esprima VS jscodeshift

I'm particularly fond of Firecracker, but it’s a bit of work to set up, so if you cannot afford the time yet, you want to be on the safe side, do a combination of static analysis and time-boxing execution. You can use esprima to parse the code and check for any malicious act.

Focusing again on ESLint, the parser used by the linter is called Espree. This is an in-house parser built by the ESLint folks to fully support ECMAScript 6 and JSX on top of the already existing Esprima. The Espree module provide APIs for both tokenization and parsing that you can easily test out.

For TypeScript we have used AST transforms from their compiler API, and for plain JavaScript we did a similar thing using ESPrima. This helped us implement some simple optimizations like stream fusion (combining .filter and .map into a single operation) or avoiding extra object allocations in vector math, which led to nice performance improvements in code that does heavy computation (we process large amounts of data on the server and store results of physics simulations).

I used ESPrima, but any parser would do in this case. I then wrote a simple function to extract all "atomic" non-boolean expressions from it.

AST is an acronym for Abstract Syntax Tree. It's the way to represent code in a format that tools can understand. Usually in form of tree data structure. We will use AST in the format of an Esprima, which is a JavaScript parser that outputs AST.

esprima

Create an AST: Esprima

The thread was originally about CRA vs Vite size on disk (or implicitly, if we're applying it to real world applications, network cost in CI job startup times). And like I said, surrogate pairs don't apply to ASCII.

See this[0] for reference. Note how the first byte must fall within a certain range in order to signal being a surrogate pair. This fact is taken advantage of by JS parsers to make parsing of ASCII code faster by special casing that range, since checking for a valid character in the entire unicode range is quite a bit more expensive[1].

[0] https://github.com/jquery/esprima/blob/0911ad869928fd218371b...

[1] https://github.com/jquery/esprima/blob/0911ad869928fd218371b...

If you want to learn more about parsing, reading the code of an actual recursive parser might be a better idea. Esprima is a decent place to start if you're interested in JS grammar. Then you can look at the babel handbook to learn more about AST transformations. From there, the literature gets quite a bit more heavy. If you get this far and are willing to push further, you'll probably want to grab yourself a copy of the dragon book at a minimum.

A parser can have various applications in everyday life, and you probably use some parser daily. Babel, webpack, eslint, prettier, and jscodeshift. All of them, behind the scenes, run a parser that manipulates an Abstract Syntax Tree (AST) to do what you need - we'll talk about that later, don't worry.

OP: If this is an avenue you feel like entertaining, here are some nice codemod tools that could ease the transition for you: CodeQue, Subsecond, and the old standard jscodeshift.

If that isn't enough or you find issues with it, the current de-facto standard for codemods is jscodeshift. You'll write more code, but at least you only have to write it once.

Here is the pull request https://github.com/facebook/jscodeshift/pull/549

Those are important but tough problems!

1. I feel like codemods and a setup shell prompt are the best solution to this, but this looks different for each language (eg, in JS there is https://github.com/facebook/jscodeshift). I could make UI around that for listers to provide parts of the app that should replaced and buyers to provide values for it, but it could be quite a rabbit hole. This is actually why I show the README for the repos, so users can see if the setup steps are comprehensive before buying (for paid ones).

2. I agree atomic commits can help someone navigate a new codebase. In the same spirit as my response to #1, I don't feel confident I could enforce this, but I could surface the commits on the starter repo page so potential buyers could see if the author laid things out well.

Thanks for the ideas!

That's why I've been working on a tool that automatically upgrades major versions of libraries with breaking changes, the idea is to simplify the process and save developers time and effort by having a bank of transformers (using codemod & jscodeshift) and open source them:

JSCodeshift: A toolkit for running and writing codemods.

jscodeshift