Checks the version of ES in JavaScript files with simple shell commands 🏆
Installations
npm install es-check
Developer Guide
Typescript
No
Module System
CommonJS
Min. Node Version
>= 4
Node Version
18.20.2
NPM Version
10.5.0
Score
51.2
Supply Chain
98.4
Quality
75.8
Maintenance
100
Vulnerability
100
License
Contributors
Languages
JavaScript (92.28%)
Shell (7.72%)
Developer
Download Statistics
Total Downloads
26,919,707
Last Day
3,924
Last Week
54,400
Last Month
349,404
Last Year
4,674,372
GitHub Statistics
172 Stars
431 Commits
15 Forks
5 Watching
2 Branches
2 Contributors
Package Meta Information
Latest Version
7.2.1
Package Id
es-check@7.2.1
Unpacked Size
19.21 kB
Size
7.24 kB
File Count
4
NPM Version
10.5.0
Node Version
18.20.2
Publised On
23 May 2024
Total Downloads
Cumulative downloads
Total Downloads
26,919,707
Last day
-79.7%
3,924
Compared to previous day
Last week
-41.1%
54,400
Compared to previous week
Last month
-23.4%
349,404
Compared to previous month
Last year
-9.6%
4,674,372
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Check JavaScript files ES version against a specified ES version 🏆
ES Check ✔️
ES Check checks JavaScript files against a specified version of ECMAScript (ES) with a shell command. If a specified file's ES version doesn't match the ES version argument passed in the ES Check command, ES Check will throw an error and log the files that didn't match the check.
Ensuring that JavaScript files can pass ES Check is important in a modular and bundled world. Read more about why.
Version 7 🎉
Thanks to the efforts of Anders Kaseorg, ES Check has switched to Commander! There appears to be no breaking issues but this update is being published as a major release for your ease-of-use. Please reach out with observations or pull requests features/fixes!
This update was made for security purposes—dependencies not being maintained.
Thanks to Anders for this deeper fix, to Pavel Starosek for the initial issue and support, and to Alexander Pepper for digging into this issue more!
Get Started Why ES Check? Usage Walk Through API Debugging Contributing Issues Roadmap
Get Started
Install
1 2npm i es-check --save-dev # locally 3npm i es-check -g # or globally 4
Check if an array or glob of files matches a specified ES version.
- Note: adds quotation around globs. Globs are patterns like so,
<something>/*.js
.
1 2es-check es5 './vendor/js/*.js' './dist/**/*.js' 3
- The ES Check script (above) checks
/dist/*.js
files to see if they're ES5. It throws an error and logs files are that do not pass the check.
Why ES Check?
In modern JavaScript builds, files are bundled up so they can be served in an optimized manner in the browsers. It is assumed by developers that future JavaScript—like ES8 will be transpiled (changed from future JavaScript to current JavaScript) appropriately by a tool like Babel. Sometimes there is an issue where files are not transpiled. There was no efficient way to test for files that weren't transpiled—until now. That's what ES Check does.
Walk through
The images below demonstrate command line scripts and their corresponding logged results.
Pass
Fail
ES Check is run above with node commands. It can also be run within npm scripts, ci tools, or testing suites.
API
ES Check provides the necessities. It accepts its place as a JavaScript matcher/tester.
General Information
1 2# USAGE 3 4index.js es-check <ecmaVersion> [files...] 5
Arguments
1 2<ecmaVersion> 'define the ECMAScript version to check for against a glob of JavaScript files' required 3[files...] 'a glob of files to test the ECMAScript version against' required 4
Options
Modules Flag
1 2--module use ES modules, default false 3
Allow Hash Bang
1 2--allow-hash-bang supports files that start with hash bang, default false 3
Not
1 2--not=target1,target2 An array of file/folder names or globs that you would like to ignore. Defaults to `[]`. 3
Files
1 2--files=target1,target2 An array of file/folder names or globs to test the ECMAScript version against. Alias of [...files] argument. 3
⚠️ NOTE: This is primarily intended as a way to override the files
setting in the .escheckrc
file for specific invocations. Setting both the [...files]
argument and --files
flag is an error.
Global Options
1 2-h, --help Display help 3-V, --version Display version 4--no-color Disable colors 5--quiet Quiet mode - only displays warn and error messages 6-v, --verbose Verbose mode - will also output debug messages 7
Usage
ES Check is a shell command CLI. It is run in shell tool like Terminal, ITerm, or Hyper. It takes in two arguments: an ECMAScript version (<ECMAScript version>
) and files ([files]
) in globs.
Here are some example of es check scripts that could be run:
1# globs 2es-check ./js/*.js 3 4# array of arguments 5es-check ./js/*.js ./dist/*.js
Configuration
If you're using a consistent configuration, you can create a .escheckrc
file in JSON format with the ecmaVersion
and files
arguments so you can conveniently run es-check
standalone from the command line.
Here's an example of what an .escheckrc
file will look like:
1{ 2 "ecmaVersion": "es6", 3 "module": false, 4 "files": "./dist/**/*.js", 5 "not": ["./dist/skip/*.js"] 6}
⚠️ NOTE: Using command line arguments while there is an .escheckrc
file in the project directory will override the configuration values in .escheckrc
.
Debugging
As of ES-Check version 2.0.2, a better debugging interface is provided. When a file errors, An error object will be logged with:
- the erroring file
- the error
- the error stack
⚠️ NOTE: Error logs are from the Acorn parser while parsing JavaScript related to specific versions of ECMAScript. This means error messaging is not specific to ECMAScript version. It still offers context into parsing issues!
Acknowledgements
ES Check is a small utility using powerful tools that Isaac Z. Schlueter, Marijn Haverbeke, and Matthias Etienne built. ES Checker by Ruan YiFeng checks the JavaScript version supported within a browser at run time. ES Check offers similar feedback to ES Checker but at build time and is specific to the product that is using it. ES Check was started after reading this post about [deploying es2015 code to production today] by Philip Walton.
Contributing
ES Check has 3 main dependencies: acorn, glob, and caporal. To contribute, file an issue or submit a pull request. To setup local development, run ./bin/setup.sh
or open the devcontainer in VSCode.
Contributors
Roadmap
- Provide compilation step to support esm
- non-user-facing
- required to keep package dependencies up-to-date as more dependencies are ESM-only
- Provide checks for theoretical keywork words
- Things like
Map
andObject.assign
are not keywords that fail ECMAScript compilation depending on specific versions of ECMAScript. However, they hint at additions to ECMAScript that previous version did not support. - This feature will enhance an already built-in confiration feature to provide more out-of-the-box support for ECMAScript checking.
- If enabled, this feature will warn (or fail) based on theoretical ECMAScript keywords.
- Things like
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
10 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
2 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
Reason
SAST tool detected but not run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Warn: 0 commits out of 30 are checked with a SAST tool
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Warn: no linked content found
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
Found 2/11 approved changesets -- score normalized to 1
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1
- Warn: no topLevel permission defined: .github/workflows/node.js.yml:1
- Warn: no topLevel permission defined: .github/workflows/update.yml:1
- Info: no jobLevel write permissions found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/node.js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/node.js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/update.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/update.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/yowainwright/es-check/update.yml/main?enable=pin
- Warn: containerImage not pinned by hash: .devcontainer/dockerfile:2
- Warn: npmCommand not pinned by hash: bin/setup.sh:35
- Warn: npmCommand not pinned by hash: .github/workflows/node.js.yml:25
- Info: 0 out of 8 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 containerImage dependencies pinned
- Info: 0 out of 2 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Score
5.5
/10
Last Scanned on 2024-12-16
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More