npmpackage.info

Gathering detailed insights and metrics for lerna

lerna

Lerna is a fast, modern build system for managing and publishing multiple JavaScript/TypeScript packages from the same repository.

8.1.9

35,752

MIT

TypeScript

329,476,344 5.1

Installations

npm install lerna

Pull Requests

Open

8

Total

1,371

Closed

388

Merged

975

Issues

Open

380

Total

2,642

Closed

2,262

Releases

239

v8.1.9

Published on 31 Oct 2024

v8.1.8

Published on 05 Aug 2024

v8.1.7

Published on 21 Jul 2024

v8.1.6

Published on 05 Jul 2024

v8.1.5

Published on 24 Jun 2024

v8.1.4

Published on 09 Jun 2024

View all 239 releases

Developer

lerna

Developer Guide

BETA

Module System

CommonJS, ESM

Min. Node Version

>=18.0.0

Typescript Support

No

Node Version

20.18.0

NPM Version

lerna/undefined/node@v20.18.0+arm64 (darwin)

Statistics

35,752 Stars

2,799 Commits

2,261 Forks

251 Watching

34 Branches

336 Contributors

Updated on 28 Nov 2024

Languages

TypeScript (96.63%)

JavaScript (2.36%)

Shell (0.51%)

CSS (0.5%)

Batchfile (0.01%)

Total Downloads

Cumulative downloads

Total Downloads

329,476,344

Last day

-9.1%

250,718

Compared to previous day

Last week

4.4%

1,552,965

Compared to previous week

Last month

23.1%

6,066,403

Compared to previous month

Last year

-9%

61,450,907

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

nx ini tar pify ssri uuid chalk execa is-ci p-map slash upath yargs aproba dedent globby lodash p-pipe pacote rimraf semver envinfo js-yaml p-queue cmd-shim fs-extra get-port inquirer make-dir p-reduce temp-dir byte-size columnify is-stream jest-diff minimatch write-pkg @nx/devkit clone-deep get-stream multimatch node-fetch strip-ansi typescript wide-align cosmiconfig glob-parent graceful-fs has-unicode p-waterfall signal-exit import-local libnpmaccess npm-packlist p-map-series resolve-from set-blocking string-width yargs-parser @lerna/create @octokit/rest color-support git-url-parse libnpmpublish read-cmd-shim load-json-file npm-package-arg @npmcli/arborist init-package-json write-file-atomic @npmcli/run-script npm-registry-fetch @npmcli/package-json strong-log-transformer console-control-strings validate-npm-package-name conventional-changelog-core validate-npm-package-license conventional-recommended-bump conventional-changelog-angular @octokit/plugin-enterprise-rest

Versions

Important note: this project recently changed stewardship to Nrwl!

Your favorite tool is alive and well: https://blog.nrwl.io/lerna-5-1-new-website-new-guides-new-lerna-example-repo-distributed-caching-support-and-speed-64d66410bec7

Lerna

Lerna is a fast, modern build system for managing and publishing multiple JavaScript/TypeScript packages from the same repository.

A few links to help you get started:

Engage with the Core Team and the Community

Want to help?

If you want to file a bug or submit a PR, read up on our guidelines for contributing

Core Team

Victor Savkin	James Henry	Austin Fahsl

vsavkin	JamesHenry	fahslaj

Benjamin Cabanes	Juri Strumpflohner

bcabanes	juristr

Contributors ✨

Thanks goes to these wonderful people (emoji key):

_{Jeff Cross} 💼	_{Daniel Stockman} 💻 📖 🚇 🚧	_{Jamie Kyle} 💻 📖 🚇 🚧	_{Henry Zhu} 💻 📖 🚧	_{Bo Borgerson} 💻 🚧
_Sebastian 💻	_{Joscha Feth} 💻 🐛	_{Norbert Csaba Herczeg} 💻	_{Douglas Wade} 💻

This project follows the all-contributors specification. Contributions of any kind welcome!

No vulnerabilities found.

10

Maintained

Determines if the project is "actively maintained".

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

6

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

5

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

2

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 2

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:129: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:173: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:197: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:202: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/other-node-versions.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/other-node-versions.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/other-node-versions.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/other-node-versions.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/other-node-versions.yml:161: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/other-node-versions.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: npmCommand not pinned by hash: tools/scripts/build.sh:20
Info: 0 out of 11 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 5 third-party GitHubAction dependencies pinned
Info: 3 out of 4 npmCommand dependencies pinned

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

Score

5.1

/10

Last Scanned on 2024-11-18

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More