npmpackage.info

Gathering detailed insights and metrics for hexo-theme-candelas

hexo-theme-candelas - 1.1.0 | npmpackage.info

hexo-theme-candelas

The next generation of the hexo default theme Landscape.

1.1.0

NOASSERTION

Stylus

71.02 kB

2.9

Installations

npm install hexo-theme-candelas

Developer Guide

BETA

Typescript

No

Module System

N/A

Node Version

10.24.1

NPM Version

6.14.12 Score

71.6

Supply Chain

99.3

Quality

75.5

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

13

Total

23

Closed

5

Merged

5

Issues

Open

1

Total

31

Closed

30

Releases

v1.1.0

Updated on Mar 27, 2022

v1.0.0

Updated on Oct 07, 2021

View All 2 releases

Languages

Stylus

EJS

JavaScript

Stylus (52.14%)

EJS (28.42%)

JavaScript (19.44%)

Developer

DukeLuo

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

NOASSERTION License

8 Stars

352 Commits

2 Forks

1 Watchers

15 Branches

51 Contributors

Updated on Dec 19, 2024

Maintainers

View All 51 Contributors

Package Meta Information

Latest Version

1.1.0

Package Id

hexo-theme-candelas@1.1.0

Unpacked Size

71.02 kB

Size

23.25 kB

File Count

NPM Version

6.14.12

Node Version

10.24.1

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

editorconfig-checker ejs-lint eslint eslint-plugin-check-file eslint-plugin-html pre-commit

Candelas

Candelas is the next generation of the hexo default theme Landscape. The goal of this project is to add more features and customization to the Landscape theme.

Candelas demo site can be found here, which is built up with Hexo Theme Unit Test as the source.

the mockup of Candelas

Features

add random banner
add post toc widget
add like post widget
add support for category page
add copyright statement for each post
add support for gitalk
add profile widget
new page layout
new tag cloud widget
other UI enhancements

Installation

If you're using Hexo 5.0 or later, the simplest way to install is through npm:

1$ cd hexo-site
2$ npm install hexo-theme-candelas

Or you can clone the entire repository:

1$ cd hexo-site
2$ git clone https://github.com/DukeLuo/hexo-theme-candelas themes/candelas

After the installation, open Hexo config file _config.yml and set the theme variable to candelas.

1theme: candelas

Upgrade

If your Candelas is installed by npm, you can use the following command to upgrade:

1$ npm install hexo-theme-candelas@latest

Or If you're using Candelas by cloning the entire repository, you can do the following step to get the latest version:

1$ cd hexo-site/themes/candelas
2$ git pull -r

Setup

If you're using Hexo 5.0 or later, the recommended way is to create a configuration file _config.candelas.yml for the Candelas theme under the root of the hexo blog.

Or you can modify the default configuration file _config.yml under the themes/candelas folder directly.

Random banner

The Candelas theme can display a random banner on the home page. You only need to provide the URL you want to show as follows:

1banner:
2  - 'https://files.shaiwang.life/banner/banner-1.jpg'
3  - 'https://files.shaiwang.life/banner/banner-2.jpg'
4  - 'https://files.shaiwang.life/banner/banner-3.jpg'

Like post widget

The like post widget is used to give the blog post a like. It uses fingerprint.js to generate a unique id for each reader, and the data is stored on the github gist. The count of like can only be increased.

If you want to enable the like post widget, you should set the enabled field as true. To use the github gist api to store the data, you will need to create a personal access token firstly. Be sure to check the gist(create a gists) check box and do not check the check boxes for other permissions. The github official link may give you a hand.

Due to the security risk, pushing the code with the personal access token to github is not allowed. Here I used a fool-style workaround to avoid this problem, encoding the token as base64 string and decoding the string in the code.

For example, the personal access token generated by github is xxxx, then using F12 to open the console and input window.btoa('xxxx'), then you get the base64 string 'eHh4eA==', so you should configure like post widget as follows:

1like:
2  enabled: true
3  gistBase64Token: 'eHh4eA=='

Profile widget

The profile widget is used to display a personal profile.

If you would like to enable the RSS, the hexo-generator-feed plugin is also required.

The configuration looks like the following:

1profile:
2  enableBalloon: true
3  metto: 'Talk is cheap. Show me the code.'
4  source: 'Linus Torvalds'
5  name: 'DukeLuo'
6  location: 'Wuhan'
7  github: DukeLuo             # the username of GitHub
8  stackoverflow: 12814009     # the user ID of Stack Overflow
9  email: dukeluo@outlook.com
10  rss: /atom.xml

Gitalk

Gitalk is a comment component based on github issue. You can follow the gitalk official tour guide to set up the gitalk.

Gitalk is disabled in Candelas by default, if you want to use the gitalk, you should set the enabled field as true, and the configuration looks like the following:

1gitalk:
2  enabled: true
3  owner: 'DukeLuo'                 # the owner of the repo stored the comment
4  repo: 'DukeLuo.github.io'        # the name of the repo stored the comment
5  admin: 'DukeLuo'                 # the user who has the permission to initialize github issues
6  clientID: 'xxxx'                 # the client id generated by github
7  clientSecret: 'xxxx'             # the client secret generated by github
8  labels: ['Gitalk', 'Candelas']   # the label for the relative issue

Category page

use hexo new page categories to create a categories page.
modify the content of the generated file index.md under the source/categories as the following:

---
title: categories
layout: categories
---

No vulnerabilities found.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

9

License

Determines if the project has defined a license.

7

SAST

Determines if the project uses static code analysis.

0

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/dukeluo/hexo-theme-candelas/codeql-analysis.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/dukeluo/hexo-theme-candelas/codeql-analysis.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/dukeluo/hexo-theme-candelas/codeql-analysis.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/dukeluo/hexo-theme-candelas/codeql-analysis.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/github-page.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/dukeluo/hexo-theme-candelas/github-page.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/github-page.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/dukeluo/hexo-theme-candelas/github-page.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/dukeluo/hexo-theme-candelas/npm.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/dukeluo/hexo-theme-candelas/npm.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/npm.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dukeluo/hexo-theme-candelas/npm.yml/master?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/github-page.yml:20
Warn: npmCommand not pinned by hash: .github/workflows/npm.yml:15
Info: 0 out of 7 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 2 third-party GitHubAction dependencies pinned
Info: 0 out of 2 npmCommand dependencies pinned

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

2.9

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More