Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I was just talking about this with a colleague. We really want to join the beta at my company. Would be happy to sign up for the pro plan!

One note though, I want to point out, that I am able to "break" some of the demo components, like changing type="number" doesn't seem to error the form when I input text over it.

In case one of the other maintainers sees this, I have one other question:

Does this in any way use `eval`? I know a lot of JSON schema validators do, and that is a pain when it comes to CSP. If Formkit doesn't use eval (and maybe we can get a commitment on that...) its a no brainer



I didn’t know that a lot of these schema systems use eval. Surprising, why is that?

As far as I can tell, my go-to schema system doesn’t. https://github.com/colinhacks/zod


Anything that uses `ajv` under the hood and doesn't use their compile schema options. They use `eval`[0] for a number of things.

Quite a lot of schema validators use `ajv` under the hood. Some, like I believe `yup`, `zod` and `superstruct` do not. I'm not sure why one approach is more advantageous than another, to be honest. I'd think eval would also be a performance issue.

[0]: https://ajv.js.org/security.html#content-security-policy


They there! The beta is public so you’re welcome to install from NPM and use. If you have issues we’d be happy to help out in Discord.

The schema parser is custom-written and does not make use of `eval`.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: