docs: add --no flag to npx command to avoid downloading the incorrect package from npm

Thanks to @alxndrsn for finding this issue and the insightful blog post.
https://www.alxndrsn.com/2024-08-01-npx-binary-confusion/

Also thanks to @lirantal for his newsletter that brought this issue to
my attention.
https://www.nodejs-security.com/newsletter/npm-supply-chain-security-prisma-orm-security-fun-nodejs-security-challenges
This commit is contained in:
Haoqun Jiang
2025-02-24 22:28:16 +08:00
parent cb4477f0d3
commit f36a4edfbd
3 changed files with 19 additions and 19 deletions
+8 -8
View File
@@ -26,7 +26,7 @@ yarn serve
If you have [npx](https://github.com/npm/npx) available (should be bundled with an up-to-date version of npm), you can also invoke the binary directly with:
```bash
npx vue-cli-service serve
npx --no vue-cli-service serve
```
::: tip
@@ -114,13 +114,13 @@ You can use `vue-cli-service inspect` to inspect the webpack config inside a Vue
Some CLI plugins will inject additional commands to `vue-cli-service`. For example, `@vue/cli-plugin-eslint` injects the `vue-cli-service lint` command. You can see all injected commands by running:
```bash
npx vue-cli-service help
npx --no vue-cli-service help
```
You can also learn about the available options of each command with:
```bash
npx vue-cli-service help [command]
npx --no vue-cli-service help [command]
```
## Skipping Plugins
@@ -128,7 +128,7 @@ npx vue-cli-service help [command]
You can exclude specific plugins when running a command by passing the name of the plugin to the `--skip-plugins` option:
```bash
npx vue-cli-service build --skip-plugins pwa
npx --no vue-cli-service build --skip-plugins pwa
```
::: tip
@@ -138,18 +138,18 @@ This option is available for _every_ `vue-cli-service` command, including custom
You can skip multiple plugins by passing their names as a comma-separated list or by repeating the argument:
```bash
npx vue-cli-service build --skip-plugins pwa,apollo --skip-plugins eslint
npx --no vue-cli-service build --skip-plugins pwa,apollo --skip-plugins eslint
```
Plugin names are resolved the same way they are during install, as described [here](./plugins-and-presets.md#installing-plugins-in-an-existing-project)
```bash
# these are all equivalent
npx vue-cli-service build --skip-plugins pwa
npx --no vue-cli-service build --skip-plugins pwa
npx vue-cli-service build --skip-plugins @vue/pwa
npx --no vue-cli-service build --skip-plugins @vue/pwa
npx vue-cli-service build --skip-plugins @vue/cli-plugin-pwa
npx --no vue-cli-service build --skip-plugins @vue/cli-plugin-pwa
```
## Caching and Parallelization
+8 -8
View File
@@ -26,7 +26,7 @@ yarn serve
Если у вас установлен [npx](https://github.com/npm/npx) (должен поставляться в комплекте с последней версией npm), то вы также можете запустить бинарник напрямую:
```bash
npx vue-cli-service serve
npx --no vue-cli-service serve
```
::: tip Совет
@@ -114,13 +114,13 @@ npx vue-cli-service serve
Некоторые плагины CLI добавляют собственные команды в `vue-cli-service`. Например, `@vue/cli-plugin-eslint` внедряет команду `vue-cli-service lint`. Вы можете посмотреть весь список команд запустив:
```bash
npx vue-cli-service help
npx --no vue-cli-service help
```
Вы также можете узнать о доступных параметрах каждой команды с помощью:
```bash
npx vue-cli-service help [command]
npx --no vue-cli-service help [command]
```
## Исключение плагинов при запуске
@@ -128,7 +128,7 @@ npx vue-cli-service help [command]
Можно исключить определённые плагины при запуске команды, передав имя плагина опцией `--skip-plugins`.
```bash
npx vue-cli-service build --skip-plugins pwa
npx --no vue-cli-service build --skip-plugins pwa
```
::: tip СОВЕТ
@@ -138,16 +138,16 @@ npx vue-cli-service build --skip-plugins pwa
Можно пропустить несколько подключаемых плагинов, передав их имена через запятую:
```bash
npx vue-cli-service build --skip-plugins pwa,apollo
npx --no vue-cli-service build --skip-plugins pwa,apollo
```
Имена плагинов разрешаются также, как и при установке, что подробнее описано [здесь](./plugins-and-presets.md#установка-пnагинов-в-существующий-проект)
```bash
# все вызовы равнозначны
npx vue-cli-service build --skip-plugins pwa
npx vue-cli-service build --skip-plugins @vue/pwa
npx vue-cli-service build --skip-plugins @vue/cli-plugin-pwa
npx --no vue-cli-service build --skip-plugins pwa
npx --no vue-cli-service build --skip-plugins @vue/pwa
npx --no vue-cli-service build --skip-plugins @vue/cli-plugin-pwa
```
## Кэширование и параллелизация
+3 -3
View File
@@ -26,7 +26,7 @@ yarn serve
如果你可以使用 [npx](https://github.com/npm/npx) (最新版的 npm 应该已经自带),也可以直接这样调用命令:
```bash
npx vue-cli-service serve
npx --no vue-cli-service serve
```
::: tip 提示
@@ -103,13 +103,13 @@ npx vue-cli-service serve
有些 CLI 插件会向 `vue-cli-service` 注入额外的命令。例如 `@vue/cli-plugin-eslint` 会注入 `vue-cli-service lint` 命令。你可以运行以下命令查看所有注入的命令:
```bash
npx vue-cli-service help
npx --no vue-cli-service help
```
你也可以这样学习每个命令可用的选项:
```bash
npx vue-cli-service help [command]
npx --no vue-cli-service help [command]
```
## 缓存和并行处理