VuePress pulls in nearly a thousand transitive dependencies. In light of recent security incidents[0][1] and the relative ubiquity of poor security practices[2] in the npm ecosystem, that seems like an unacceptably large attack surface.

I don't want to have to worry about somebody injecting malicious code or cryptocurrency miners into my website by compromising a little-watched transitive dependency in my static site generator.

[0] https://blog.npmjs.org/post/175824896885/incident-report-npm... [1] https://blog.npmjs.org/post/173526807575/reported-malicious-... [2] https://www.bleepingcomputer.com/news/security/52-percent-of...

I'm using VuePress to auto-generate a static, non-interactive site from a set of Vue components and some input data that's updated daily. For me it serves the purpose of a batteries-included way to render Vue to HTML, without messing with SSR libraries, webpack, or Babel configurations myself. I find Vue's composability a much tidier way of doing things than the file-inclusion-based setups typical of systems designed for static site generation.

That said, I've had to write a Python script to do some pre- and post-processing on the VuePress files. Generating a single README.md whose front matter contains my input JSON; stripping out script tags, as there's currently no way to prevent VuePress from generating them in the first place; minifying the HTML; injecting some extra tags; moving files around. There's a bit of a mismatch here between my use case and VuePress's primary role as a documentation generator.

I'd love to be able to call into VuePress as a library, instead of running it as a separate executable, and, for example, pass it my input data directly instead of writing it out to a temporary file for it to read back in. This is something I plan to toy with implementing once I get some free time again (currently bogged down with preparing to give a talk).

I said it before and I'll say it again: VuePress is impressively easy to get started with. Running `vuepress dev` in an empty directory is all you need to get started.

Also, I really love the decision to make `README.md` files act as the `index.html` files. This has the benefit of making your docs easy to read from your projects Github repo.

Looking forward to seeing how it progresses.

Is this in the same space as Sphinx and Doxygen? The VuePress docs only have a trivial markdown example.

How does it compare to docusaurus, gitdocs, and a variety of other tools out there?

I guess there’s no such thing as too many static site generators...

vuepress also generates SEO friendly docs, eg when compared to docsify, but on the flip side docsify has full text search, while the default vuepress theme only searches headers (but since its seo ready most third party search will work ef algolia, google).

I'm enjoying the weekend vue articles that have appeared lately.

All these static site "generators" seem pretty silly. If you're going to make a static site then just make a few template pages by hand in html then copy and edit them to fill with whatever content.

It works even better if your webserver has server side includes (SSI) turned on. Then you can make header/footer/sidebar/etc templates and just insert them with a line in the page templates.