JavaScript

@porro/js-connector reports to Porro on every production build: the framework and Node versions, and the packages in your lock file, so Porro can raise security advisories, updates waiting and versions past support. It runs at build time, so it works wherever you build: Forge, Laravel Cloud, Cloudflare Pages, Vercel, Netlify or your own CI. Nothing connects into your site and nothing runs in production.

It has no panel: it needs a Porro account.

Install

npm install --save-dev @porro/js-connector
npx @porro/js-connector connect <site key>

connect sends the first report and adds && porro-connector to your build script. Commit that change, then add the key to your host's production environment variables, not the repo:

PORRO_KEY=<site key>

A build without PORRO_KEY (your machine, preview deploys) skips the report, and a failed report never fails your build.

What it sends

• Node's version, and the framework's: Nuxt, Next, Astro, SvelteKit, Remix, Angular, Vue, React, Svelte or Vite
• The deploy environment, from VERCEL_ENV, Netlify's CONTEXT, CF_PAGES_BRANCH or NODE_ENV (PORRO_ENV overrides it)
• Each package's name and version from package-lock.json, pnpm-lock.yaml or yarn.lock, and whether it's direct or dev
• A SHA-256 of the lock file, and whether source maps are published with the site

Never source code, the lock file itself, environment values or secrets. npx @porro/js-connector --dry-run prints exactly what would be sent.

Options