Gathering detailed insights and metrics for @roots/bud-purgecss
Gathering detailed insights and metrics for @roots/bud-purgecss
Build tool that wraps webpack complexity behind an elegant, minimal API
Installations
npm install @roots/bud-purgecssDeveloper Guide
BETA
Typescript
Yes
Module System
ESM
Min. Node Version
>=16
Releases
97
Languages
14
TypeScript
MDX
JavaScript
Objective-C
CSS
Handlebars
Ruby
Vue
Dockerfile
Shell
Rich Text Format
SCSS
HTML
Blade
TypeScript (81.43%)
MDX (10.68%)
JavaScript (5%)
Objective-C (0.86%)
CSS (0.77%)
Handlebars (0.63%)
Ruby (0.33%)
Vue (0.11%)
Dockerfile (0.08%)
Shell (0.05%)
Rich Text Format (0.02%)
SCSS (0.02%)
Developer
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
MIT License
346 Stars
1,718 Commits
43 Forks
9 Watchers
75 Branches
25 Contributors
Updated on Jul 09, 2025
Sponsor this package
Maintainers
5
Package Meta Information
Latest Version
6.24.0
Package Id
@roots/bud-purgecss@6.24.0
Unpacked Size
22.43 kB
Size
5.22 kB
File Count
18
Published on
Dec 09, 2024
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dev Dependencies
3
bud.js
Configurable, extensible build tools for modern single and multi-page web applications
Goals
bud.js wants to be:
- Reliable, yielding consistent and predictable behaviors regardless of specified options.
- Fast, leveraging parallel processing, smart caching and an asyncronous events based API to keep build times minimal.
- Extensible, with a fully featured plugin system to support an ecosystem of packaged modules.
- Simple, to get started and straight forward to maintain.
Features
- Zero config by default. Check out this codesandbox template with react, postcss modules and no config.
- Modular by design. Use only what you need.
- Multi-compiler support.
- Heckin’ fast.
- Lux developer tooling and semi-automated dependency management.
- Support for configuration files authored with TypeScript, JSON, YML, CJS and ESM.
- Support for CDNs like skypack and unpkg.
- Customizable and extensible.
Requirements
- Node 16+
- yarn 1.22 or higher
- npm 8.3 or higher
- Windows users must run bud.js under the Windows Subsystem for Linux.
Getting started
Quickly scaffold a new project with create-bud-app:
npx create-bud-app
If you want to add bud.js to an existing project or want to further customize the scaffolded app check out the Getting Started guide.
There are many example implementations available.
Modules
Presets
ℹ Presets are a collection of extensions which are commonly used together. There are currently three presets: our general preset, a WordPress specific preset, and the preset used in the roots/sage theme.
| Package name | Usage | Stable Release | Preview Release |
|---|---|---|---|
| @roots/bud-preset-recommend | 📚 Docs |  |  |
| @roots/bud-preset-wordpress | 📚 Docs |  |  |
| @roots/sage | 📚 Docs |  |  |
Extensions
Language support & module preprocessors
ℹ These extensions provide support for languages and syntaxes which are not understood by the browser and require compilation.
| Name | README | Stable Release | Preview Release |
|---|---|---|---|
| @roots/bud-babel | 📚 Docs |  |  |
| @roots/bud-esbuild | 📚 Docs |  |  |
| @roots/bud-mdx | 📚 README |  |  |
| @roots/bud-postcss | 📚 Docs |  |  |
| @roots/bud-sass | 📚 Docs |  |  |
| @roots/bud-swc | 📚 Docs |  |  |
| @roots/bud-typescript | 📚 Docs |  |  |
Optimization
ℹ These extensions optimize compiled code and static assets to help ensure a high quality user experience in your app. They are typically only run in
productionmode.
| Name | README | Stable Release | Preview Release |
|---|---|---|---|
| @roots/bud-compress | 📚 README |  |  |
| @roots/bud-criticalcss | 📚 Docs |  |  |
| @roots/bud-imagemin | 📚 Docs |  |  |
| @roots/bud-purgecss | 📚 Docs |  |  |
Features and framework support
ℹ These extensions provide support for popular application frameworks like React & Vue. Make sure to install a compatible compiler or preprocessor.
| Name | README | Stable Release | Preview Release |
|---|---|---|---|
| @roots/bud-emotion | 📚 Docs |  |  |
| @roots/bud-react | 📚 Docs |  |  |
| @roots/bud-solid | 📚 Docs |  |  |
| @roots/bud-tailwindcss | 📚 Docs |  |  |
| @roots/bud-vue | 📚 Docs |  |  |
Code quality
ℹ These extensions ensure source code conforms to a specified style. Linting configuration is expected to be provided by the user, but a base eslint config is available: @roots/eslint-config.
| Name | README | Stable Release | Preview Release |
|---|---|---|---|
| @roots/bud-eslint | 📚 Docs |  |  |
| @roots/bud-prettier | 📚 README |  |  |
| @roots/bud-stylelint | 📚 Docs |  |  |
WordPress specific
ℹ All of these extensions are included in @roots/bud-preset-wordpress.
| Name | README | Stable Release | Preview Release |
|---|---|---|---|
| @roots/bud-tailwindcss-theme-json | 📚 README |  |  |
| @roots/bud-wordpress-dependencies | 📚 README |  |  |
| @roots/bud-wordpress-externals | 📚 README |  |  |
| @roots/bud-wordpress-theme-json | 📚 README |  |  |
Community extensions
ℹ The following extensions are maintained by the community. Please refrain from making issues in this repo regarding these extensions.
| Name | README | Stable Release |
|---|---|---|
| bud-embedded | 📚 README |  |
| bud-localtunnel | 📚 README |  |
| bud-wp-editor-query | 📚 README |  |
Have you produced a bud.js extension and want to share it here? Please, create an issue sharing information about your project.
For more information on authoring your own extension consult the documentation and the source code of the extensions in this repository.
Core modules
ℹ @roots/bud is actually made up of a number of packages. You only need to install
@roots/budto use bud.js.
Support modules
ℹ These packages are not specific to bud.js but are used by the framework. They could be used in other projects outside of the context of bud.js.
License
bud.js is licensed under MIT.
No vulnerabilities found.
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE.md:0
- Info: FSF or OSI recognized license: MIT License: LICENSE.md:0
Reason
binaries present in source code
Details
- Warn: binary detected: sources/@roots/bud-framework/vendor/mac.no-index/roots-notifier.app/Contents/MacOS/roots-notifier:1
Reason
SAST tool detected but not run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Warn: 24 commits out of 25 are checked with a SAST tool
Reason
Found 14/19 approved changesets -- score normalized to 7
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:32
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:33
- Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1
- Warn: no topLevel permission defined: .github/workflows/discourse.yml:1
- Warn: no topLevel permission defined: .github/workflows/labeler.yml:1
- Warn: no topLevel permission defined: .github/workflows/lint.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-main.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-nightly.yml:1
- Warn: no topLevel permission defined: .github/workflows/stale.yml:1
- Warn: no topLevel permission defined: .github/workflows/test.e2e.yml:1
- Warn: no topLevel permission defined: .github/workflows/test.integration.yml:1
- Warn: no topLevel permission defined: .github/workflows/test.unit.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/codeql-analysis.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/discourse.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/discourse.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/labeler.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/labeler.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-main.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/release-main.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-main.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/release-main.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-nightly.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/release-nightly.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-nightly.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/release-nightly.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/stale.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.e2e.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/test.e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.e2e.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/test.e2e.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.integration.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/test.integration.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.integration.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/test.integration.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.unit.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/test.unit.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.unit.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/roots/bud/test.unit.yml/main?enable=pin
- Warn: containerImage not pinned by hash: .docker/bud.dockerfile:1: pin your Docker image by updating node:lts to node:lts@sha256:2fa6c977460b56d4d8278947ab56faeb312bc4cc6c4cf78920c6de27812f51c5
- Warn: containerImage not pinned by hash: .docker/chrome.dockerfile:1: pin your Docker image by updating node:lts to node:lts@sha256:2fa6c977460b56d4d8278947ab56faeb312bc4cc6c4cf78920c6de27812f51c5
- Warn: npmCommand not pinned by hash: .docker/bud.dockerfile:6
- Info: 0 out of 17 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 third-party GitHubAction dependencies pinned
- Info: 0 out of 2 containerImage dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
55 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-x4c5-c7rf-jjgv
- Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
- Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
- Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
- Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-36jr-mh4h-2g58
- Warn: Project is vulnerable to: GHSA-4gmj-3p3h-gm8h
- Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99
- Warn: Project is vulnerable to: GHSA-f7f6-9jq7-3rqj
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27
- Warn: Project is vulnerable to: GHSA-4www-5p9h-95mh
- Warn: Project is vulnerable to: GHSA-9gqv-wp59-fq42
- Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-3rfm-jhwj-7488
- Warn: Project is vulnerable to: GHSA-hhq3-ff78-jv3g
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-x5gf-qvw8-r2rm
- Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
- Warn: Project is vulnerable to: GHSA-x7hr-w5r2-h6wg
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-76p7-773f-r4q5
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-3qxh-p7jc-5xh6
- Warn: Project is vulnerable to: GHSA-cvv5-9h9w-qp2m
- Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx
- Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v
- Warn: Project is vulnerable to: GHSA-vg6x-rcgg-rjx6
- Warn: Project is vulnerable to: GHSA-x574-m823-4x7w
- Warn: Project is vulnerable to: GHSA-4r4m-qw57-chr8
- Warn: Project is vulnerable to: GHSA-xcj6-pq6g-qj4x
- Warn: Project is vulnerable to: GHSA-356w-63v5-8wf4
- Warn: Project is vulnerable to: GHSA-859w-5945-r5v3
- Warn: Project is vulnerable to: GHSA-9crc-q9x8-hgqq
- Warn: Project is vulnerable to: GHSA-cchq-frgv-rjh5
- Warn: Project is vulnerable to: GHSA-g644-9gfx-q4q4
- Warn: Project is vulnerable to: GHSA-5j4c-8p2g-v4jx
- Warn: Project is vulnerable to: GHSA-g3ch-rx76-35fx
- Warn: Project is vulnerable to: GHSA-4vvj-4cpr-p986
- Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6
- Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v
- Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
4.7
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More