1replace({
2  include: ['src/**/*.js'],
3  changed: 'replaced'
4});

Can be replaced with:

1replace({
2  include: ['src/**/*.js'],
3  values: {
4    changed: 'replaced'
5  }
6});

Word Boundaries

By default, values will only match if they are surrounded by word boundaries.

Consider the following options and build file:

1module.exports = {
2  ...
3  plugins: [replace({ changed: 'replaced' })]
4};

1// file.js
2console.log('changed');
3console.log('unchanged');

The result would be:

1// file.js
2console.log('replaced');
3console.log('unchanged');

To ignore word boundaries and replace every instance of the string, wherever it may be, specify empty strings as delimiters:

1export default {
2  ...
3  plugins: [
4    replace({
5      changed: 'replaced',
6      delimiters: ['', '']
7    })
8  ]
9};

10

Maintained

Determines if the project is "actively maintained".

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

7

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

4

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Security-Policy

Determines if the project has published a security policy.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-windows.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/node-windows.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-windows.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/node-windows.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/node-windows.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/node-windows.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-title.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/pr-title.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/release.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/release.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/release.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/release.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/validate.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/validate.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/validate.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/validate.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/validate.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/validate.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/validate.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/rollup/plugins/validate.yml/master?enable=pin
Info: 0 out of 8 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 4 third-party GitHubAction dependencies pinned

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

3.9

/10

Last Scanned on 2025-06-30

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

@rollup/plugin-replace - 6.0.2 | npmpackage.info

Other packages similar to @rollup/plugin-replace

Other packages similar to @rollup/plugin-replace

@rollup/plugin-replace

Installations

Developer Guide

Yes

CommonJS, ESM

>=14.0.0

20.18.1

10.8.2

Score

Pull Requests

9

757

186

562

Issues

21

1,033

1,012

Releases

Unable to fetch releases

Languages

Developer

rollup

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

NaN

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Peer Dependencies

Dev Dependencies

@rollup/plugin-replace

Requirements

Install

Usage

Options

delimiters

objectGuards

preventAssignment

exclude

include

sourceMap or sourcemap

values

Word Boundaries

Meta

10

10

10

7

4

0

0

0

0

0

0

0

3.9

/10

`delimiters`

`objectGuards`

`preventAssignment`

`exclude`

`include`

`sourceMap` or `sourcemap`

`values`