harp

library0.47.2jsnpmunverified

Harp is a zero-configuration static web server, generator, and bundler for Node.js. It implicitly pre-processes a wide range of web assets, including Jade, Markdown, EJS, Less, Stylus, Sass, SCSS, CoffeeScript, JSX, and CJS, converting them into HTML, CSS, and JavaScript. The current stable version is 0.47.2, with recent releases primarily focusing on critical security patches and maintenance rather than new feature development, indicating a mature but less actively evolving project. Harp differentiates itself by offering a simple, fast, and lightweight solution that aims to avoid complex build steps or task runners. It features first-class layout and partial support, intelligent path redirects, and the crucial ability to export an entire project to static assets for easy deployment. It also includes implicit vendor prefixing for CSS preprocessors via Autoprefixer. Harp is ideal for publishing simple front-ends with minimal setup and low cognitive overhead, positioning itself as an alternative to heavier web frameworks.

web-framework devops

npm install harp

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · HARP

harp

web-frameworkjavascriptv0.47.2

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

harp

✓ const harp = require('harp')

✗ import harp from 'harp'

Harp is primarily a CommonJS module and does not natively support ES module `import` syntax. The main `harp` object provides server and compilation methods.

harp.server

✓ const harp = require('harp'); harp.server(__dirname);

✗ import { server } from 'harp'

The server functionality is accessed as a method on the default `harp` object, not as a named export. Ensure the module is imported via `require` first.

harp.compile

✓ const harp = require('harp'); harp.compile(__dirname, './dist', () => console.log('Compiled!'));

✗ import { compile } from 'harp'

The compilation functionality is accessed as a method on the default `harp` object, not as a named export. It's a callback-based API for completion.

Installs Harp globally, creates a new project with a Jade template and SCSS stylesheet, starts the development server, and then compiles the project to static assets.

#!/bin/bash # Install Harp globally npm install -g harp # Create a new project directory mkdir harp-project cd harp-project # Create a basic Jade template echo "doctype html\nhtml\n head\n title My Harp Site\n link(rel='stylesheet', href='/main.css')\n body\n h1 Welcome to Harp!\n p This is a zero-configuration static site." > index.jade # Create a simple SCSS stylesheet echo "body { font-family: sans-serif; h1 { color: #333; } }" > main.scss # Create _harp.json for potential configuration (e.g., basicAuth) echo '{ "globals": { "siteName": "My Harp Project" } }' > _harp.json echo "\n--- Starting Harp server ---\nAccess at http://localhost:9000\n" # Start the Harp server in the background harp . & SERVER_PID=$! # Wait a moment for the server to start sleep 3 echo "\n--- Compiling project to static assets ---\n" # Compile the project to a 'www' directory harp . www echo "\n--- Compiled project available in 'www' directory ---\n" # Clean up server process kill $SERVER_PID echo "\nTo view compiled site: cd www && python -m http.server 8000\nTo restart dev server: harp ."

harp --version

Debug

Known issues

breakingVersions prior to `0.40.2` are vulnerable to 'Unauthorized File Access via encoded underscore' (CVE-2019-10779), allowing attackers to access arbitrary files. This is a critical security vulnerability.

fix

Upgrade to `harp@0.40.2` or later immediately. Ensure all deployments use a patched version.

affects: <0.40.2

breakingStarting from `v0.40.3`, Harp introduced a `--deny-symlinks` flag. If your project relied on serving symlinks, they will now result in a 'Forbidden' response unless this flag is explicitly managed.

fix

Review your project for implicit symlink usage. If symlinks are essential, consider restructuring your project or carefully using the `--deny-symlinks` flag with appropriate security considerations.

affects: >=0.40.3

gotchaHarp is primarily a CommonJS library and does not officially support ES Modules (`import/export` syntax). Attempting to use it in an ESM context will lead to runtime errors.

fix

Ensure Harp is used within a CommonJS environment or project. If integrating with ESM, consider using a CJS wrapper or bundler that correctly handles CJS dependencies.

affects: >=0.1.0

gotchaSpecific versions, notably `v0.20.2`, introduced critical bugs such as address binding errors when starting the server and RangeErrors during compilation, which were fixed in `v0.20.3`.

fix

Avoid using `harp@0.20.2`. If you are on this version, upgrade to `v0.20.3` or any later stable version to resolve these issues.

affects: 0.20.2

gotchaWhile Harp has broad Node.js compatibility (`>=6.x`), its ecosystem dependencies (like `node-sass`, `jade`) may have their own compatibility constraints. Running Harp with very new or very old Node.js versions might encounter build issues or require specific dependency versions.

fix

Refer to Harp's `package.json` for recommended Node.js versions. If encountering issues, try running with Node.js LTS versions (e.g., Node 16 or 18 at the time of v0.47.2's release) or check specific preprocessor library compatibility.

affects: >=0.1.0

Errors

Common errors & fixes

Error: listen EADDRINUSE :::9000

The default port 9000 is already in use by another process, or a Harp server was not properly shut down.

fix

Specify a different port using `harp --port <new_port>` or `harp -p <new_port>`. Ensure no other processes are running on the desired port.

Forbidden

Harp is attempting to serve a file that is a symbolic link, and the `--deny-symlinks` flag is active (default since v0.40.3).

fix

Restructure your project to avoid symlinks for publicly served files, or if you understand the security implications, verify Harp's documentation for overriding this behavior (if available, generally not recommended).

ReferenceError: require is not defined

You are attempting to use `require('harp')` within an ES Module (ESM) context, which does not support CommonJS `require` calls.

fix

Ensure your project is configured as a CommonJS module (`'type': 'commonjs'` in `package.json` or by not specifying `type` for older Node.js versions) when using Harp, or use a tool like Webpack to bundle CJS modules for ESM consumption if absolutely necessary.

RangeError: Maximum call stack size exceeded

This can occur during the `harp compile` process, especially in `v0.20.2`, due to an internal bug with certain project structures or large compilation tasks.

fix

Upgrade Harp to `v0.20.3` or a later version. If the issue persists on newer versions, simplify complex template structures or report the issue to the Harp repository.

Upgrade

Version history

0.47.2latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

8 hits · last 30 days

node

Resources

githubhttps://github.com/sintaxi/harp ↗

packagehttps://www.npmjs.com/package/harp ↗

homepagehttps://harpjs.com ↗